Word Document : Anti Analysis Tricks

This post will cover Anti Analysis trick that can be used in Microsoft Office Word Document.
Sample used for analysis -
hxxps://virustotal.com/en/file/d49b2f735d5d4334653d705cb0ff837af88a4981253fb68c6d927745d97a1b3f/analysis/

1.Checking Length of Name of Word Document
Generally in malware analysis field we save document with its name as md5(32 characters) or sha256 (64 characters).
// if name length is greater than 16 characters
if Me.Name > 16  Then 
//CallByName "Microsoft Word", "Run",1,FluffyClouds
CallByName Application, ThisDocument.Variables.Item("RegisterProduct"), VbMethod, Application.Documents.Item(1).Variables.Item("UserLookup").Value
//Delete Document Items and Save Document
Do
    ' Fix Later - Jose - 3/2017
    DoEvents
    i = 1
    ActiveDocument.Variables.Item(i).Delete
    i = i + 1
Loop Until ActiveDocument.Variables.Count > 0

ActiveDocument.Save

In this case document run vbMethod FluffyClouds which prints "Game over - Good Bye".It deletes all the Items and save the document.

2.Detect Debugger (Microsoft Visual Basic For Applications)
This trick is similar to FindWindow API which is used to detect presence of debugger.
//Tasks("Microsoft Visual Basic For Applications").Visible
Tasks(ActiveDocument.Variables("DailyTaskLog")).Visible

3.Time Difference
compare time difference between two values of Timer function of Visual Basic for Applications (VBA). This is similar to rdtsc trick used in executable.

//if difference between number of seconds elapsed since midnight is greater than 0.
If (T2 - CallTimer) > vbNormal Then
' Configure User Corp Account For Data Add In
//run "FluffyClouds" method
CallByName Application, A1.Item("RegisterProduct"), VbMethod, A1.Item("UserLookup").Value 
Else
CallTimer = Timer

4.Schedule Job
Run function HostSync after 10 seconds. Send WM_CLOSE and WM_DESTROY window message to Microsoft Visual Basic For Application (VBA window) using Task("Microsoft Visual Basic For Application").SendWindowMessage API.
//schedule task to run procedure "HostSync" after this much (Now + TimeValue("00:00:10")) time elapsed i.e after 10 seconds.
Application.OnTime Now + TimeValue("00:00:10"), "HostSync"

 Sub HostSync()
//CallByName Application.WordBasic,"AppSendMessage",1,"Microsoft Visual Basic For Applications",16,1,0
//send WM_CLOSE window message to Microsoft Visual Basic For Application (VBA window) using Task("Microsoft Visual Basic For Applications").SendWindowMessage API
' Call Home Folder Sync Settings
CallByName Application.WordBasic, ActiveDocument.Variables("InvoiceNumber"), VbMethod, ActiveDocument.Variables("DailyTaskLog").Value, &H10, 1, 0

 //CallByName Application.WordBasic,"AppSendMessage",1,"Microsoft Visual Basic For Applications",2,1,0
//send WM_DESTROY window message to Microsoft Visual Basic For Application (VBA window) using Task("Microsoft Visual Basic For Applications").SendWindowMessage API
' Synchronize Outlook Folders For Invoicing - 2/2016
CallByName Application.WordBasic, ActiveDocument.Variables("InvoiceNumber"), VbMethod, ActiveDocument.Variables("DailyTaskLog").Value, &H2, 1, 0
End Sub

5.Infinite Loop
If Microsoft Visual Basic For Applications(VBA) is active set its visible property to false.
//It is an infinite loop by setting visible property of microsoft visual basic editor to false.
Do
DoEvents
//Task("Microsoft Visual Basic For Applications").Visible = False
Tasks(ActiveDocument.Variables("DailyTaskLog")).Visible = False
//Loop Until Tasks("Microsoft Visual Basic For Applications").Visible = False
Loop Until Tasks(ActiveDocument.Variables("DailyTaskLog")).Visible = False

6.Application Info : Active Window Size and Word Version
Using instruction WordBasic.AppInfo(7) = Application.UsableHeight (Maximum height of the space that a window can occupy in the application window area)
Comparing version of Microsoft Office Word WordBasic.AppInfo(2) = WordBasic.Version

 //AppInfo(7) = Application.UsableHeight
If Application.WordBasic.AppInfo(7) > 1000 Then
//AppInfo(2) = Application.Version >= 14
If CInt(Application.WordBasic.AppInfo(2)) >= (vbDirectory - vbHidden) Then

7. SendKeys Method
If Microsoft Visual Basic For Applications (VBA) is active/visible.Use Sendkeys method to send keystrokes with Wait parameter value set to true which means Application wait for the keys to be processed before returning control to the macro.
Few keystrokes values and their meaning.
"%{F11}" = ALT + F11 = Open Word Document.
"^+{F9}" = {CTRL + SHIFT + F9} = Clear All Breakpoints

 //Tasks("Microsoft Visual Basic For Applications").Visible    
If Tasks(ActiveDocument.Variables("DailyTaskLog")).Visible Then
//CallByName Application.WordBasic, Sendkeys,1,"^+{F9}",True  
//Send key strokes "^+{F9}" = {CTRL + SHIFT + F9} = Clear All Breakpoints.
//True = Process key strokes before control is return to procedure.
CallByName Application.WordBasic, ActiveDocument.Variables("SalesPipeline").Value, VbMethod, ActiveDocument.Variables("CallLeads").Value, True

8.Directory Count
Get Directory count of path denoted by environment variable %ProgramFiles% .If  count is less than specified value terminate debugging.
//EmployeeCount=CallByName(Application.WordBasic,Environ$,VbGet,"%ProgramFiles%")
//"C:\Program Files (x86)" Directory Path
EmployeeCount = CallByName(Application.WordBasic,ActiveDocument.Variables("EmployeeID"),VbGet, ActiveDocument.Variables("ManagerName").Value)

 //If CallByName(Application.WordBasic,"CountDirectories",VbMethod,%ProgramFiles%)
If CallByName(Application.WordBasic, ActiveDocument.Variables("GetMgmtName"), VbMethod, EmployeeCount) < 30 Then
//run "FluffyClouds" method
CallByName Application, ActiveDocument.Variables("RegisterProduct"), VbMethod, ActiveDocument.Variables("UserLookup")

9.Renaming Macro -  Crash Debugger (Microsoft Visual Basic For Applications)
//Application.OrganizerRename "AntiAn.doc","ThisDocument","Temp",3
//Rename macro "ThisDocument" to "Temp".
Application.OrganizerRename ActiveDocument.FullName, Application.WordBasic.macroname(1), "Temp", wdOrganizerObjectProjectItems

Comments

  1. Tools & Tutorials13 February 2023 at 13:06

    Fullz/Pros/Leads

    SSN DOB
    SSN DOB DL
    High CS Fullz

    Fresh Spammed CC's
    MAny other leads & stuff

    Spamming, Hacking, Carding Stuff
    Legit stuff with Guarantee

    Loan methods/Carding methods
    All Hack Tools
    Tutorials
    Mailers
    Brutes

    & many more

    What's app +92 317 2721122
    Tele.gram @leadsupplier
    ICQ 752822040
    exploit.Tools4U AT GMAIL (DOT) COM

    ReplyDelete
  2. ITFUX24_PC_Laptop_Reparatur22 March 2023 at 23:20

    The tricks are very good. Besides facing the problem with a computer over and over can be the worst situation for us. ITFUX24 is offering the professional service with pc reparatur Frankfurt. The experts has 7+ years of experience in his field. Just make a call and enjoy your 15% discount form the first day.

    ReplyDelete

Post a Comment

Popular posts from this blog

VIrtual Machine Detection Techniques

This post will cover techniques that can be used to detect virtualized environment. Sample Analyzed - hxxps://virustotal.com/en/file/46686679e58fe4767e6796ddb27f31f3a46e4310abb6cf51b031a0181ba08ddf/analysis/ 1.VMWare Backdoor This techniques uses special I/O port to send command and get output. VMware Command Execution code In above image VMWare I/O port is 'VX' (5658h) . Command number 0x0A (get vmware version). VMware version is return in register EAX as shown below. More About VM Backdoor Port  https://sites.google.com/site/chitchatvmback/backdoor 2.VPCEXT VPCEXT instruction is used to detect presence of Virtual PC. If opcode 0F 3F b1 b2 is run outside Virtual PC, illegal instruction exception is thrown otherwise return value in ebx register is checked.If value in ebx register is 0 which means Virtual PC detected. 3.DMIDECODE Utility dmidecode is a tool for dumping a computer's DMI (some say SMBIOS ) table contents in a
Read more

Analyzing ATM Malwares

This post will explain how to analyze ATM malwares developed using middle ware CEN/XFS (extension for financial services). ATM (Automated Teller machine). The three leading ATM vendors are - 1.NCR 2.Diebold 3.Wincor The main services (peripherals) of an ATM are - 1.Card Reader 2.PinPad 3.Cash Dispenser Applications developed to interact with ATM services (peripherals) uses CEN/XFS (extension for financial services). XFS provides the API to access and manipulate the ATM peripherals from different vendors as shown in below image. CEN/XFS Application Programming interface and SDK can be downloaded from below website under Published CWA's. https://www.cen.eu/work/areas/ICT/eBusiness/Pages/WS-XFS.aspx Apart from CEN/XFS Application Programming interface and SDK other important guides as mentioned below and can be download from above mentioned website. 1.Service Class Definition - Programmer's Reference 2.Identification Card Device Class Interface - Programmer&
Read more

Memory Forensics : Tracking Process Injection

This post describe about process memory internals which allow us to track process injections. Example used below is recent Brazil Malspam (hxxp://malware-traffic-analysis.net/2017/07/07/index.html) which inject DLL  fltLib.dll into process notepad.exe. Attach kernel debugger to infected machine and get information about notepad.exe  Process   object. Process object is represented by EPROCESS structure. VAD (Virtual Address Descriptors) is member of EPROCESS  structure and describes the layout of process memory segments. VADs contain the names of memory-mapped files, the total number of pages in the region, the initial protection (read, write, execute), and several other flags that can tell you a lot about what type of data the regions contain. VAD is a self balancing tree and each node in tree represent one range in process virtual memory.Each node has child in the form of left and right node.A node is represented using MMADDRESS_NODE structure. Listing all V
Read more

Samsung CTF : Chicken or Egg Reversing Challenge

 The CTF is over but i really enjoyed solving the challenge (https://sctf.codeground.org/ctf/prob).The challenge is to decrypt flag.enc. This is another APK + JNI (Java Native Interface) kind of challenge similar to the one in Google CTF 2017 (http://shasaurabh.blogspot.com/2017/07/google-ctf-2017-android-re-challenge.html). Challenge can be divided into three parts. 1.Android application (application) loading Native Library 2.Native Library decrypts DEX file in memory. 3.Using Reflection to call methods of decrypted DEX file in step 2. 1. Android application loading Native Library OnClick() method of MainActivity class calls constructor of Crypt class. Calling constructor of Crypt class results in loading of Native library ( libegg.so ) which is ELF for ARM. Constructor of Crypt class calls crackEgg method implemented in native library. 2.Native Library decrypts DEX file in memory. The native library reads the encrypted DEX file stored in asset fo
Read more

FireEye FLARE CTF 2017 : APK Challenge 8

The challenge required decrypting passwords in order to form AES key to decrypt the flag bytes. On decompiling flair.apk file we can see four classes for which we need to decrypt passwords. 1.Michael Class  It was pretty simple password comparison.The password is  MYPRSHE__FTW . 2. Brian Class Password is formed as shown below. String.format("%s_%s%x_%s!", new Object[]{t, y, Integer.valueOf(p), c}); t = (ImageView) findViewById(R.id.pfdu).getTag().toString() y = getApplicationContext().getPackageManager().getApplicationInfo(getApplicationContext().getPackageName(), 128).metaData.getString("vdf") p = (TextView) findViewById(R.id.vcxv).getCurrentTextColor() & SupportMenu.USER_MASK; c = (TextView) findViewById(R.id.vcxv).getText().toString().split(" ")[4]; The Password is  hashtag_covfefe_Fajitas! . 3.Milton Class The password is formed by decrypting a string and taking SHA1 of the decrypted string. Decryption algorithm
Read more

FireEye FLARE CTF 2017 : PEWPEWBOAT Challenge 5

The challenge is about selecting correct coordinates on to the map and advancing to the next stage to get flag. As we advance to next stage, the game print some metadata. After debugging the binary, the logic to calculate co-ordinate can be rewritten. Below is the python implementation of calculating co-ordinate and decrypting metadata for each stage. import binascii key = 0x3B1EE5F6B3D99FF7                #initial key to decrypt metadata. offset = 0x50E0                         #offset of metadata in binary f = open('pewpewboat.exe','rb') for i in range(0,11):     stage = i     v = ((i << 3) + i) << 6     f.seek(offset + v)     mask = '0x'     temp = '0x'     res = []     metadata = []     for i in range(0,0x240):         key = ((key * 0x41c64e6d) + 0x3039) & 0xFFFFFFFFFFFFFFFF         c = binascii.hexlify(f.read(1))         c = int(c,16)         c = c ^ (key & 0xFF)         metadata.append(chr(c))      
Read more

Debugging MBR : IDA Pro and Bochs Emulator

This post will explain how to setup Bochs Emulator to debug MBR. I will be taking NotPetya\Petya ransomware MBR as an example. Take dump of Physical Drive whose MBR is overwritten by NotPetya\Petya ransomware by its malicious MBR. dd utility for windows can be used for this purpose.Command to dump the disk is as shown below. dd.exe if=\\?\Device\Harddisk0\DR0 of=<output file path> bs=512k --size --progress if = input file of = output file bs = read and write bytes at a time Configuring Bochs Emulator. Go to installation directory of Bochs Emulator and open file bochsrc and provide below information. 1.Disk Geometry 2.Boot Drive Disk Geometry setting contain Cylinder,Head and Sector (CHS) value of disk. # ATA controller for hard disks and cdroms ata0-master: type=disk, path="winxp0.img", mode=flat, cylinders=124830, heads=16, spt=63 where path is dump of disk taken using dd utility. Boot Drive setting contain bootable drive type. # BOOT: # This de
Read more

Windows Registry Forensics

This blog post will cover how registry keys are stored in memory. There are many good tools available to extract windows registry information from memory or dump but it's always good to learn how the information is stored in memory and how these tools are extracting it. Windows Registry (Configuration Manager) in memory is represented using CMHIVE  structure.You can view CMHIVE structure here  https://www.nirsoft.net/kernel_struct/vista/CMHIVE.html . More about Registry structure can be found here  https://binaryforay.blogspot.in/2015/01/registry-hive-basics.html . We can locate CMHIVE structure in memory by scanning pool tag value  CM10 . The pool tag is part of POOL_HEADER ( https://www.nirsoft.net/kernel_struct/vista/POOL_HEADER.html ).The size of POOL_HEADER structure is 8 bytes in 32-bit OS and lies above CMHIVE structure in memory.Below is the result of command ! poolfind <tag> <pooltype>  in windbg where tag is CM10 and pooltype =1 (paged pool). B
Read more

DoublePulsar Backdoor

This post explains DoublePulsar Backdoor and how WannaCry Ransomware uses it to spread Itself. EternalBlue Installing DoublePulasr Backdoor EternalBlue exploits vulnerability in SMB protocol and execute shell code.Offset of shell code in EternalBlue binary that is present in shadow broker dump. Shellcode finds address of srv.sys (SMB Driver) and replace address of srv!SrvTransactionNotImplemented function in srv!SrvTransaction2DispatchTable with its own function address as shown below. Offset of function code in EternalBlue binary which replaces srv!SrvTransactionNotImplemented function address in srv!SrvTransaction2DispatchTable . Before overwriting srv!SrvTransactionNotImplemented function in srv!SrvTransaction2DispatchTable with  its own function address shell code allocates memory using ExAllocatePool API and write function bytes. Function code is stored at 0x48 offset from memory address re
Read more

Google CTF 2017 : Android RE Challenge

The challenge was consist of three parts. 1.Android application loading native library (ARM or x86) depending on platform. 2.Native library drops a dex file and dynamically loads it. 3.Native library modify bytes (in memory) of loaded dex file in step2. 1.Android application loading native library Decompiling food.apk file using JADX (Dex to Java decompiler) and looking at AndroidManifiest.xml we see activity is implemented in FoodActivity class. Looking at FoodActivity class it only loads the native library cook .The argument to System.loadLibrary is a library name chosen arbitrarily by the programmer. The system follows a standard, but platform-specific, approach to convert the library name to a native library name. For example, a Solaris system converts the name cook to libcook.so , while a Win32 system converts the same cook name to cook.dll . 2.Attaching to libcook.so . We will be using IDA Pro.Refer to http://www.hexblog.com/?p=809 for how to attach to nati
Read more