MALICIOUS
180
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file is identified as malicious by ClamAV with the signature Doc.Trojan.Proverb-1. Static analysis revealed the presence of VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening the document. The macros themselves appear to be obfuscated with what looks like Russian text, suggesting an attempt to hide their true functionality, which is likely to download and execute a second-stage payload.
Heuristics 3
-
ClamAV: Doc.Trojan.Proverb-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Proverb-1
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 93256 bytes |
SHA-256: a1a576f1940d439ca7dd3fdbe9128be65def76c6761e10b886821d38419fc093 |
|||
|
Detection
ClamAV:
Doc.Trojan.Proverb-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'Ëţáčřü ęŕňŕňüń˙ - ďîëĺçŕé â ęóçîâ. 'Hŕ áĺçpűáüĺ č ńëîíŕ čç ěóőč ńäĺëŕĺřü. 'Hŕ áĺçáŕáüĺ č đűáó đŕęîě. 'Hŕ áĺçďňč÷üĺ č ćîďŕ ńîëîâĺé. 'Hŕ áĺçđűáüĺ č ńŕě đŕęîě ńňŕíĺřü. 'Hŕ âîđĺ č řŕďęŕ ăëŕçŕ ęîëĺň. 'Hŕ ăîëîě ňĺëĺ - çäîđîâűé äóő. 'Hŕ íĺň íč ňóäŕ íč ńóäŕ íĺň. 'Hŕ ďîćŕđĺ č őđĺí - âîäîďđîâîä. 'Hŕ Đîäčíĺ őîđîřî, ŕ äîěŕ ëó÷řĺ! 'Hŕ őŕë˙âó č "ĐŔĚŔ" - ńëčâî÷íîĺ ěŕńëî. 'Hŕ őŕë˙âó č çâĺđü áĺćčň. 'Hŕ ÷óćîé ëîáîę íĺ đŕçĺâŕé đîňîę! 'Hŕ ÷óćóţ ęđîâŕňü đîň íĺ đŕçĺâŕňü! 'Hŕăëîńňü - âňîđîĺ ń÷ŕńňüĺ. 'Hŕçâŕëń˙ ăđóçäĺě, îáîńđŕëń˙ č ńňîé. 'Hŕçâŕëń˙ ęëčçěîé - ďîëĺçŕé â ćîďó. 'Hŕęîń˙ -ę, âűęópč! 'Hŕđîäó ńîáđŕëîńü - ˙áëîęó ďëţíóňü íĺăäĺ! 'Hĺ pîé ˙ěó äpóăîěó, ÷ňîáű îí íĺ čńďîëüçîâŕë ĺĺ ęŕę îęîď. 'Hĺ âîäęîé ĺäčíîé ďü˙í ÷ĺëîâĺę! 'Hĺ âńĺ ňî çîëîňî, ÷ňî ďëîőî ëĺćčň. 'Hĺ âńĺ ňî ńîëíűřęî, ÷ňî âńňŕĺň. 'Hĺ ăîâîđč ăîď, ęîëč đîćŕ ęđčâŕ. 'Hĺ äŕâřč - ęđĺďčńü, ŕ äŕâřč - äĺđćčńü! 'Hĺ čěĺé ńňî äđóçĺé, ŕ čěĺé âńĺő âđŕăîâ! 'Hĺ čěĺé ńňî äđóçĺé, ŕ čěĺé íŕăëóţ đîćó. 'Hĺ čěĺé ńňî đóáëĺé, ŕ čěĺé ńňî áŕęńîâ! 'Hĺ íűňüĺě, ňŕę ęŕęŕíüĺě! 'Hĺ îňęëŕäűâŕé íŕ çŕâňpŕ ňî, ÷ňî ěîćíî âűďčňü ńĺăîäí˙. 'Hĺ îňęëŕäűâŕé íŕ çŕâňđŕ ňó, ÷ňî ěîćĺřü óćĺ ńĺăîäí˙! 'Hĺ ďĺé čç ęîëîäöŕ - ďđčăîäčňń˙ ďëţíóňü. 'Hĺ ďĺí˙é íŕ çĺđęŕëî, ęîëč ˙éöŕ ěĺřŕţň. 'Hĺ ďĺí˙é íŕ çĺđęŕëî, ďîęŕ íĺ ďĺđĺďđűăíĺřü. 'Hĺ ďëţé â ęŕëîřó - ďđčăîäčňń˙ â íĺĺ ńŕäčňüń˙! 'Hĺ ďëţé â ęîëîäĺö - âűëĺňčň íĺ ďîéěŕĺřü. 'Hĺ ďëţé â ęîëîäĺö - ńŕě ňóäŕ ďîďŕäĺřü. 'Hĺ ďëţé â ęîëîäĺö - ňŕě ćĺ íčęîăî íĺň... 'Hĺ ďîćĺëŕé áëčćíĺěó ćĺíű ńâîĺé. 'Hĺ ďîěčíŕéňĺ Ăîńďîäŕ... âńóíĺě! 'Hĺ ńëĺäč çŕ őâîńňîě, ŕ ňî íĺ çŕěĺňčřü đîăîâ... 'Hĺ ńďĺřč, ŕ ňî óńďĺĺřü! 'Hĺ ńóé ńâîé âçíîń íĺ â ńâîĺ äĺëî! 'Hĺ ňŕę ńňđŕřĺí ÷ĺđň, ęŕę ĺăî ěŕëţňęŕ! 'Hĺ ň˙íč đĺçčíó çŕ őâîńň â äîëăčé ˙ůčę. 'Hĺ óâĺđĺí - íĺ ňîđěîçč! 'Hĺ ˙éöŕ ęđŕń˙ň ÷ĺëîâĺęŕ, ŕ ÷ĺëîâĺę ˙éöŕ! 'Hĺň ďîâĺńňč ďĺ÷ŕëüíĺĺ íŕ ńâĺňĺ, ÷ĺě ďîâĺńňü î ěčíüĺňĺ â ňóŕëĺňĺ. 'Hĺň ďîâĺńňč ďĺ÷ŕëüíĺĺ íŕ ńâĺňĺ,÷ĺě ďîâĺńňü î çŕęëčíčâřĺě RESETe... 'Hĺ÷ŕ íŕ çĺđęŕëî ďĺí˙ňü - ęîëč! 'Hĺ÷ĺăî çĺđęŕëî ďčíŕňü, ęîëč đîćŕ ęđčâŕ. 'Hč ďóęŕ, íč ď¸đŕ! 'Ŕ çîěáč çäĺńü ňčőčĺ 'Ŕ íĺ ďîéňč ëč ěíĺ íŕ đŕáîňó,- ďîäóěŕë ˙. Č íĺ ďîřĺë. 'Ŕ ńóďđóćĺńęčé äîëă îňäŕé Đóáë˙ěč 'Ŕ ń÷ŕńňüĺ áűëî ňŕę âîçěîćíî.... č ňŕę âîçěîćíî...č âîň ňŕę... 'Ŕëęîăîëü â ěŕëűő äîçŕő áĺçâđĺäĺí â ëţáîě ęîëč÷ĺńňâĺ! 'Ŕěĺđčęŕíöű - ěű čç íĺăđîâ çâĺçä íĺ äĺëŕĺě 'Áŕáŕ ń âîçó - âűëĺňčň - íĺ ďîéěŕĺřü. 'Áŕáŕ ń âîçó - ęoáűëŕ â ęópńĺ äĺëŕ. 'Áŕáŕ ń âîçó - ďîňĺőĺ ÷ŕń. 'Áŕáŕ ń âîçó, č âîëęč ńűňű! 'Áŕçŕđ ęîďĺéęó ëţáčň 'Áĺäó íŕCLICKŕë... (čç Windows'95) 'Áĺç póáŕřęč áëčćĺ ę ňĺëó. 'Áĺç ďđóäŕ íĺ âűňŕůčřü č đűáęó čç íĺăî. 'Áĺç ňđóäŕ íĺ çŕńóíĺřü č ňóäŕ. 'Áĺđĺăč ĺăî ęŕę çĺíčöó - âî ęŕę. 'Áĺđĺăč ÷ĺńňü ńěîëîäó - ďîëţáčřü č ęîçëŕ! 'Áĺđĺăč ÷ĺńňü ńěîëîäó, ęîëč đîćŕ ęđčâŕ. 'Áëčćĺ ę ňĺëó! 'Áîëüřîěó ęîđŕáëţ - áîëüřŕ˙ ňîđďĺäŕ. 'Áîđîňüń˙ č čńęŕňü, íŕéňč č ďĺđĺďđ˙ňŕňü! 'Áđîíĺňĺěęčí "Ďîíîńĺö". 'Áóäĺřü ěíîăî ćčňü - ńęîđî ńîńňŕđčřüń˙ 'Áóäĺřü ňčřĺ - äîëüřĺ áóäĺřü 'Áűńňđĺĺ, ăëóáćĺ, íĺćíĺĺ. ' ăŕđĺěŕő íĺň ďëîőčő ňŕíöîđîâ ' ăîńň˙ő őîđîřî, ŕ äîěŕ ďëîőî. ' ăîńň˙ő őîđîřî, ŕ äîěŕ ó ěĺí˙ íĺňó. ' ćĺíńęčé ěîíŕńňűđü ńî ńâîčě óńňŕëűě íĺ őîä˙ň ' ęîíöĺ ęîíöîâ, ńđĺäč ęîíöîâ, íŕéäĺřü ęîíĺö ňű íŕęîíĺö. ' ňĺěíîňĺ âńĺ ęîřęč ńĺđţň. ' ÷óćîĺ ÎŔÎ ńî ńâîčě óńňŕâîě íĺ őîä˙ň. 'Âĺę âęëŕäŕ íĺ âčäŕňü. 'Âĺđŕ ěîćĺň äâčăŕňü ăîđű, îíŕ - ęîëîńńŕëüíŕ˙ áŕáŕ. 'Âç˙ëń˙ çŕ ăóć - íĺ çŕáóäü ńőîäčňü â äóř 'Âčäĺňü âŕń - îäíî óäîâîëüńňâčĺ, ŕ íĺ âčäĺňü - äđóăîĺ 'Âčäíî ďňčöó ďî ďîěĺňó 'Âčíî, äĺâî÷ęč, íî÷íŕ˙ Ěîńęâŕ, ěčëčöč˙, äđŕęč, đŕçáčňűĺ ŕâňîěîáčëč, đŕçîđ¸ííűĺ ăí¸çäŕ ëţáâč 'Âîäęŕ "Áóđŕňčíî" - ďî÷óâńňâóéňĺ ńĺá˙ äđîâŕěč 'Âîçüěč ęîí˙ çŕ đîăŕ! 'Âîëęîâ áî˙ňüń˙ - â ëĺńó íĺ ĺáŕňüń˙! 'Âđĺě˙ ëĺ÷čň, íî äîęňîđ - áűńňđĺĺ. 'âńĺ ăĺíčŕëüíîĺ - ďđîńňűíü 'Âńĺ ăĺíčňŕëüíîĺ ďđîńňî. 'Âńĺ ëčříĺĺ - äĺň˙ě! 'Âń¸ íĺ ňŕę ďëîőî ęŕę âű äóěŕĺňĺ, âńĺ íŕěíîăî őóćĺ 'Âńĺ őîđîřî, ÷ňî őîđîřî ęŕ÷ŕĺňń˙ 'Âűéňč â ăîđîä: ó ëţäĺé ďîńěîňđĺňü, äŕ ńâîé ďîęŕçŕňü... 'Ăäĺ ńîâîę - ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.