Malicious office documents are often used as downloaders, macros are executed to begin a sequence of events that ultimately downloads the next stage. Some documents will embed a high number of URLs to download from, such as the document we are investigating.
The goal is to analyze the macros in this malicious office document to identify how download URLs are stored within the document. Additionally, you will be able to unravel how it uses both VBA and Excel 4 macros.
Please note - you may need access to the Office Suite (Excel) to follow along with all steps of this analysis
The exercise files are in a password-protected archive using a password of: infected
Solutions and walk-through analysis is provided here.
Want to know when the next challenge is released? Follow me on Twitter!
Sample MD5: 875633e78cc91862b5189e69bd0364c1
-
What function is used to begin execution of the VBA macros?
-
What column/cell does the macro code access in the workbook?
-
Describe how the large strings in these cells are used? How are they deobfucated?
-
Extract all possible download URLs from this document (hint: there are 54 URLs in total) through the creation of a Python script.
-
What malware family was this document trying to download?
MITRE ATT&CK Techniques: T1566 Phishing -> T1566.001 Spearphishing Attachment
All of the necessary tools are installed in the REMnux distribution.
- Terminal/Command prompt w/ Python installed
- Oledump plus plugin_biff
- Text editor
- XLMDeobfuscator
Removing password-protected projects with EvilClippy on YouTube
This content is licensed under CC BY-NC-SA 4.0.