[SANS ISC] Simple YARA Rules for Office Maldocs, (Mon, Nov 22nd)

In diary entry “Extra Tip For Triage Of MALWARE Bazaar’s Daily Malware Batches” I shared 2 simple YARA rules to triage Office documents with VBA code.

This is rule olevba, for Office documents that use the binary CFBF aka ole file format:

rule olevba {
    strings:
        $attribut_e = {00 41 74 74 72 69 62 75 74 00 65}
    condition:
        uint32be(0) == 0xD0CF11E0 and $attribut_e
}

“uint32be(0) == 0xD0CF11E0” is a test to check if the file starts with D0CF11E0: that is the magic header of ole files.

The ASCII representation of 00 41 74 74 72 69 62 75 74 00 65 is “.Attribut.e”, where the dot (.) represents a NULL byte. This sequence, is the start sequence of compressed VBA code generated by the VBA IDE (e.g., not been tampered with like VBA stomping).

If these 2 conditions are met, the YARA rule will trigger. False positives can occur, especially when string $attribut_e is found inside binary data that is not compressed VBA data.

This is rule pkvba, for Office documents that use the OOXML file format:

rule pkvba {
    strings:
        $vbaprojectbin = “vbaProject.bin”
    condition:
        uint32be(0) == 0x504B0304 and $vbaprojectbin
}

OOXML is essentially: a ZIP container, containing XML files.

“uint32be(0) == 0x504B0304” is a test to check if the file starts with 504B0304: that is the magic header of ZIP records typically found first inside a ZIP file.

vbaProject.bin is the filename of the ole file that contains the VBA project.

If these 2 conditions are met, the YARA rule will trigger. False positives can occur, especially when string vbaProject.bin is found somewhere else than inside a ZIP record.

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Source: Read More (SANS Internet Storm Center, InfoCON: green)

You might be interested in …

[HackerNews] Chinese Hackers Implant PlugX Variant on Compromised MS Exchange Servers

All posts, HackerNews

A Chinese cyberespionage group known for targeting Southeast Asia leveraged flaws in the Microsoft Exchange Server that came to light earlier this March to deploy a previously undocumented variant of a remote access trojan (RAT) on compromised systems. Attributing the intrusions to a threat actor named PKPLUG (aka Mustang Panda and HoneyMyte), Palo Alto Networks’ Unit 42 threat intelligence […]

Read More

[HackerNews] Russian Turla APT Group Deploying New Backdoor on Targeted Systems

All posts, HackerNews

State-sponsored hackers affiliated with Russia are behind a new series of intrusions using a previously undocumented implant to compromise systems in the U.S., Germany, and Afghanistan. Cisco Talos attributed the attacks to the Turla advanced persistent threat (APT) group, coining the malware “TinyTurla” for its limited functionality and efficient coding style that allows it to go undetected. […]

Read More