Word Macro Drops IcedID Trojan – Malware Analysis

HASH MD5: 4A88E83B325AA23DA1E4BFA90B4F7C34 File type: Office Open XML Document VT Score: 45/62 While I was going through Any.run report tracker, I came across this word document, I downloaded it for analysis. OleTools: I used OLETools to analyse the document macros. Olevba.py -a <file name> Indicators: Auto execute on opening document. May write a file to… Read More Word Macro Drops IcedID Trojan – Malware Analysis

Word Macro Malware Analysis

SHA256: dd81d70fa14f0e95b8cd2fe86a9a21a264cbb4bb32d80c4195fc13ee6791b994 Sample Link: Beta.VirusBay.io File Type: Microsoft Word File Extension: .doc I am going to use OLETools to analyse this word document sample. For initial document analysis I rely on this tool, if you have read my earlier blog posts on word macro analysis, you can see I have used this tool. >>oleid.py <word… Read More Word Macro Malware Analysis

Word Macro Malware Analysis

Hash: 98fe0b166f550446cbf9e0f368eb8bea79d2eec29fa033cee1ff8f8e38a12836 Sample Download Source: beta.virusbay.io File Type: Microsoft Word Document File Format: .doc VirusTotal Scrore: 32/62 Document Preview: File Property: cmd> olemeta.py <filename> Document Macro Analysis: cmd> olevba.py -a <filename> Document_Open macro executes on opening document. The first thing I was trying to access Macro. By default it was disabled, to enable it go… Read More Word Macro Malware Analysis

Excel 4.0 macro Trojan Downloader – Malware Analysis

Hash: 89e62ec08b0b6065134c67937bae76ccd70163770fd6992574e41b9c82c3cf1c Sample Download Link: beta.VirusBay.io Application Name: Microsoft Excel File Type: xls VirusTotal Score: 29/60 I came across this sample on VirusBay.io. I downloaded this malicious excel file on my VM for malware analysis. OLEVBA.py First thing I did analysis of VBA macro source code in excel file using OLETools. Command > OLEVBA.py -a The… Read More Excel 4.0 macro Trojan Downloader – Malware Analysis