MALICIOUS
222
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The sample contains VBA macros with an Auto_Open subroutine that utilizes CreateObject to instantiate Shell.Application and then calls ShellExecute. This indicates an attempt to execute arbitrary commands, likely to download and run a secondary payload. The presence of mshta.exe references further supports the execution of external content. The URL provided is confirmed benign, but the macro's functionality is highly suspicious.
Heuristics 7
-
Reference to ShellExecute API high SC_STR_SHELLEXECReference to ShellExecute API
-
Reference to mshta.exe high SC_STR_MSHTAReference to mshta.exe
-
Auto_Open macro high OLE_VBA_AUTOAuto_Open macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.bitly.com/bdksahdjasdsa
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas7602931b4464dac084362d3ae06d89d05748055a2830e7ba1cfe6debb4e5efc1 |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 923 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.