This malicious OneNote document contains two obfuscated batch scripts and we’ll be using our commercial Simple Batch Emulator package to understand what they do.
SHA256: 46149F56028829246628FFAFC58DF81A4B0FF1C87ED6466492E25AD2F23C0A13
Continue reading “Obfuscated Batch Scripts in OneNote Document”
This malware gives us a chance to see the recently introduced Silicon Shellcode Emulator in action.
SHA256: 8CF1E49C74FB05DE954A6B70281F47E3CBD021108B0EE11F4A59667FF28BFEE9
A quick 70-seconds introduction to Silicon Shellcode Emulator: a lightweight x86/x64 emulator designed for Windows shellcode. This package is available to all commercial licenses of Cerbero Suite Advanced.
An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage.
SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6
The first file we encounter is a OneNote document. If the “OneNote Format” package is installed, all files are automatically extracted.
To help in the analysis of malware which uses Windows batch scripts we just released a package on Cerbero Store called “Simple Batch Emulator”. The name of the package is self-explanatory as it provides a basic emulator for batch scripts. The package is available to all commercial licenses of Cerbero Suite Advanced.
The following is a malicious OneNote document. All embedded files are automatically extracted thanks to the “OneNote Format” package.
Two of the embedded files are batch scripts. We can execute the action to emulate the obfuscated batch code.
The script extends the Silicon Excel Emulator by implementing th “FORMULA” function:
from Pro.SiliconSpreadsheet import *
from Pro.UI import proContext
class EmulatorHelper(SiliconExcelEmulatorHelper):
def __init__(self):
super(EmulatorHelper, self).__init__()
def evaluateFunction(self, emu, ctx, opts, depth, e):
function_name = e.toString()
if function_name == "FORMULA":
if emu.expectedArguments(e, 2, 2):
ve = emu.argToValue(ctx, opts, depth, e, 0)
v = emu.valueToSpreadsheetValue(ve)
idxstr = emu.argToValue(ctx, 0, depth, e, 1).toString()
idx = SiliconSpreadsheetUtil.cellIndex(idxstr)
print("FORMULA:", idxstr, "=", emu.valueToString(ve))
# add the cell to the sheet
ws = emu.getWorkspace()
sheet_idx = ws.sheetIndexFromName(idx.sheet if idx.sheet else ctx.idx.sheet)
sheet = ws.getSheet(sheet_idx)
sheet.addCell(idx.column, idx.row, v.type, v.value)
return SiliconExcelEmulatorValue(SiliconSpreadsheetValueType_Null, 0)
return SiliconExcelEmulatorValue()
v = proContext().findView("Analysis [qakbot_xls_2]")
if v.isValid():
view = SiliconSpreadsheetWorkspaceView(v)
helper = EmulatorHelper()
emu = view.getExcelEmulator()
emu.setHelper(helper)
else:
print("error: couldn't find view")
The script extends the Silicon Excel Emulator by implementing the “NOW” and “FORMULA.FILL” functions:
from Pro.SiliconSpreadsheet import *
from Pro.UI import proContext
class EmulatorHelper(SiliconExcelEmulatorHelper):
def __init__(self):
super(EmulatorHelper, self).__init__()
def evaluateFunction(self, emu, ctx, opts, depth, e):
function_name = e.toString()
if function_name == "FORMULA.FILL":
if emu.expectedArguments(e, 2, 2):
ve = emu.argToValue(ctx, opts, depth, e, 0)
v = emu.valueToSpreadsheetValue(ve)
idxstr = emu.argToValue(ctx, 0, depth, e, 1).toString()
idx = SiliconSpreadsheetUtil.cellIndex(idxstr)
print("FORMULA.FILL:", idxstr, "=", emu.valueToString(ve))
# add the cell to the sheet
ws = emu.getWorkspace()
sheet_idx = ws.sheetIndexFromName(idx.sheet if idx.sheet else ctx.idx.sheet)
sheet = ws.getSheet(sheet_idx)
sheet.addCell(idx.column, idx.row, v.type, v.value)
return SiliconExcelEmulatorValue(SiliconSpreadsheetValueType_Null, 0)
elif function_name == "NOW":
return SiliconExcelEmulatorValue(SiliconSpreadsheetValueType_Number, "44249.708602")
return SiliconExcelEmulatorValue()
v = proContext().findView("Analysis [qakbot_xls_0]")
if v.isValid():
view = SiliconSpreadsheetWorkspaceView(v)
helper = EmulatorHelper()
emu = view.getExcelEmulator()
emu.setHelper(helper)
else:
print("error: couldn't find view")