Welcome back everyone. 1
So let us start analyzing the malicious document file using oledumb and I'll be sharing all these analysis 2
files 3
through cloud link, probably through Dropbox. I'll password encrypt those files and I'll upload it there. 4
And I'll share the links in the description sections so you all can download files and you 5
can follow these videos by analyzing the same file so that it makes things much more clear to you. 6
So let's quickly go ahead and launch powershell. 7
Make sure to run it as administrator. 8
So we are in the flare office directory Now that's where we can start using the program and our file 9
is present here. 10
So OK so to start using oledumb you have to use Python to run the oledump python file 11
first move to be directory. Now python oledump.py 12
So before we analyze any files just quickly run the help command and see what all parameters are there. 13
So we have dump, have ASCIIdump, we have strings we have 14
VBA decompress. 15
We have a raw and bunch of other things. 16
You can explore all of these one by one. 17
So in order to analyze given doc file all you have to do is you have to run oledump.py and you 18
have to pass your office file to this 19
course files. 20
It's called payment.doc. 21
So let's run this file. 22
So here is the output of oledumb. 23
So here you can see that it has separated all the objects one by one along with its size. It has listed 24
the CompObject, the summary information, table information then it has also listed that there are 25
macro projects inside this particular doc file. 26
Now the one that would be interesting 27
Is object number 7 where it has marked capital "M". 28
And it means that this document particularly contains macro scripts inside it. 29
Now in order to view the macro script, we have to again run the same command oledump.py and 30
this time will pass the hyphen X (-X) parameter along with the object number which is 7. So here 31
it will list the hex value of the object. In order to view a more readable format, 32
We can basically pass the -d command which just dumps the entire result. 33
Now here you'll will see that there are a lot of unwanted characters as well. 34
These are basically the characters which didn't really get translated into direct readable ASCII 35
characters but it still makes a lot of sense if you look at the code you'll see that it's basically 36
trying to launch command.exe and it's trying to do something with Powershell. In order to get rid of all 37
these unwanted characters, 38
We can basically do a VBA decompress and it will create a pretty nice script for us. 39
So here are the output that we are seeing now is the actual VBA script that is embedded inside that 40
particular document file. 41
Now it makes it much more easy to read and understand here. 42
So if you've seen it has defined a function called document open which means that this function will 43
get executed as soon as the document is launched. 44
What it does is that it launches shell command, where it passes cmd.exe, basically the command.exe 45
from there it tries to launch powershell 46
Notice the way how powershell has been mixed and matched with both upper and lower case characters. 47
This is done to usually avoid static signature based techniques where you have either powershell all 48
in lower or in upper case characters. 49
So all those techniques can be evaded using these kinds of mixing and matching. 50
After that it's basically trying to initiate a web client. 51
And it's trying to download a file from this particular location. 52
You can see the entire file location here and it's an exe file. 53
It means it's an executable. 54
It's very highly likely that this is the actual malware payload that will get downloaded from this particular 55
office file. 56
It gets written into temp app data and it gets written with the name of playa.exe. 57
So once the file gets downloaded, the next command gets executed is > "Start" this particular file. 58
Once the file is executed, 59
You just exit the shell terminal. 60
So this was the entire interpretation of the malicious VBA macro that was embedded inside the document. 61
So this is where the delivery and exploitation phase happened. 62
So in the delivery phase this document came in as an attachment with the e-mail. 63
And once you launched that particular document you basically executed this macro in the background and 64
you just downloaded the malware and executed it on your system. 65
And that was the exploitation phase. 66
Let us try the other file as well which is a docx file. 67
It's called Statements.docx. 68
So here if you see, object number A3 contains VBA macros as marked by oledump. 69
So we'll go ahead and pass -s along 70
with 71
The object number which is A3 72
If you press enter it throws in a bunch of output in hex format. 73
Let's quickly do a VBA decompress on this and this results into. 74
The following script. 75
So once you have the script with you you can just start analyzing it once again just like we did it 76
in the previous video. 77
So this is how we analyze malicious office files using oledump. In the next video, 78
We'll try and understand how we can use the second tool to basically perform the same analysis.