Malicious office document analysis Part-3

Introduction
This post covers how to identify and extract potential malicious content like embedded executable and payloads from Macro forms in office documents. Refer Part-1 and Part-2 to get an understanding of tools and approach to analyse phishing documents.

Tools

Didier Stevens Suite
sudo pip install oletools

Analysis

All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.

Hash: 345b804a9416595840516674caaa65e65be57591d300beab2b6190298a9eac78

Download above mentioned sample and check the integrity

Check the file properties using native Linux file command which gives quick idea about sample

Ran oledump.py to check the embedded macros and macro related forms

It was found that stream 14 and 15 look like macro forms. Dump them using -d option to check anything suspicious content in it

Wow ! Hex 4d5a was observed which is traditional ASCII MZ header for windows executable, DLL or sys files. Ran base64dump.py to decode the hex coded content to check the ASCII header

Dumped the identifier 1 in ASCII

Ran pecheck.py to check the PE file basic properties, history, header, sections info, imports and exports

Dump the PE file for further analysis

Comments

Memory Analysis of WannaCry Ransomware

Introduction This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC) WannaCry WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a...

Dionaea – A Malware collection honeypot Introduction This post outlines the necessary requirements, configurations and step by step installation procedure for honeypot Dionaea. It also briefs the logging of various attacks from external entities and produces the results to a dashboard interface feature for ease of understanding. Dionaea Dionaea is one of the modern malware collection honeypots that’s aimed to trap malware exploiting vulnerabilities exposed by services offered over a network to obtain a copy of malware. Dionaea emulates protocols by embedding python as its scripting language and also detects shellcodes using LibEmu. It also supports IPv6 and TLS. Dionaea traps malware from below mentioned protocols. • SMB (Server Message Block): • HTTP (Hyper Text Transfer Protocol) • FTP (File Transfer Protocol) • TFTP (Trivial File Transfer Protocol) • MSSQL (Microsoft SQL Server) • VoIP (Voice over IP) Requirements...

What happened ..??

Introduction Below is the memory dump of Donny's system. He's not happy with what's going on it :(. Find What's happened ? Link: https://mega.nz/#F!0moF0RaC!H2W9tUNs5Pjk1PA_p7dudA SHA256: 3E4FF07DA0D18E0387D0A6E8A0FA936974A652EB30D1FB3A4E61CA391E731944 Hint : Use Volatility or Rekall Memory Forensics Framework Solutions : Coming Soon !! :)

null0x4d5a

Search This Blog