Trojan downloader word macro

MalBot · May 13, 2019, 7:15pm

SHA256 – 4221a9922d97fa329b3dbb27e37522448958cbfa186a6ef722e48d63f9753808

Download link – VirusTotal

I downloaded this word document and checked whether macro present and it auto executes on opening document.

Yes, it does and it has obfuscated strings too.

I opened document and navigated to > Views > Macros > View Macros > Selected “autoopen” > Edit

I renamed autoopen() to autoopen2. (Which you can see in above screenshot)

while debugging macro, found it executed PowerShell script in obfuscated form.

After deobfuscate, below is the PowerShell script.

On debugging PowerShell script, it tries to download 685.exe from one of below URL’s

and drops PE file at location C:\Users\<user>\685.exe

While debugging PowerShell script, I tried to hit the download script but found none of above URL’s has PE file.

The file is removed from all URL’s.

Below is VirusTotal score.