On 11/10/2020, AnyRun posted an Emotet maldoc that utilized CertUtil to decode a DLL payload that was used for unpacking and running the Emotet trojan. This is a deviation from normal use of obfuscated base64 PowerShell command as well as embedding the DLL into the maldoc instead of retrieving from a compromised host. This video provides analysis of the document using both static and dynamic techniques, as well as a walk-through of the macro code. The original Tweet from AnyRun can be found at: https://twitter.com/anyrun_app/status/1326157565840023553 Analysis of an Emotet document that uses PowerShell from earlier this year can be found…
Read moreCategory: malware
Maldoc Workshop at Hack-in-the-Box CyberWeek (UAE)
I gave a free 4-hour workshop as part of the Hack-in-the-Box (HITB) CyberWeek (November 15th, 2020). The focus of this workshop was on analyzing malicious Word and Excel documents: Malicious office documents continue to be an effective tool for threat actors to compromise their victims and gain access to an organization’s network. While these documents have been around for a while, malware authors continue to find effective ways of abusing functionality to minimize their detection. This year alone we have seen a resurgence of such techniques through the use of Excel 4 Macros and other creative ways to bypass detection….
Read moreExcel 4 Macros – Get.Workspace Reference
With the recent resurgence of the use of Excel 4 macros in malicious excel documents, I’ve found myself scouring the internet looking for language references. One such function that was particularly difficult to find documentation for was Get.Workspace, which takes a integer value as an argument and returns information about the environment. Since it appears that it is all but impossible to find Excel 4 macro documentation from Microsoft, I thought I’d create a few posts in the hopes of the content getting indexed and thus easier to find. The source of this information came from this PDF, which used…
Read moreRemoving Passwords from VBA Projects
Occasionally I’ll encounter a maldoc that has a password-protected VBA project. While tools such as oledump may still extract the macros, the password protection is typically encountered when accessing the project through the Office/VBA IDE (which I typically use for dynamic analysis). This happens rare enough that I often forget the steps of removing the password so thought I’d start collecting possible solutions. Word – 2007+ Sample MD5: dc989fa836fa93fe1f158fa490382686Any.Run: https://app.any.run/tasks/dd8ae979-4afc-44ac-99d2-3b57f9d6e2b1Hybrid-Analysis: https://www.hybrid-analysis.com/sample/4bb275b253db05bfa23a677d3db8f78cef0d633bbef19d05e37780f61577153c?environmentId=100 With this type of document, you can rename the original file with a .zip extension, this will allow you to explore the contents. This type of file uses the…
Read moreMaldoc drops DLL and executes via ExecuteExcel4Macro
Behavioral information is a key indicator used to determine if an office document is malicious or not. I’ve recently seen a series of malicious office documents that lacked any observable process behavior – such as the execution of Powershell or JavaScript via cscript/wscript. As I began looking into this document, it became apparent why – it was using ExecuteExcel4Macro to load and execute a hidden DLL. Looking at the Macros Using Oledump, several macro streams where identified in this document (17 – 20, 23 – 24). Additionally, it contains a stream OLE 1.0 embedded data (see stream 4 above). This…
Read more