Set shellApp = CreateObject('Shell.Application') Public Sub SendBanObj(UserIndex As Integer, Slot As Byte, Object As String) The function SendBanObj generates some GET request:

The object named halalaya will be used to handle HTTP communication. Inside another file there are several public objects, that are used to share information between them: The procedure autoopen deploys several functions, that can be found in other VB modules. oledump.py -s 10 -v “(523)-Invoice 7500005791.doc” > ThisDocument.vbĮxecution of macros starts in ThisDocument.vbĪttribute VB_Base = '1Normal.ThisDocument' We can easily extract the code with the help of the same tool. This is the point, where we can expect some illegitimate functionalities – macros can potentially deploy malicious actions. I will use oledump – a very handy tool for dissecting DOCs, written by Didier Stevens.įirst, let’s have a look on what are the elements inside the doc: In this post we will reveal the true mission of a DOC file delivered in a spam. But even if it was a real document, it doesn’t mean that it is harmless. exe – means, it is an executable, not a document as it claims. Such trick may fool some users – however, more advanced of them will notice that the real extension of the file is. Usually they deploy simple social engineering tricks – trying to deliver packed executable in disguise of a document, i.e.

Some malware families often use spam campaigns as a method of distribution.

Macros downloader