[Autogenerated] the primary way office documents have
been and are used as an attack vector into companies is
through weaponized VB a macros.
Many companies have built entire solutions and business workflows using macros.
So this makes it very hard to block them.
This is such a popular attack vector that Microsoft themselves
plan to block the execution of macros by default,
although this can be overcome with some social engineering,
I also want to take a step back and look through some of the techniques
that we have already touched upon in regards to documents.
Initially we have managed to identify documents with the use of the Python
magic package that is able to identify the file type based on information
stored in the file header and then using your rules,
we are able to detect office documents that contain macros,
but even more important macros that are able to self execute and we have
reached the current point in this course which is analyzing suspicious
documents and we'll do this using a tool called Ole V B A,
which is part of a more advanced tool set.
All the tools is a set of tools designed for analyzing malicious documents,
it's able to detect auto executable macros,
suspicious VB, a key words used by malware,
anti sand boxing and anti virtualization technologies and it's
available on GitHub this module is so popular that it's actually
part of other very popular detection solutions and services
specifically in this module.
I will be making use of all the V B A to detect and extract vB macros,
but this is capable of much more including identifying specific
indicators associated with malicious documents.
To get a solid understanding of analyzing malicious documents.
Let's consider the following demo.
First we'll review the documentation for the old tools
module after installing it using pip,
will analyze a malicious document and will actually build
functionality in the script to extract specific indicators
in this first part of the demo,
I want to first go over the documentation page for
the all the tools python package.
This is also available on GitHub Please note that this is a collection of
tools for handling different parts of the analysis process.
The weakest section contains extensive documentation on this.
One of the tools that we're interested in is all M V B A.
Well, I intend to use this as part of our script.
This can easily be used as a standalone tool for analyzing vB
macros and you can see on the wiki page some examples of the way
it can be used with this insight.
Now we can move forward and install the module using pip, install all the tools.
Perfect.
It installs successfully.
Let's give this a try an experiment analyzing a document.
So I will run all the VB a dash A and file five from the samples
directory which we have previously identified as a document.
Nice.
This generated a comprehensive report.
Let's expand the terminal so we can view the full report.
This contains the full list of indicators of compromise.
This is pretty cool.
So the next task is to discover how we can interact with this
information from Python So for this I will start a Python and from
all the tools dot ole VB a import the VB parcel.
Next I'll create a new VB parcel object using the path to the document.
The V B A parcel has some interesting methods.
One of them being detect macros as you can notice this will return
true if the document has VB A code embedded.
This is really useful for classification and triage but
what if we want to get the VB code itself?
This can be done using the reveal method and using this within a print
statement will print out the vB macro code Nice.
Now let's implement this in the analysis part of our script as well.
So first I will add the import at the top of the script and create a new
function called analyze doc which will take one argument for the path to
the document on disk and I will create a vB parcel object and also
called the method analyze macros.
This will analyze the macros and will populate some more
fields which are part of the object.
one of these fields is analysis results,
this is a dictionary with all the indicators of
compromise to return this in a nice format,
I will use Jason dot compass and also specifying in dent
and convert the fields into strings.
Now in the main part of the script,
I will add another argument called OLE or dash.
analyze role in the long format and also need statement to
correlate the new argument with the function that I have
written in its simplest form.
We can print the results of the function, analyze dog and provide the foul path.
There may be scenarios where this should be applied only
to a fall and not to the entire folder.
So I will add a condition to check if the path that was
provided is a fall rather than a directory.
Now let's test this and see how it works and let's expand the terminal.
Great.
We have managed to retrieve the list of indicators that we
can further leverage in our python script.
Having covered the analysis of malicious documents,
it's now time to move on to the next topic.