Unlocking Excel 4.0 Macro Malware

Here I show you some super quick and easy techniques to analyse malicious Excel files laden with Excel 4.0 macros. These are sneaky customers; often difficult to analyse and built with sandbox-evasion in mind.
I show you the simple techniques I use when approaching this kind of sample in order to extract the key Indicators of Compromise, and hopefully you'll now feel confident examining these files in your own environment
LINKS
=====
d13ot9o61jdzpp...
THANKS
=======
If you liked the video, please give it a THUMBS UP. If you loved it, please SUBSCRIBE.
FOLLOW
=======
Also, feel free to follow me on / cybercdh .
SAMPLE
=======
Unfortunately in this case I'm unable to share the sample I demonstrated, however, head over to the following URL where you can get yourself many, many others with similar properties:
labs.inquest.n...

[@scaramouche600]

This level of knowledge will never not be impressive! Thanks for your uploads

[@cybercdh]

That's a very kind comment, appreciate you taking the time to make it.

[@jolesco]

Interesting as always Colin, I liked that modulo wrap-around on the key.

[@cybercdh]

Thanks! Yep, the modulo operator is something I always look for in an unknown function, super common to see it used in basic encoding / decoding routines like this

[@billycamlin2350]

A superb demo yet again Colin. With ultra-low detection of these files on VirusTotal and the samples still defeating many sandboxes, these techniques are pure gold!

[@cybercdh]

Thank you; appreciate the support and glad you found the content helpful

[@stewatts]

God tier skills as always mate and the speed that you do it at is crazy (even when slowing down to explain!). Always learning from your videos 👌

[@cybercdh]

Thanks for your continued support Ste. Always means a lot.

[@MalTrakSecurity]

Great video Colin. First time to watch your videos and really impressed! Lots to learn from you I believe

[@cybercdh]

Thanks, glad you enjoyed

[@TKomoski]

Cool Colin, I had to scratch my head a couple times. Then I slowed your video down so I could digest it a little better. I caught some stuff but the majority is Greek to me. Glad your their stopping the bad guy *Cheers*

[@cybercdh]

Thanks man; thanks as ever for taking the time to watch

[@bizbouk]

Great explanation mate! Keep up the videos! Nice one

[@cybercdh]

Thank you for the continued support. It means a lot.

[@RingZeroLabs]

Interesting sandbox checks. Good job man.

[@cybercdh]

Thanks

[@lukashman538]

Thanks =) I always try to make the reversing code to do my job, cause it will make it as author expected =) Some other atacks of this kind were discovered by 360 Thread Intelligance Center. Good luck!

[@cogwheelLearning]

Wow. This is really impressive.

[@donaldduck6198]

In the zip-structure, i.e. in [content.xml] there are key-words "macro";easy to detect

[@jaylal4899]

your videos are awesome. Everything is so well explained.

[@cybercdh]

Glad you like them!

[@sikkavilla3996]

great video colin!

[@cybercdh]

Thanks!

[@createlazar5977]

Could you show how to analysis .NET Malware.

[@disfiguredloafers]

This - would like to see an analysis of Agent Tesla.

[@billycamlin2350]

Or even better and out of the same stable: Formbook. How to extract the C2 config from any .NET malware though, would be invaluable.

[@D_Tech_And_Trek]

Amazing Colin!

[@Arti9m]

So basically we should do our important work in a sandbox :)
Also when I wrote XLS parser for PHP, I was confused about why is there multiple 'macro' types in the format. The docs were for Excel 95, 97-2003 and did not mention explicitly it was Excel 4.0 macros. (For parser I simply ignored macros, ofcourse.)

[@cybercdh]

Sounds like a cool project

[@CristiNeagu]

But what does it do? Does it download malicious code that it runs? Does it send data to a server?

[@cybercdh]

In this case yes, it aims to download a DLL and run it. In other samples things may be different; the intention here was to show how to determine what it does, not what it actually does.

[@stanislavsmetanin1307]

Thanks.

[@djdex222]

Great video but slow it down abit lad

[@boynextdoor1]

Ah yes, obviously

[@IOwnThisHandle]

I honestly had to watch on 0.75 speed. You're talking way, way too fast.

[@Brenden97]

This might actually be done intentionally

[@Brenden97]

Keep in mind he does reverse engineering for a living. ***Cough cough watch time***

[@cybercdh]

It’s a ploy to have people watch multiple times and increase my ad revenue. Not.