Hello and welcome to the walkthrough for the analysis on this document from an earlier lesson, we have
already extracted the document file and rename it or V-J Tree from this PDF file.
So you can download these two files from the resource section if you have misplaced them.
So the first thing I would do is examining using the EXIF to.
To see some metadata and from here you will notice that this is a dossier for you is also microwaveable,
is got Russian text hinting that this could be of Russian origin, the creation that he used to 017.
April 21, there are also some metadata here.
Which suggests that this is the new office format, the open XML format, therefore, if you wanted
to run your signature signatures, get this far, we will need to use it in conjunction with the other
parameters.
We do not have a creator.
We don't have a subject well.
So sometimes this is quite common when you don't have this kind of thing in no way, if you do find
the subject or the creator name, there will give us more hints as to who created the Noé.
Nice to see you, sir, is it done to your skin, so let us open a new terminal for that purpose.
Navigate to our location of this.
Is it done why parameter and the Shuai for Yaara skin and improvise the path to the signature, the
index fund.
And finally, the name of the father.
So you have a bit of a fight on screen and you will see some hits.
And from here you can see that he has got two important results confirming that this is a macro document
and pointing also to the Web project being file, which is always present when there is VVS VBA macro.
So this means that when these documents open, it is going to run this and a macro code.
So we need to extract those will be a macro call and see what it does.
The next step is to use I.D. times in order to do some scan, but since this is in the new format,
he going to feel
this, give it a try.
And you see, I know that you next thing, they're going to extract the macro code using VBA, so to
do that, we tackle Avivah, followed by the name of the file itself.
And you enter maybe I could Screamfest.
So this is a table of summary for the Avivah Schenn, so let's see, we have authorizer, which means
that when this document is open, authorizer is going to automatically run this script, whatever is
specified in the authorizing function.
And then also here you see all the suspicious elements, key words in red, for example, open and written
in the open and read and write to the file.
And this also binary, which means you can write a binary file, means probably for the binary executable
files.
And the common keyword is De, meaning that you can run partial command.
And there's also user agent meeting and you can connect to the Internet and download the second stage.
There is also some obfuscation possible because of the Y and also X strings and basically strings.
So that is straight to the office kindies this file, if you open it directly with Reichling and open
with the official studio code.
We will be seeing young.
So to deal with it, we can use the Web to secure the screen or Avivah with the perimeter and reveal
Parmeter and the name on the file and then redirect the output to a separate file so that you all right
now is enough.
So we are going to call this will be J3 thought Vrba.
So he has completed the negotiation, has won the far the resulting FA open the visual studio.
So this is the resulting file.
So let's scroll down and look at the table of the summary, which should be somewhere in the center
of the file.
And you saw all the reports on the summary.
And when you got VBA stream, that has been the obfuscated.
So let's go down and look at the actual the obfuscated could have some attributes.
The set.
And here is a user agent probably trying to connect to the Internet here, and there may be further
obfuscation, as you can see, some extra long strings here in this line.
They just on Friday.
And in line 697, we see a long string as a parameter to the function split.
So the function split will take this long string and split into different elements based on the separate
specify here.
So the separator could be pointing to this string here, nine wi fi v, so this could be separate.
So we see here there are three possible you are else which the malware is trying to connect to when
it runs.
So here alone, we can use this as an indicator of compromise and look at our network to see anybody
in the organization has reached out to these websites, to the second stage below.
And if you scroll down further as CEO, we have.
We have some WMI services trying to find out some resources which are available from the machine and
over here and nine nine nine one seven is opening a file for some purpose.
The open text function is actually here is trying to open the file.
So up to this stage of the analysis, probably the or else only he has given us that he might connect
to.
But we don't know what is going on down there.
And we also do know what is going to safety.
How do so us try to analyze the Piper monkey.
So to do that, we just copy the code to a separate file.
The first Monu and then create a new file.
And then remove all the Avivah comments.
And then I'll see this clean file.
And we are going to call it Will we get three?
But one way, because these are so small, you see.
Then we run by Pamunkey against it, so you just take the monkey and for the name of the father, his
name will be three, but one, B, B, C, we can get any more information from my monkey.
So after analyzing this history correlations, they found out to open a document open to suspicious
items did not detect any oil or indicators of compromise.
So we can continue to do this by selecting the other modules from will be Yewtree, like Lightbody based
two and three and repeat the same thing.
But we are going to try another two in the next video, lazy office analyzer, where we are going to
execute it as in a debug environment, the liaison office analyzer, and hopefully we can get more information
from that.
So thank you for watching.
I'll see you in the next one.