MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1140 Deobfuscate/Decode Files or Information
The sample contains VBA macros, including a Document_Open macro that executes a Shell() call. This indicates an attempt to run arbitrary code. The presence of a 'Callback phishing phone lure' heuristic further suggests the document's content is designed to trick users into calling a number, likely for fraudulent purposes. The VBA code itself appears to be related to document formatting and event handling, but the Shell() call is the primary indicator of malicious activity.
Heuristics 5
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 1241895 bytes |
SHA-256: cc16bf0a1722baa29e695f1ab1f4e45d698f01a8074ce2002182f8d75d62d10c |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Dim ctlPopup As CommandBarPopup
Dim cmbNewBar As CommandBar
'Private Sub Document_Close()
' Dim cmbNewMenu As CommandBar
' Set cmbNewMenu = ActiveDocument.CommandBars("Menu Bar")
' 'zle,2008-9-28,+3,可以修改菜单
' With cmbNewMenu
' .Protection = msoBarNoProtection
' End With
''退出删除菜单
' For Each ctlPopup In cmbNewMenu.Controls
' If ctlPopup.Caption = "添加标准要素" Or ctlPopup.Caption = "标准文本样式" Or ctlPopup.Caption = "附录及排版" Then
' ctlPopup.Delete
' End If
' Next
'
' For Each cmbNewBar In CommandBars
' If cmbNewBar.Name = "标准编写工具" Or cmbNewBar.Name = "标准文本样式" Then
' cmbNewBar.Delete
' End If
' Next
' Dim i As Integer
' i = 1
' Do While ActiveDocument.CommandBars("Menu Bar").Controls(i).Caption <> "文件(&F)"
' ActiveDocument.CommandBars("Menu Bar").Controls(i).Delete
' Loop
' 'zle,2008-9-28,+3,不允许修改菜单
' With cmbNewMenu
' .Protection = msoBarNoCustomize
' End With
'End Sub
Private Sub Document_Open()
Set ClsEvent.TdsApp = ActiveDocument.Application
End Sub
Attribute VB_Name = "MdlTds"
Option Explicit
Global ShowTip As Boolean, OnePage As Boolean
Global ClsEvent As New ClsTds
Global ShpDT As Shape, ShpLB As Shape, ShpRQ As Shape
Global StdType As Integer '封面标准类型 0－国际标准 1－行业标准 2－地方标准 3－企业标准
Global InProcess As Boolean '判断当前是否正在进行封面数据处理，避免事件连续触发造成死循环
Global OriFldName As String '原来域名，用于当某个域失去焦点时调用，如果现在域不是OriFldName 则证明OriFldName失去焦点 OriFld失去焦点
'zle,2008-7-23,+2，表格行列
Global g_rowNum As Integer
Global g_columnNum As Integer
'zle,2008-7-23,+begin，点击了“首”的按钮
Global g_SLFirst As Integer
Global g_ZhuFirst As Integer
Global g_ZMFirst As Integer
Global g_SZFirst As String
'zle,2008-10-4,+2,索引项内容
Global g_IndexText As String
Global g_MarkOrAll As Integer
Global g_strTitle As String
Global g_MC_Count As Integer '用来标识目次更新的次数
Global g_SYGS As String
Global g_DelIndex As Integer
Global g_DelIndexText As String
Global g_FindCount As Integer
Option Base 1
'zle,09-6-16, +定义一个结构体
Private Type StrType
strLetter As String
strFirCharacter As String
End Type
'=============================================================================
'==Function:插入菜单
'==Para:
'==Return:
'==Designer:
'==Created: by zle,090706
'==Updated:
'== Update 1:
'=============================================================================
Sub InsertMenu()
Dim cmbNewMenu As CommandBar '自定义菜单
Dim cmbNewBar_YS As CommandBar '第一行放置"标准要素"快捷菜单
Dim cmbNewBar_CB As CommandBar '第二行放置"层次标题样式"快捷菜单
Dim cmbNewBar_YY As CommandBar '第三行放置"要素内容样式"快捷菜单
Dim ctlPopup As CommandBarPopup
Dim Cmd As CommandBarButton
Dim StartStatus As String
OriFldName = ""
StartStatus = GetSetting("TCS", "StartControl", "Status", "End")
StartStatus = "Start"
If StartStatus = "End" Then
MsgBox "文件不能单独运行", vbCritical
Exit Sub
End If
'zle,2008-8-5,+1，固定菜单
'zle,090705,*1，处理文档切换时保存问题
If Application.Version <> "12.0" Then
CustomizationContext = ActiveDocument.AttachedTemplate
End If
Set cmbNewMenu = ActiveDocument.CommandBars("Menu Bar")
'zle,2008-9-28,+3,可以修改菜单
With cmbNewMenu
.Protection = msoBarNoProtection
End With
'增加前先删除原来的菜单
For Each ctlPopup In cmbNewMenu.Controls
If ctlPopup.Caption = "要素及排版" Or ctlPopup.Caption = "层次标题样式" Or ctlPopup.Caption = "要素内容样式" Or ctlPopup.Caption = "特殊符号" Then
ctlPopup.Delete
End If
Next
'增加前先删除原来菜单对应的快捷按钮
For Each cmbNewBar_YY In CommandBars
If cmbNewBar_YY.Name = "要素及排版" Or cmbNewBar_YY.Name = "层次标题样式" Or cmbNewBar
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.