{"id":872,"date":"2015-07-01T17:35:21","date_gmt":"2015-07-01T16:35:21","guid":{"rendered":"http:\/\/www.greyhathacker.net\/?p=872"},"modified":"2015-07-01T17:35:21","modified_gmt":"2015-07-01T16:35:21","slug":"detecting-malicious-microsoft-office-macro-documents","status":"publish","type":"post","link":"https:\/\/www.greyhathacker.net\/?p=872","title":{"rendered":"Detecting Malicious Microsoft Office Macro Documents"},"content":{"rendered":"

For the past few months I have been looking into macro enabled Office documents and during that time I have detected hundreds of malicious documents. This post just highlights what to look out for so it might benefit some of you if deciding to notify or quarantine mail in your environment. I’ve also did a quick analysis on a Word2010 formatted document I received last week.<\/p>\n

So what are Macros?<\/strong>
\nMacros are a series of commands that can be run automatically to perform a task. Macro code is embedded in Office documents written in a programming language known as Visual Basic for Applications (VBA). Macros could be used maliciously to drop malware, download malware, etc. Malicious macro files usually are received in Word documents or Excel spreadsheets but other formats do exist though I have never encountered them. Once a malicious document is opened only a single click is next required for the macro code to run.<\/p>\n

\"\"<\/p>\n

Automating Macros<\/strong>
\nVisual Basic has reserved names for launching code when documents are opened. These names are the key to detect possible malicious code. Sometimes are used for legitimate purposes but generally we should consider them dangerous. For Word the reserved names that could be used maliciously are AutoOpen()<\/strong> and Document_Open()<\/strong> and for Excel the reserved names are Auto_Open()<\/strong> and Workbook_Open().<\/strong> These days malicious documents are using AutoOpen() and Auto_Open() but Document_Open() and Workbook_Open() could also be used.<\/p>\n

Below is an example in Word document where AutoOpen() subroutine is set in Modules-NewMacros<\/p>\n

\"\"<\/p>\n

The macros could also be added in the “ThisDocument” section and then NewMacros section is not really required<\/p>\n

\"\"<\/p>\n

Similarly in Excel the subroutine Workbook_Open() would be in the “ThisWorkbook” section and the Module1 section is not required<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

What to look for<\/strong>
\nBelow is a table of the kind of strings to search for based on the extension and file format.<\/p>\n\n\n\n\n\n\n\n
Format<\/td>\nReserved Names<\/td>\nEmbedded in<\/td>\nExtensions<\/td>\n<\/tr>\n
Word 2003<\/td>\nAutoOpen
\nDocument_Open<\/td>\n		n\/a<\/td>\nDoc dot*<\/td>\n<\/tr>\n
Excel 2003<\/td>\nAuto_Open
\nWorkbook_Open<\/td>\n		n\/a<\/td>\nXls xlt<\/td>\n<\/tr>\n
Word 2010<\/td>\nAutoOpen
\nDocument_Open<\/td>\n		vbaProject.bin<\/td>\nDocm dotm* doc (renamed)<\/td>\n<\/tr>\n
Excel 2010<\/td>\nAuto_Open
\nWorkbook_Open<\/td>\n		vbaProject.bin<\/td>\nXls xlsb xltm<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

*Only applies when using Document_Open name<\/em>.<\/p>\n

Word 2003 also supports saving macro enabled documents to be saved as XML extension files which are able to run on Word 2010. XML files can also be renamed to a doc extension. The macro code in XML is stored as base64 and the string to search for would be w:macrosPresent=\u201dyes\u201d<\/strong><\/p>\n

\"\"<\/p>\n

Office 2010 format is not a binary format like Office 2003 documents. Office 2010 documents are an Office Open XML (OOXML) format which was introduced with Microsoft Office 2007. Office Open XML is a zipped, XML-based file format so string “vbaProject.bin” would need to be searched in the initial file. Within this vbaProject.bin file the reserved subroutine names will be found.<\/p>\n

Couple of months ago a new macro based documents have been seen in the wild. These documents were web page based formatted documents saved as MHT files (Single File Web Page) and then renamed to a doc. Strings you could search for are MIME-Version, Content-Location and x-mso. I have not seen xls extension being used in the wild, most likely because it adds another warning when opened.<\/p>\n

\"\"<\/a><\/p>\n

When saving macro based documents as HTML files (Web Page) the file extension could be renamed from html to doc or xls. The editdata.mso is a zlib compressed file which contains the macros. The mso file could be called anything so not dependent on this name. If the mso file was to be dropped but some other means the macro document contents would look like this below<\/p>\n

<html>\r\n<link rel=Edit-Time-Data href=\"C:\/Temp\/editdata.mso\">\r\n<body>Will open Windows Calculator to test macros<\/body>\r\n<\/html><\/pre>\n
If the mso file was to be downloaded remotely an extra warning would be given.<\/p>\n
<html>\r\n<link rel=Edit-Time-Data href=\"http:\/\/www.malicioussite.com\/editdata.mso\">\r\n<body>Will open Windows Calculator to test macros<\/body>\r\n<\/html><\/pre>\n
\"\"<\/a><\/p>\n
 <\/p>\n
Malicious Word 2010 Document \u201cemail_message.doc\u201d Analysis<\/strong>
\nI’ve never detected an Office 2010 formatted document till now. Pretty much every document happens to be in Word 2003 format. Below is some quick analysis I did just to highlight the unusual properties taken.<\/p>\n
The “email_message.doc” I detected last week sent with a doc extension. Office 2010 macro enabled Word documents by default takes a docm extension. Once this particular malicious document has been opened you\u2019ll see this content<\/p>\n
\"\"<\/p>\n
Looking into the macros we see a new technique used to obfuscate its code not seen before (as far as know). In the \u201cNewMacros\u201d section the code can be clearly seen dropping the code then executing it.<\/p>\n
\"\"<\/p>\n
We also see pretty much the same code in the \u201cThisDocument\u201d section.<\/p>\n
\"\"<\/p>\n
The line of code of real importance is<\/p>\n
dll = Base64Decode(UserForm1.TextBox1)<\/pre>\n
Here is reads the encoded base64 string from UserForm1.TextBox1 and decodes it before writing to disk and executing it.<\/p>\n
\"\"<\/p>\n
Even though the same macro codes are in \u201cThisDocument\u201d and \u201cNewMacros\u201d section the code in \u201cNewMacros\u201d will not work due to using the reserved macro subroutine name \u201cDocument_Open\u201d which only works when used in the \u201cThisDocument\u201d section.<\/p>\n
Final part of the macro code in the malicious document runs a subrountine ClearDocPasteText(“”)<\/strong> which clears the document contents which end up viewing a blank document.<\/p>\n
Uploading the Word document to VirusTotal yesterday detected 33\/55<\/a>\u00a0and\u00a0the dropped binary file detected 38\/55<\/a><\/p>\n
Finally some strings in the binary stand out which suggest this malware spams out emails.<\/p>\n
00027EB1\u00a0\u00a0 0042A2B1\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 MailAddr\r\n00027EBE\u00a0\u00a0 0042A2BE\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 reports-2012@qip.ru\r\n00027ED2\u00a0\u00a0 0042A2D2\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 SendInBackgr\r\n00027EE0\u00a0\u00a0 0042A2E0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 MailAsSmtpServer\r\n00027EF2\u00a0\u00a0 0042A2F2\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 MailAsSmtpClient\r\n00027F04\u00a0\u00a0 0042A304\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 UploadViaHttp\u00a0\r\n00027F13\u00a0\u00a0 0042A313\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 MailViaMapi\u00a0\r\n00027F20\u00a0\u00a0 0042A320\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 MailViaMailto\r\n00027F2F\u00a0\u00a0 0042A32F\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 SmtpServer\r\n00027F3F\u00a0\u00a0 0042A33F\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 SmtpPort\r\n00027F4D\u00a0\u00a0 0042A34D\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 SmtpAccount\r\n00027F5E\u00a0\u00a0 0042A35E\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 SmtpPassword\r\n00027F70\u00a0\u00a0 0042A370\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 HttpServer\r\n00027F7F\u00a0\u00a0 0042A37F\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 http:\/\/repo.int.qip.ru\/send\r\n00027F9B\u00a0\u00a0 0042A39B\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 HttpPort\r\n00027FA9\u00a0\u00a0 0042A3A9\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 HttpAccount\r\n00027FBA\u00a0\u00a0 0042A3BA\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 HttpPassword\r\n00027FCC\u00a0\u00a0 0042A3CC\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 AttachBugRep\u00a0\r\n00027FDA\u00a0\u00a0 0042A3DA\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 AttachBugRepFile\u00a0\r\n00027FEC\u00a0\u00a0 0042A3EC\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 DelBugRepFile\u00a0\r\n00027FFB\u00a0\u00a0 0042A3FB\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 BugRepSendAs\r\n0002800C\u00a0\u00a0 0042A40C\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 bugreport.txt\u00a0BugRepZip\r\n00028029\u00a0\u00a0 0042A429\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 ScrShotDepth\r\n0002803B\u00a0\u00a0 0042A43B\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 ScrShotAppOnly\u00a0\r\n0002804B\u00a0\u00a0 0042A44B\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 ScrShotSendAs\r\n0002805D\u00a0\u00a0 0042A45D\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 screenshot.png\r\n0002806C\u00a0\u00a0 0042A46C\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0 ScrShotZip\r\n\r\n<\/pre>\n
References<\/strong>
\nhttp:\/\/support.microsoft.com\/en-us\/kb\/286310<\/a>
\nhttp:\/\/en.wikipedia.org\/wiki\/Office_Open_XML<\/a>
\nhttp:\/\/blog.didierstevens.com\/2015\/03\/09\/a-new-type-of-malicious-document-xml\/<\/a>
\nhttp:\/\/www.howtogeek.com\/171993\/macros-explained-why-microsoft-office-files-can-be-dangerous\/<\/a>
\nhttps:\/\/nakedsecurity.sophos.com\/2015\/03\/06\/from-the-labs-new-developments-in-microsoft-office-malware\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
For the past few months I have been looking into macro enabled Office documents and during that time I have detected hundreds of malicious documents. This post just highlights what to look out for so it might benefit some of you if deciding to notify or quarantine mail in your environment. I’ve also did a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,5],"tags":[47],"class_list":["post-872","post","type-post","status-publish","format-standard","hentry","category-all","category-malware","tag-macros"],"_links":{"self":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts\/872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=872"}],"version-history":[{"count":5,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts\/872\/revisions"}],"predecessor-version":[{"id":877,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts\/872\/revisions\/877"}],"wp:attachment":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}