Office (OOXML) / .DOCX malware analysis — malicious · f00836a63be7ebf1

MALICIOUS

Office (OOXML) / .DOCX

802.0 KB First seen: 2026-01-19

MD5: 8f57948e69c82bf98704f129c5460576 SHA-1: 33e277af0cea397252c23d310961f803be5cdf2b SHA-256: f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44

142 Risk Score

Malware Insights

MITRE ATT&CK

T1059 Command and Scripting Interpreter T1204 Malicious Link T1105 Ingress Tool Transfer

The OOXML document contains embedded URLs and exhibits characteristics of a malicious container, indicated by the POLYGLOT_ZIP_PREFIXED heuristic. The presence of VirtualAlloc, LoadLibrary, and GetProcAddress API references suggests the document is designed to load and execute code, likely a second-stage payload. The embedded URL, though currently benign, is a common vector for initial compromise.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
ZIP/OOXML container with non-ZIP prefix bytes high POLYGLOT_ZIP_PREFIXED

Non-empty bytes appear before the first ZIP local-file header. Format-aware parsers will see only the leading content while ZIP-aware parsers will scan forward and successfully open the archive — a classic polyglot delivery pattern.
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/SMI/2016/WindowsSettings

Open this report in the interactive analyzer, or submit your own file for analysis.