Hello and welcome to a new session in this session.
We are going to look at the principles of analyzing VBA macro script.
So in this video, we will talk about the principles first.
The learning objectives for this video is what media functions to focus on, review the workflow for
script analysis.
And analyze militias will be worked through visual basic applications are also known as Vrba, essentially
visual, basic, now visual, basic can be embedded inside a Microsoft Office document.
And that's what makes Microsoft's document a good choice for malware authors, because this we a basic
application is actually a programming language, therefore a mobile.
They can basically write code.
They will allow the document to write to the file system or to open a network connection or to execute
other programs.
So now I'm going to outline a demo for you, how you can open and view macros in office, document.
You should use a virtual machine to open the document with Microsoft Words two or one three.
After opening, you will see the screen here and there will be a button here, and it will content do
not typically do any more content.
Now, notice that the five chosen is Huguet three, the Newseum.
And this is a far reaching down from the earlier lesson from the PDA.
Philco important that PDA after you have opening click on View and then click on New Macross.
You will then see a dialogue going across and in the here you will see on the list it will be a cruise.
In this example, you have three or two open document open and employ.
So select the macro if you want to view it and click on EDIT, you will then open up an application
called Microsoft.
We showbizzy for application and show you the code.
So this is what he looks like.
Sometimes, however, you will not be able to open it because some files are password protected.
So in those cases, you will not be able to view this unless you have a password.
So if there is no password, then you can just open it in this manner and we will directly.
So now I will go through the walkthrough with you, show you how to do it.
I have here my Whicher machine running Windows seven 64 with and inside on this folder.
I will be you three, which we have extracted from this file earlier, a PDF file from an earlier lesson.
So the first thing I do is to make a copy of this and then I make use of this.
And this file we have discovered from the earlier lesson is open office XML format, meaning it is a
U.S. format.
So we can just rename it as we G3 the.
So Amnesia's klymenko inside, so now we are going to open it correctly.
And make sure you're in the washing machine, do not open inside your hoist machine.
You will now see this button and it will.
Do not click on it, because if you click on this and then the macro is automatically.
Instead of clicking on this, you can view the macro, we are executing it, click on View and you notice
that I'm using Microsoft Office two zero one three.
So after clicking on View, click on macros and in Select View macros.
And here is a list of all the necklace, there will be a script, you can click any one of these and
click edit and you will open for you.
For example, if I select the last one click and he will then open up, we shall be looking for applications
and show.
So these temeka.
So this is how you can open and view a macro from the office document, it is now heading back to our
power points right now, VBA functions.
The next thing they're going to look at, and these are the four important ones, which is obviously
used by the authors when they are trying to use Microsoft Office to launch some kind of her malware
attack.
The first is how to open or do I think these two functions as being open.
So whenever the Microsoft document is open, these two functions who automatically run and execute whenever
we specify.
And then there's also other clues, other places when the document is close, this thing execute.
So if you close the document, you whatever is specified.
Next on is CSIR function, sacia function returns character from ASCII value.
So normally it would be a ASCII consigliere for alphabet, for character, so dysfunctional convert
that numeric representation of an alphabet back into the original alphabet.
And then sometimes the number of the numeric representation may not be so simple.
It may be for the obfuscatory, some kind of mathematical expression.
So the authors always use this function in order to obfuscate the data, the strings in the script so
that it is difficult for analysis.
And then the next one is Shell, the shell function.
It's a good program.
So check function is also often used by others to run operating system functions and you can also execute
shell scripts.
So it's a very powerful function.
So these are the four which you should be aware of, because they are always being used in malicious
documents for the files and sometimes the out the need to use some kind of function, which is not available
from the macro script with a script.
So in those cases, then you have to declare this import.
So it is how you declare an import using VBA, which are busy.
So the author would declare what function they want to import in this case can be put aside.
And where does it come from?
It comes from the user to read to the file, which is a systems, the same thing.
It is this open process and it comes from country to the same if I process memory and repossesses memory.
So all these for here are often used for injecting processes.
And this is one example which is being used, this is a macro script which will try to open a track
and create a process, open a process.
So you're running again, right?
Inject some code into the process so that you whatever is injected will run inside and in that process.
So this is how you can hide processes.
So this is the power of macro's.
We be basic across Rebekah's.
So this is why you can see the this is a choice for many authors to launch a military attack, that
is to use Microsoft Office documents.
Next thing is, we want to have a revision of the obfuscation.
We've already seen this before when we were studying PDF files, analysis of bedfast.
So in Innisfail's, scripts are normally obfuscated so that it makes it difficult for analysis.
And these are the four common areas where Scribd can be obfuscated versus formatting.
Formatting is to remove all the waste pieces and also the formats like taps and so on.
So that is difficult to read.
The whole could be denvir meaningless block of code next year to inject extraneous means to inject unnecessary
expressions online.
So instructions in order to make the code longer and difficult to understand now in order to defeat,
as soon as you have to look for all those instructions which are only used once and remove them now
for formatting in order to defeat formatting, formatting, obfuscation, we can use prettify, as I
explained earlier.
Next, data obfuscation that our position is where the malicious author takes a stream, for example,
a while and then breaks up into individual characters and then use complicated functions to make it
difficult to understand when those functions are concatenated and run together and the original string
will be recreated.
The same thing is true for creating temporary file pass or other baff or even file names or even instructions.
All those can be data of scattered.
And the fourth one in the arsenal for the authors is substitution, substitution is ready never to make
a variable name into a meaningless random names so that when the analyst looks at it, no one else will
not know what the variable is supposed to hold or what is supposed to do.
And we have seen before that the way to defeat this is to look for the meaning of the usage of those
variables and then rename them accordingly.
So these are the revision of four school education and this is also the same thing had seen before.
Whenever the cryptanalysis, we want to look for indicators.
So the indicators, for example, you should be looking for you are healthy.
Sign the document or the Melva or the script.
This you are Elsah typically used for second stage.
So the first stage will be the document and then the document will run some script in trying to reach
out to some Yahel to download for the bill for the malicious binary files.
Next thing to look out for months and every six months, you should be careful on these comments so
these companies can further run power shelves and publishers are very powerful.
Next will be findings.
You should be looking out for filenames as well, because Farnham's can give you a clue as to what is
the new name of the second stage, which is downloading from the Internet, or why is the name of the
bar the part where the malicious document or malicious files are being copied to and hidden in the operating
system?
So these are these three things to look out for.
Now there's a tool that is called Wabo Monkey and whoever monkey is available in remarks and by the
monkey can emulate VBA engine.
When you use a monkey like this wee wee monkey and nimura document that you want to analyse and you
have a monkey who executes emulating the running of the web and in trying to look for malware artefacts
and then come up with a nice report to tell you what the VBA macro is trying to do.
And you can also do string the obfuscation and replacement, so if you run with a dash, dash the F
option, you would always get strings and show you the original text.
And if you run, you dash to reveal you replace those the obfuscated strings in the.
Thank you for watching and that's all for this video.
I'll see you in the next one.