Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 de1ec15823c3d707…

MALICIOUS

Office (OOXML) / .DOC

137.2 KB Created: 2021-03-11 10:39:00 UTC Authoring application: Microsoft Office Word 15.0000
MD5: ac33ee5032e398b9c27377762e1f7f17 SHA-1: 56089cc1a763cf6a078babee414ff6b9ab522a8a SHA-256: de1ec15823c3d7078339d1211ffeafd491e23c409d8d55dcc25c552beb9d3c5b
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file contains VBA macros, including a Document_Open macro, which is a common technique for initial execution. The heuristics indicate the use of GetObject, suggesting an attempt to load and execute external code. The embedded VBA code appears to be obfuscated but contains elements that suggest it attempts to gather system information and potentially download a second-stage payload. The presence of a Document_Open macro and the GetObject call strongly indicate a malicious intent to execute arbitrary code upon opening the document.

Heuristics 4

  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
24ece28a3a5dc05d22377a67ffb639a8c571d5e4c1f155882e08253368788554		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3641 bytes
vbaProject_00.bin
5591454db899545cd2ede6b0b876de9f0c3ba627759aec18378b9e1a016e4f84		 vba-project OOXML VBA project: word/vbaProject.bin 18944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.