The next tool that we want to cover is OleVBA. 1
So we have already figured out that the file is suspicious and that has only one page it has and characters but 2
it does contain VBA macro which definitely points out that this can be something suspicious. 3
So in order to go ahead and extract that macro file we'll be using olevba tool of Oletools. 4
So once we pass olevba, it goes ahead and extract the VB Script for us. 5
This is exactly the same script which we extracted when we were using 6
Oledump. The other advantage of using Oletools is that 7
It also gives us some key indicators about the script that has been extracted. 8
For example, it says that there is an auto_execution and the key word is document_open. 9
So what it means is that this VBA script will be executed as soon as someone opens this word document. 10
We discussed about this in the oledump as well. 11
There is also presence of shell command execution which definitely points that there is something suspicious. 12
It may run an executable file or a system command. 13
It also has been able to pick up powershell, where it says that it may run powershell commands, it may download 14
files from the Internet because it's calling net.webclient. It will download files, 15
It will create new object onto the system and as an indicator of compromise 16
IOC stands for indicators of compromise. 17
It says that this is one of the indicators that should be something you should look at. 18
And there are a bunch of other IOC's picked up as well like cmd.exe and and two more file names which are 19
also executables. We'll be going into much more details as to what IOC means. For Now, 20
you can simply understand that it represents some of the indicators which might lead to malicious 21
activity or which might be associated with malicious activity related to a malware campaign. 22
Another interesting tool that comes in the Oletools suite is mraptor, which basically looks for any 23
suspicious VBA macro inside your document file. 24
So to run it again we'll pass Python mraptor.py and will pass it 25
our document file location. 26
So once it runs it tells you that result of execution of this tool was that the document file is suspicious 27
and the reason is because it contains a bunch of flags. 28
And what are those flags. 29
It says that it contains auto exec, It writes to disk, it executes something and this is the reason why it is 30
heuristically predicting that this file might be suspicious. 31
So they have basically used their other tools to extract those informations and they are applying an 32
heuristic to give you a judgment that the file is suspicious. 33
We have already seen how these heuristics have been determined and why they are suspicious. 34
So it makes this much more sense to directly use mraptor to figured out that this document file is 35
suspicious or not. 36
I did not directly go to mraptor because I first wanted you all to understand what are the traits of 37
of suspicious document file and how we basically extract the VBA macros to make sense out of it. 38
And once you have that idea it makes it much more easy to understand why this document file was particularly 39
categorized as suspicious. 40
So that was all about oletools. 41
Thanks a lot for watching.