Example report
Remittance-Advice-2026-08.docm
| block | 8/ 100 | F12 / 100 | not established |
| verdict | file trust | vendor risk | attribution |
|---|---|---|---|
| confidence high, risk high | 5 weighted factors | identity not established | no identity established |
Verdict
The macro source stored in this document does not match the compiled code that would execute. Both are present, both were extracted, and they describe different programs. That mismatch has no legitimate cause and is the entire basis for this verdict.
Key findings
- VBA stomping detected. The readable source describes a date-formatting routine. The compiled p-code alongside it does not implement that routine, and the two were extracted from the same module in the same pass.
- An automatic entry point is present. The module runs on open without user interaction beyond enabling content, so the divergence is not academic.
- Any tool that reads only the stored source sees a document that formats dates. The source is not merely misleading: it was written to be read instead of the code that runs.
- Document metadata claims an author and organisation with no corroboration anywhere in the file. Treated as an unauthenticated string and given no weight.
Recommended actions
- ImmediatelyBlock this hash and quarantine any copies. The verdict rests on a structural property of the file, not on a reputation signal that might change.
- ImmediatelyEstablish how it arrived and who has opened it. The extracted observables below give you the search terms.
- Follow-upCheck the shared drive for siblings. Stomped documents rarely arrive alone, and similarity clustering against your own history is the cheapest way to find them.
- PolicyIf macro-enabled documents from outside the organisation have a business case, scope it narrowly. If they do not, this file is an argument for blocking the class.
Decision4Why it concluded that, and whether to approve
Verdict factors
| factor | reading | weight | detail |
|---|---|---|---|
| Source and p-code agreement | attention | high | The two representations of the same module describe different programs. Structural, reproducible, and not a matter of interpretation. |
| Automatic execution | attention | high | An auto-run entry point is present, so the divergence executes rather than sitting inert. |
| Malicious signals | attention | high | Rule matches on obfuscation patterns within the recovered p-code. |
| Publisher identity | neutral | medium | Unsigned, and document metadata is an unauthenticated string. No identity established, and none claimed here. |
| Document category | neutral | medium | Macro-enabled document from outside the organisation. Elevated baseline by category. |
| Terms-of-service posture | neutral | low | Not applicable. |
Scores
8/ 100 file trust
| dimension | weight | score | note |
|---|---|---|---|
| Malicious signals | 40% | 0 | Stomping plus obfuscation in recovered p-code |
| Code signing | 20% | 0 | Unsigned; no VBA project signature |
| Vendor reputation | 20% | 20 | No identity established to attach reputation to |
| Software category | 15% | 20 | External macro-enabled document |
| Terms-of-service posture | 5% | 50 | Not applicable |
Vendor2Who published this, and what corroborates it
Vendor intelligence
F12 / 100 vendor risk · identity estimated · evidence completeness 11%
Identity confidence is graded, not asserted. Every line below is tied to something in the artifact itself: a certificate subject, a declared product string, because a package name is not a vendor.
| dimension | weight | score | note |
|---|---|---|---|
| Identity verification | 25% | 0 | Metadata strings only, contradicted by the file itself |
| Security posture | 25% | 0 | No identifiable publisher |
| Code signing | 15% | 0 | Unsigned |
| Licence compliance | 15% | 40 | Not applicable to a document |
| Community health | 10% | 0 | Not applicable |
| Vendor maturity | 10% | 0 | No entity to assess |
No identity is established and none is claimed. Where the unsigned binary had three unauthenticated properties agreeing with one another, this document has metadata contradicted by its own structure, which is worse than absent evidence, because a name that disagrees with the artifact is a reason to trust the artifact less, not a weaker reason to trust the name.
Evidence
| source | tied to | says |
|---|---|---|
| Document metadata | Author and Company fields inside the file | Strings naming an organisation, with nothing in the file corroborating them |
| VBA project signature | The macro project itself | Absent: the project is unsigned |
| Creating application | Application string in document properties | Inconsistent with the OOXML structure actually present |
Enterprise readiness
| Deployment method | Not applicable (document) |
|---|---|
| Macro project | Present, unsigned |
| Automatic execution | Yes, runs on open once content is enabled |
| External references | None in the document body |
| Embedded objects | None |
| Protected view bypass | None attempted |
| Origin | Outside the organisation |
Approval readiness
Block
Conditions
- Hash blocked and copies quarantined
- Arrival path and open history established
- Shared drive checked for related documents
Rules matched
| No malicious signals | block |
|---|---|
| Macro-enabled document from outside the organisation | review |
| Signed by verified publisher | review |
| Minimum trust score ≥ 70 | block |
Compliance3Framework posture, obligations, and the limits
Compliance
| framework | met | gap | review |
|---|---|---|---|
| NIST SP 800-53 | 2 | 3 | 1 |
| SOC 2 | 1 | 2 | 1 |
| ISO 27001:2022 A.8 | 2 | 2 | 1 |
| CMMC 2.0 | 1 | 2 | 1 |
| PCI-DSS v4.0 | 1 | 1 | 1 |
| HIPAA Security Rule | 1 | 1 | 0 |
| GDPR | 1 | 0 | 1 |
Controls
| control | status | note |
|---|---|---|
| SI-3Malicious code protectionNIST SP 800-53 | gap | Content reached a user-accessible location before analysis |
| SI-7Software integrityNIST SP 800-53 | gap | The document’s own representations of its code are inconsistent |
| SC-18Mobile codeNIST SP 800-53 | gap | Auto-executing macro content from an external origin |
| AC-4Information flow enforcementNIST SP 800-53 | review | Arrival path through a shared drive needs establishing |
| CC6.8Unauthorised softwareSOC 2 | gap | Executable content present in a document store |
| A.8.7Protection against malwareISO 27001:2022 A.8 | gap | Detected at analysis rather than at ingress |
Licence obligations
Not applicable. A document carries no licence terms of its own.
| obligation | applies | note |
|---|---|---|
| Commercial-use restriction | no | Not applicable |
| Attribution | no | Not applicable |
| Copyleft | no | Not applicable |
| Source disclosure | no | Not applicable |
| Patent grant | no | Not applicable |
Analysis coverage
What was examined, and what was not. The limits belong next to the decision, not behind it.
Examined
| OOXML package structure and every part within it | full |
|---|---|
| VBA project, stored source, decompressed | full |
| VBA project, compiled p-code stream | full |
| Comparison between the two, which is where the finding is | full |
| Document properties and relationships | full |
| Rule matching across extracted content | full |
Not examined
| Advisory and vulnerability status | Not assessed. This report describes what the file is and who made it, not what is known to be wrong with the software. |
|---|---|
| Runtime behaviour | Static analysis only. The macro was never executed, and nothing here describes what happens if it is. |
| Network destinations contacted at runtime | Would require execution. The observables below are strings recovered from the file, not connections observed. |
| Multi-engine antivirus verdicts | Multi-engine antivirus runs on a customer-supplied key by design: the quota and the data-sharing decision stay with you rather than with us. No key is attached to this example, so no engines were consulted. |
Composition4What it is made of, and what identifies it
File overview
| Type | Microsoft Word 2007+ document, macro-enabled (OOXML) |
|---|---|
| Family | Office document |
| Size | 284 KB |
| Submitted | 2026-08-05T11:22:16Z |
| Completed | 2026-08-05T11:22:41Z |
File identifiers
| SHA-256 | d41b8f0a37c692e584b0179ac35fe2d6018b47c93a5e60f24db8137ea0c9f5b6 |
|---|---|
| SHA-1 | 9a3f61b04e7c25d8130af6b92e04c7185da3e0f1 |
| MD5 | 6b09e2fa17c4d385021ba7e94f3c60d8 |
| TLSH | T1C82E5B37A0D94F16C35E0728BD64A19F3C05E86D2A47B901FE35C6D08B472AE19D30F5 |
Names
| Submitted as | Remittance-Advice-2026-08.docm |
|---|---|
| Title property | Remittance Advice |
| Author property | Unauthenticated string |
| Company property | Unauthenticated string |
Nearest in your own history
| artifact | tlsh distance | seen |
|---|---|---|
| Payment-Confirmation-2026-07.docm | 18 | 2026-07-29 |
| Remittance-Advice-2026-07.docm | 24 | 2026-07-02 |
Technical details
| Container | OOXML (ZIP) |
|---|---|
| Parts | 14 |
| Macro project | word/vbaProject.bin |
| VBA modules | 2 |
| Project signature | Absent |
| Created | 2026-08-04T22:07:11Z (document property, unauthenticated) |
| Modified | 2026-08-04T22:09:38Z (document property, unauthenticated) |
| Creating application | Declared string inconsistent with the structure present |
Sections
| name | characteristics | entropy | note |
|---|---|---|---|
| word/document.xml | Document body | 5.12 | Two paragraphs of ordinary invoice text |
| word/vbaProject.bin | OLE compound file, macro project | 7.41 | High entropy relative to the rest of the package |
| word/vbaProject.bin :: PROJECT | Stored source stream | 4.88 | The version every source reader sees |
| word/vbaProject.bin :: _VBA_PROJECT | Compiled p-code stream | 7.63 | The version that executes |
| docProps/core.xml | Document properties | 4.21 |
Signature
| Document signature | Absent |
|---|---|
| VBA project signature | Absent |
| Consequence | Nothing in the file attests to its origin. The metadata naming an author is a string a user typed, not a claim anyone stands behind. |
Enrichment
| source | consulted | result |
|---|---|---|
| Known-malware hash intelligence | yes | No record for this hashAbsence of a record is not evidence of safety, and this verdict does not depend on it. The finding is structural. |
| Community threat-intelligence pulses | yes | No pulses reference this artifactNever sufficient on its own: a single uncorroborated feed does not drive a verdict in either direction, and none drove this one. |
| Certificate transparency | no | Not applicableNo certificate present. |
| Company registration | no | Not applicableNo verified organisation name to look up. The metadata string is not treated as one. |
| Licence resolution | no | Not applicable |
| Multi-engine antivirus | no | Not consultedMulti-engine antivirus runs on your own vendor key by design: your quota, your data-sharing terms, not ours. That is a deliberate product decision rather than a limitation. No key is attached to this example, so no engines were consulted and no engine result appears anywhere in this report. |
Extracted macrosnot shipped
Source extraction and stomping detection are real. Recovering intent from compiled p-code is partial: the divergence is detected reliably, the reconstruction of what the p-code does is best-effort.
Everything below was extracted from the document and is displayed as inert text. It is not executable here, it was not executed during analysis, and no part of this page runs it. It is shown because reading it is the point.
Module1source and p-code agree
Stored source: what a reader sees
' Formats invoice dates for the remittance table
Public Sub FormatDates()
Dim c As Range
For Each c In ActiveDocument.Range.Cells
If IsDate(c.Range.Text) Then
c.Range.Text = Format(CDate(c.Range.Text), "dd mmm yyyy")
End If
Next c
End SubCompiled p-code: what would execute
Matches the stored source. This module is what it says it is, and it is included so the comparison below has a control.
ThisDocumentruns on opensource and p-code disagree
Stored source: what a reader sees
' Applies house formatting on open
Private Sub Document_Open()
Application.ScreenUpdating = True
FormatDates
End SubCompiled p-code: what would execute
Does not match. The recovered p-code for this module contains string-concatenation and character-code arithmetic that assemble a command line at runtime, followed by a call through a shell interface. Nothing resembling FormatDates appears in the compiled stream, and nothing resembling the compiled stream appears in the stored source.
Stored source and compiled p-code describe different programs
Word executes the compiled p-code and ignores the stored source when the compiled version targets the running Office release. The stored source exists to be read. Replacing it while leaving the p-code intact is what stomping is, and it defeats every tool that inspects macro source without also decompiling.
This is the clearest case on the site for reading a file rather than looking it up. There is no name to query, no hash to recognise, no publisher to check. The finding exists only because both representations were extracted and compared, and it would survive the document being renamed, re-saved, or sent from a different address.
Forensics2What it touches, and when
Indicators and behaviournot shipped
ATT&CK technique mapping and D3FEND pairing are designed here at a depth the current pipeline does not reach. Observable extraction is real; the mapping from observable to technique is partly manual today.
Observables
| type | value | context |
|---|---|---|
| String fragment | Chr(104) & Chr(116) & Chr(116) & Chr(112) | Character-code assembly in recovered p-code |
| Interface | WScript.Shell | Late-bound object reference in recovered p-code |
| Entry point | Document_Open | Automatic execution on open |
| Filename | Payment-Confirmation-2026-07.docm | Near neighbour in this tenant’s own history |
Techniques
| technique | why it is listed | countermeasure |
|---|---|---|
| T1566.001Phishing: Spearphishing Attachment | Macro-enabled document with an invoice pretext, arriving from outside the organisation. | Message and attachment analysis at ingress |
| T1204.002User Execution: Malicious File | Execution requires a user to enable content, which is the only control standing between arrival and execution. | Macro execution policy |
| T1027Obfuscated Files or Information | Character-code arithmetic assembling strings at runtime, plus the source and p-code divergence itself. | Static content analysis |
| T1059.005Command and Scripting Interpreter: Visual Basic | The executing code is VBA reaching a shell interface. | Script execution logging |
Timelinenot shipped
Reconstructed from artifact timestamps and analysis events. Ordering across sources is best-effort, clock skew between a build host and an analysis host is not resolved.
| when | event | from | confidence |
|---|---|---|---|
| 2026-08-04T22:07:11Z | Document created | Document property, asserted by the file, unverifiable | |
| 2026-08-04T22:09:38Z | Document last modified | Document property, asserted by the file, unverifiable | |
| 2026-07-29T00:00:00Z | Near-identical document analysed in this tenant | Similarity history | |
| 2026-08-05T11:22:16Z | Collected from shared drive | Cloud storage connector | |
| 2026-08-05T11:22:41Z | Analysis completed | Analysis record |
More of this
New posts on what a file tells you before you run it: headers, signatures, manifests, overlays, the fields most inventory never reads. Only when there is something worth the write-up.
We intend to offer a tool that does this across every file on an endpoint. You get one message when you can use it.