Alone.
Come back in this lesson, we are going to do a lot practical on analyzing a malicious office document
and remember, we have already done some preliminary analysis, several lessons and go.
What we did was we use a EXIF tool to take a look at the metadata.
And if we saw it, we did some time ago and we saw the timestamp.
Time to time here.
As you know, this is Russian origin and using their office form, it is near all of his helmet.
So it is the same structure.
Storage for me said, and it is not open office, I format for it, and you also you are asking me for
on this just to refresh your memory.
And yet I confirmed that contains VVA macro.
So now we are going to continue with our analysis with had tools, we are going to see if we can try
to extract the VVA macro from this fund.
The first thing we are going to use the EIB.
So I open a new window here and go to the location of this railway.
And I wish I'd followed by the name of the document, so it shows us that this is a Microsoft Word document.
It is not encrypted.
And here is a document.
And it also contains VVA Macro's next for use in order to call Hawary Times.
Or any time show us the time stamp for this document and you can see it has all the time stamps in there
and has the same date, which is two zero one five February 10.
And if you compare this with our EXIF to metadata, we can correlate them and confirm they are the same.
Immigration is 2015 February and modified it more in 2015, February 10, which is the one found here
February 10.
So this more or less confirms that this is the date in which he was created.
And you can see also a lot of stories, objects here, as you can see, and he also contains wee wee,
wee, wee, wee, wee a micro.
So the next step is to see if we can try to extract these VBA macro.
To do that, we can use the Avivah program.
So let's open a new window and go into our mailbag document.
If you just came with any options, he would tell you what he can do and you can see there's a lot of
options here, a lot of things he can do.
OK, so now we are going to use our Avivah on our back office document.
And you're not going to specify any options.
And you can see it's giving us a lot of information, including the VVA scripture and one of the important
section is at the bottom, which contains a table, a summary of the entire analysis.
You can see that he has authorized, which means that this document how to execute something, then
he is hoping.
And the suspicious elements are incorrect, as you can see, the open kiewa, which can open the file.
And he's going to kill Give Me Schmidly file show, which can run executable file system common.
User agent, which means that it is capable of downloading additional Baylock from the Internet CAGR,
which may be used to obfuscate string's.
And he also got high strings and base64 strings, which is also useful obfuscation.
Now, every school right to the top, this, you can see the VVA cell, which has been extracted by
WAVY, and you can see here there's a lot of obfuscation using string obfuscation, and he's trying
to make it difficult for analysis.
You will also see some location of the file system here and the technical term as well as here.
So this could be a location where this group may the right things to we also see some high service objects,
which means that this number is probably trying to run some tests on the operating system.
And we see lots and lots of obfuscated strings.
So now let's see if we can dump this into a separate file to extract the VBA script from this document
we can use to Huelva here today, C option, and then we redirect the output to a file of our own and
we will call it that duckweed V.V. extension.
And now you see that a new file here.
So we can open this here, right?
Clicking Open this.
We we show us to you could.
So this is the father has been done, and you can see on top here, there are some strings that has
been inserted by whoever and we do need them.
You just cut them off since they are not part of the VBA script and you scroll down, you see some more
at the bottom.
You can also cut this off, this part here.
Clean up the forest, clean and also properly formatted by visitors to local and remember to save it.
Now, this fire is ready for use in further analysis in the future.
Listen.
So we are stretched to the maybe a script, which is the objective of this lesson.
So thank you for watching.
I'll see you in the next one.