{"id":9010,"date":"2022-03-26T11:52:00","date_gmt":"2022-03-26T09:52:00","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=9010"},"modified":"2023-05-05T02:04:02","modified_gmt":"2023-05-05T00:04:02","slug":"malicious-document-analysis-episode-1","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/dfir-and-incident-response\/malicious-document-analysis-episode-1\/","title":{"rendered":"Malicious Document Analysis [Episode 1]"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Before starting the analysis, I\u2019m going to use the following environment and tools:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>REMnux: <a href=\"https:\/\/docs.remnux.org\/install-distro\/get-virtual-appliance\"><\/a><\/strong><a href=\"https:\/\/docs.remnux.org\/install-distro\/get-virtual-appliance\">https:\/\/docs.remnux.org\/install-distro\/get-virtual-appliance<br><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.remnux.org\/install-distro\/get-virtual-appliance\"><strong>Didier Stevens Suite:<\/strong><br><\/a><a href=\"https:\/\/blog.didierstevens.com\/didier-stevens-suite\/\">https:\/\/blog.didierstevens.com\/didier-stevens-suite\/<\/a><br><\/li>\n\n\n\n<li><strong>Malwoverview:<\/strong><br><a href=\"https:\/\/github.com\/alexandreborges\/malwoverview\">https:\/\/github.com\/alexandreborges\/malwoverview<\/a><br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, it\u2019s always recommended to install <strong>Oletools<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em># <strong>python -m pip install -U oletools<\/strong><\/em><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All three tools above are usually installed on <strong>REMnux <\/strong>by default. However, if you are using Ubuntu or any other Linux distribution, so you can install them through links and command above.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Like any common binary, we can analyze any maldoc using static or dynamic analysis, but as my preferred approach is always the former one, so let\u2019s take it.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We\u2019ll be analyzing the following sample: <strong><em>59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc<br><\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Downloading sample and gathering information<br><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first step is getting general information about this hash by using any well-known endpoint such as<em><br><strong>Virus Total, Hybrid Analysis, Triage, Malware Bazaar<\/strong><\/em> and so on. Therefore, let\u2019s use <strong><em>Malwoverview<\/em><\/strong> to do it on the command line and collect information from Malware Bazaar that, fortunately, also brings information from excellent <em>Triage<\/em>:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>malwoverview.py -b 1 -B 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc<br><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"591\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo1-1730807.png\" alt=\"\" class=\"wp-image-9011\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo1-1730807.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo1-1730807-300x246.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Analyzing the malicious document<br><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Given the output above, we could try to make an assumption that the dropped executable comes from the own maldoc because Microsoft Office <em>\u201c<strong>loads VBA resource, possible macro or embedded object present<\/strong>\u201c<\/em>. Furthermore, the maldoc seems to elevate privilege (<strong>AdjustPrivilege( )<\/strong>), hook (intercept events) by installing a hook procedure into a hook chain (<strong>SetWindowsHookEx( )<\/strong>), maybe it makes code injection (<strong>WriteProcessMemory( )<\/strong>), so we it\u2019s reasonable to assume these <em>Triage <\/em>signatures are associate to the an embedded executable. Therefore it\u2019s time to download the malicious document from <strong>Triage<\/strong> (you can do it from <a href=\"https:\/\/tria.ge\/dashboard\">https:\/\/tria.ge\/dashboard<\/a> website, if you wish):<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>malwoverview.py -b 5 -B 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Uncompress it by executing the following command (password is \u201c<strong>infected<\/strong>\u201c) and collect information using olevba tool:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>7z e 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.zip<br><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using <strong>olevba<\/strong> and <strong>oleid<\/strong> (from<em><br><strong>oletools<\/strong><\/em>) to collect further information we have the following outputs:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>olevba -a 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx<br><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"717\" height=\"402\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo2-4708250.png\" alt=\"\" class=\"wp-image-9012\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo2-4708250.png 717w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo2-4708250-300x168.png 300w\" sizes=\"auto, (max-width: 717px) 100vw, 717px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oleid 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx<\/strong><br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"334\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo3-6012279.png\" alt=\"\" class=\"wp-image-9013\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo3-6012279.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo3-6012279-300x139.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">From both previous outputs, important facts come up:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some code is executed when the MS Word is executed.<br><\/li>\n\n\n\n<li>A file seems to be written to the file system.<br><\/li>\n\n\n\n<li>The maldoc seems to open a file (probably the same written above).<br><\/li>\n\n\n\n<li>VBA macros are responsible for the entire activity.<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The next step is to analyze the maldoc, which is a OLE document, we are going use <strong>oledump.py<\/strong> (<em>from <strong>Didier Steven\u2019s suite \u2014 @DidierStevens<\/strong><\/em>) to check the OLE\u2019s internals and try to understand what\u2019s happening:<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"403\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo4-1823522.png\" alt=\"\" class=\"wp-image-9014\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo4-1823522.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo4-1823522-300x168.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">According to the figure above we have:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>three macros in 16, 17 and 18.<br><\/li>\n\n\n\n<li>a big \u201ccontent\u201d in 11, which could be one of \u201cVBA resources\u201d mentioned <em>Triage\u2019s<\/em> output.<br><\/li>\n\n\n\n<li>Once again, we can decide to use dynamic analysis (a debugger) or static analysis to expose the real threat hidden inside this malicious document, but let\u2019s proceed with static analysis because it will bring more details while addressing the problem.<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In the next step we need to check the macros\u2019 content by uncompressing their contents (<strong><em>-v option<\/em><\/strong>) using <strong>oledump.py<\/strong>:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oledump.py -s 16 -v 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx | more<br><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"985\" height=\"693\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo5-2705242.png\" alt=\"\" class=\"wp-image-9015\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo5-2705242.png 985w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo5-2705242-300x211.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo5-2705242-768x540.png 768w\" sizes=\"auto, (max-width: 985px) 100vw, 985px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">There\u2019re few details that can be observed from output above:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Obviously the code is <em>obfuscated<\/em>.<br><\/li>\n\n\n\n<li>The <strong><em>Split function<\/em><\/strong>, which returns a zero-based and one-dimensional array containing substrings, manipulates the content from <em><strong>UserForm1<\/strong> (<strong>object 11<\/strong>)<\/em> and, apparently, this <em>content is divided in four parts (<strong>TextBox1, TextBox2, TextBox3 and TextBox4<\/strong>).<\/em> In addition, the <em>UserForm1 <\/em>content seems to be <em>separated by \u201c!\u201d character<\/em>.<br><\/li>\n\n\n\n<li>The <strong><em>UserForm2<\/em><\/strong> is also being (<em><strong>TextBox1<\/strong> and <strong>TextBox2<\/strong><\/em>) in a <em>MoveFile operation<\/em>.<br><\/li>\n\n\n\n<li>The <strong><em>Winmgmt service<\/em><\/strong>, which is a WMI service operating inside the <em>svchost process<\/em> under LocalSystem account, is being used to execute an operation given by <strong><em>UserForm2.TextBox5<\/em><\/strong>.<br><\/li>\n\n\n\n<li>The <strong><em>UserForm2.Text6<\/em><\/strong> is used to create a reference to an object provided by <em>ActiveX<\/em>.<br><\/li>\n\n\n\n<li>The <strong><em>UserForm2.Text7<\/em><\/strong> is being used to save some content as a binary file.<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore we must investigate the content of object 15 (<strong><em>Macros\/UserForm2\/o<\/em><\/strong>):<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oledump.py 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx -s 15 -d | strings<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"224\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo6-6128518.png\" alt=\"\" class=\"wp-image-9016\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo6-6128518.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo6-6128518-300x93.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We can infer from figure above that:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>UserForm2.Text1:<\/strong> C:\\Users\\Public\\Pictures\\winword.con<br><\/li>\n\n\n\n<li><strong>UserForm2.Text2:<\/strong> C:\\Users\\Public\\Pictures\\winword.exe<br><\/li>\n\n\n\n<li>We are <strong>moving <em>winword.com<\/em><br><em>to winword.exe<\/em><\/strong> within <strong><em>C:\\Users\\Public\\Pictures\\<\/em><\/strong> directory.<br><\/li>\n\n\n\n<li><strong>UserForm2.Text3:<\/strong> Scripting.FileSystemObject<br><\/li>\n\n\n\n<li><strong>UserForm2.Text4:<\/strong> winmgmts:{impersonationLevel=impersonate}!\\\\\u201d &amp; strComputer &amp; \u201c\\root\\cimv2}<br><\/li>\n\n\n\n<li><strong>UserForm2.Text5:<\/strong> Win32_ProcessStartup<br><\/li>\n\n\n\n<li><strong>UserForm2.Text6:<\/strong> winmgmts:root\\cimv2:Win32_Process<br><\/li>\n\n\n\n<li><strong>UserForm2.Text7:<\/strong> ADODB.Stream<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The remaining macros don\u2019t hold nothing really critical for our analysis this time:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oledump.py 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx -s 17 -v | strings | tail +9<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oledump.py 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx -s 18 -v | strings | tail +9<br><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"240\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo7-515303.png\" alt=\"\" class=\"wp-image-9017\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo7-515303.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo7-515303-300x100.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Analyzing the image above (check <em><strong>SaveBinaryData()<\/strong><br><\/em>function) and previous figures, it\u2019s reasonable to assume that an executable, which we don\u2019t know yet, will be saved as <em>\u201c<strong>winword.com<\/strong>\u201c<\/em> and later it will be renamed to <em>\u201c<strong>winword.exe<\/strong>\u201c<\/em> within <strong><em>C:\\Users\\Public\\Pictures\\<\/em><\/strong> directory. Finally, the binary will be executed by calling <strong><em>objProcess.create()<\/em><\/strong> function.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At this point, we should verify the content of object 11 (check \u201c<strong><em>Macros\/UserForm1\/o<\/em><\/strong>\u201c) because it likely contain our \u201chidden\u201d executable. Thus, run the following command:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oledump.py 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx -s 11 -d | more<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"393\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo8-6086455.png\" alt=\"\" class=\"wp-image-9018\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo8-6086455.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo8-6086455-300x164.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As we expected and mentioned previously, these decimal numbers are separated by \u201c!\u201d character.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, there\u2019s a catch: according to last figure, this object has 4 parts (<em><strong>UserForm1.Text1, UserForm1.Text2, UserForm1.Text3<\/strong> and <strong>UserForm1.Text4<\/strong>),<\/em> so we should dump it into a file (<strong><em>dump1<\/em><\/strong>), edit and \u201cjoin\u201d all parts.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To dump the \u201c<em>object 11<\/em>\u201d into a file (named <strong><em>dump1<\/em><\/strong>) execute the following command: :<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>oledump.py 59ed41388826fed419cc3b18d28707491a4fa51309935c4fa016e53c6f2f94bc.docx -s 11 -d &gt; dump1<br><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We need to \u201cclean up\u201d dump1 file:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Editing the file using \u201c<strong>vi<\/strong>\u201d command or any other editor.<br><\/li>\n\n\n\n<li>Using \u201c<strong>$<\/strong>\u201d to go to the end of each line.<br><\/li>\n\n\n\n<li>Removing occurrences of <strong>\u201cTahoma\u201d<\/strong> word and any garbage (easily identified) from the text.<br><\/li>\n\n\n\n<li>Join this line with the next one (\u201c<strong>J<\/strong>\u201d command on \u201c<strong>vi<\/strong>\u201c)<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">After editing the dump1 file, we have two replace all \u201c!\u201d characters by commas, and transform all decimal numbers into hex bytes. First, replace all \u201c!\u201d characters by comma using a simple \u201csed\u201d command:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>sed -e \u2018s\/!\/,\/g\u2019 dump1 &gt; dump3<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>cat dump3 | more<\/strong><br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"366\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo9-3866896.png\" alt=\"\" class=\"wp-image-9019\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo9-3866896.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo9-3866896-300x153.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">From this point we have to process and transform this file (dump3) to something useful end we have two clear options:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>We can use the amazing <strong>CyberChef <\/strong>(<a href=\"https:\/\/gchq.github.io\/CyberChef\/\">https:\/\/gchq.github.io\/CyberChef\/<\/a>).<br><\/li>\n\n\n\n<li>We can write a Python 3 code to statically decode the <em>dump3 file<\/em> into a possible executable.<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019m going to show you both methods, though I always prefer programming a small script. Please, pay attention to the fact that all decimal numbers are separated by comma, so it will demand an extra concern during the decoding operation.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To decode this file on <strong>CyberChef<\/strong> you have to:<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Load it onto CyberChef\u2019s input pane. There\u2019s an button on top-right to do it.<br><\/li>\n\n\n\n<li>Pick up \u201c<strong><em>From Decimal<\/em><\/strong>\u201d operation and configure the delimiter to \u201cComma\u201d.<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Afterwards, you\u2019ll see an executable in the Output pane, which can be saved onto file system.<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"371\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo10-4869545.png\" alt=\"\" class=\"wp-image-9020\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo10-4869545.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo10-4869545-300x155.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Saving the file from Output pane, save the file and check its type:<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/Downloads$ <strong>file download.dat<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">download.dat: PE32 executable (GUI) Intel 80386 Mono\/.Net assembly, for MS Windows<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s excellent! Let\u2019s now write a simple Python code named <strong>python_convert.py<\/strong> to perform the same operation and get the same result:<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"314\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo11-3780621.png\" alt=\"\" class=\"wp-image-9021\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo11-3780621.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo11-3780621-300x131.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>python3.8 .\/python_convert_1.py<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">remnux@remnux:~\/articles$ <strong>file final_file.bin<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">final_file.bin: PE32 executable (GUI) Intel 80386 Mono\/.Net assembly, for MS Windows<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As we expected, it\u2019s worked! Finally, let\u2019s check the final binary on <strong>Virus Total<\/strong> and <strong>Triage <\/strong>to learn a bit further about the extracted binary (next figures):<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"905\" height=\"723\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo12-65713.png\" alt=\"\" class=\"wp-image-9022\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo12-65713.png 905w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo12-65713-300x240.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo12-65713-768x614.png 768w\" sizes=\"auto, (max-width: 905px) 100vw, 905px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"917\" height=\"448\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo13-8948696.png\" alt=\"\" class=\"wp-image-9023\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo13-8948696.png 917w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo13-8948696-300x147.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo13-8948696-768x375.png 768w\" sizes=\"auto, (max-width: 917px) 100vw, 917px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"916\" height=\"522\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo14-1959472.png\" alt=\"\" class=\"wp-image-9024\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo14-1959472.png 916w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo14-1959472-300x171.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo14-1959472-768x438.png 768w\" sizes=\"auto, (max-width: 916px) 100vw, 916px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It would be super easy to extract the same malware from the maldoc by using <strong><em>dynamic analysis<\/em><\/strong>. You\u2019ll find out that a password is protecting the VBA Project, but this quite trivial to remove this kind of protection:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"340\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo15-2013103.png\" alt=\"\" class=\"wp-image-9025\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo15-2013103.png 720w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2023\/01\/110221_2310_maliciousdo15-2013103-300x142.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s it! I hope you have learned something new from this article and see you at next next one.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Before starting the analysis, I\u2019m going to use the following environment and tools: Furthermore, it\u2019s always recommended to install Oletools # python -m pip install -U [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":9026,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[224,227,228,229],"tags":[179,4,5,257,259,6],"class_list":["post-9010","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dfir-and-incident-response","category-linux-and-open-source","category-malware-and-threat-analysis","category-network-and-protocol-security","tag-dfir","tag-linux","tag-malware","tag-network-security","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/9010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=9010"}],"version-history":[{"count":1,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/9010\/revisions"}],"predecessor-version":[{"id":9027,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/9010\/revisions\/9027"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/9026"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=9010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=9010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=9010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}