MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
T1204.002 Malicious File
The file contains a large VBA macro, indicated by the OLE_VBA_MACROS heuristic. The presence of a critical OLE_VBA_SHELL firing suggests the macro attempts to execute external commands. Additionally, a high OLE_VBA_CREATEOBJ firing points to the creation of objects for potentially malicious purposes. The extracted artifact 'macros.bas' is the source of these macros. The overall intent appears to be the execution of a second-stage payload, though the specific mechanism is not fully detailed in the provided evidence.
Heuristics 4
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas94e5e6588da1fd81c6a45b7a4857a602aa12adfe87c7b0805e927f9d595ce0b5 |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 310960 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 464 Chr/ChrW string-construction calls.
|
|||
ole10native_00.bin8493d3ba6dbb604d8ccf43e7af097a687f66ec39f15c4de11e9d0509284bcfe4 |
ole-package | OLE Ole10Native stream: MBD00672C13/Ole10Native | 4132 bytes |
ole10native_02.bin4ba16879466705089b1f9e5df39a53f32ad9eb826639fe49248e4d06805cd171 |
ole-package | OLE Ole10Native stream: MBD011EC50F/Ole10Native | 4100 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.