Although there are no classical packer signatures to be detected (PEid, ExeInfoPE), looking at the results of entropy tests it is clear that the sample is compressed/crypted in some way or another.  Entropy being the measure for randomness/chaos.

Examples : 

• AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA has an entropy of 0 
• ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx has an entropy of 96,04%
  

There are several ways to measure whether a binary (or parts of it) are compressed/encrypted, I happen to use gynvaels' excellent tool ENT (not to be confused by a similar entropy measurement tool) as it offers several advantages such as mapping to .code and .data section of a PE file. As we can see above the entropy of the code section (Green) is that of normal code, the data section is high on entropy at the very end of it.

Luckily for us it doesn't use stolen bytes or more advanced methods to hinder dumping from memory while the sample decrypted/decompressed itself.

So we proceed with

• Loading the sample in Ollydbg - Wait until it hits OEP
• Dump the process using Ollydump 
• fix import table
• Search for "serial"
• Look for branching code 
• Patch branching code from JZ to JNZ

posted by Thierry Zoller on the 13/10/2009

The office file format is a file format on steroids, has it's on MFT and own structure - hell the file format can even fragment - that kind of steroid. One can only imaging how this format came to live, did Microsoft launch an internal competition of who comes up with the most complicated and most difficult file format ever ? Compatibility was surely not the goal [1]. Anyway enough ramblings...

Luckily there has been good progress on the Office fileformat analysis front, there was Officecat [2] and STG Docfileviewer [3] but honestly in terms of supporting analysts, these didn't cut it.

This week Microsoft released "Offvis", basically DOC/XLS/PPT/OLE parser with added bonus of detecting existing attacks. It's main goal is to help researchers and vendors to facilitate the parsing and dissection of the awfully complicated office file format.

On another front, Frank Boldewin releases an awesome automatic and generic doc/ppt/xls dissection tool. The tool extracts macros and information about the structure of the file, and searches for common shellcode patterns, has it's own small disassembly logic and, as an added bonus, brute forces possible XOR and ADD obfuscation loops.

As input Offvis takes Office file format files, such as DOC,XLS and so forth. On the left hand it displays raw content of the file, on the upper right it displays the result of the parsing attempt. The display is interactive allowing you to select a field and see the raw content displayed.

If the file exploits includes a commonly and known vulnerability, it will display and warn you. It does not detect any other attempts, including the commonly used method of dropping malicious code using macros.

There seems to be no generic detection of shellcode or malware. In essence Offviss' goal appears to be to help developers and vendors at better understanding the format itself and test the implementations of their parsers. The added CVE recognition of known exploits is a bonus at best, although it has one nifty feature that comes in handy during analysis - defragementation.

The results we had with the tool were great, it is the first (to our knowledge) generic utility to detect malicious code within office file formats, by that we mean that it doesn't look for specific patterns of known exploits, but uses generic means to detect possible malicious code with the possibility of false positives (as in all generic methods).

It detects the api hashing method commonly used in shellcode at offsets that are located nearby, it then brute forces all possibly XOR keys and matches MZ,PE signatures indicating binary executables, and extracts them to disk. Additionally it rates the different findings in a metric called "Malicious Index", one might imagine this index to be used to filter out malicious documents at the border setting a minimum "malicious index" to reach.

Malhost-setup can be used to analyse malicious code that directly exploits office - Malhost-setup takes the malicious file as input and the address of the start of the shell code as hexadecimal offset. It then extracts the shellcode and embeds it into an executable allowing to proceed with analysis in your debugger of choice.

Posted by Thierry