WELCOME TO EHOST.COM.NP

Thursday, August 30, 2018

Vba2Graph- A Tool For Security Researchers For Malware Analysis

ads space






Vba2Graph- A Tool For Security Researchers For Malware Analysis



Vba2Graph: A tool for security researchers to Analysis of Malware.



Allows for quick analysis of malicious macros, and easy understanding of the execution flow.


It Generates a VBA call graph for easier analysis of malicious documents., developed by @MalwareCantFly



Features



  • Keyword highlighting

  • VBA Properties support

  • External function declarion support

  • Tricky macros with “_Change” execution triggers

  • Fancy color schemes



Pros


    ✓ Pretty fast


    ✓ Works well on most malicious macros observed in the wild




Cons


    ✗ Static (dynamicaly resolved calls would not be recognized)



Examples


Example 1:


Trickbot downloader – utilizes object Resize event as initial trigger, followed by TextBox_Change triggers.




Example 2:





Installation



Install oletools:


https://github.com/decalage2/oletools/wiki/Install



Install Python Requirements


pip install -r requirements.txt



Install Graphviz


For Windows
Install Graphviz msi:


https://graphviz.gitlab.io/_pages/Download/Download_windows.html


Add “dot.exe” to PATH env variable or just:


set PATH=%PATH%;C:\Program Files (x86)\Graphviz2.38\bin


For Mac
brew install graphviz


Ubuntu
sudo apt-get install graphviz


Arch
sudo pacman -S graphviz




Usage (All Platforms)


olevba malicious.doc | python vba2graph.py -c 1


python vba2graph.py -i olevba_output.bas -o output_folder



Output


You’ll get 3 folders in your output folder:


  • png: the actual graph image you are looking for

  • dot: the dot file which was used to create the graph image

  • bas: the VBA functions code that was recognized by the script (for debugging)



Batch Processing


Mac/Linux:
batch.sh script file is attached for running olevba and vba2graph on an input folder of malicious docs.


Deletes output dir. use with caution.


Download Vba2Graph



ads space
ADS SPACE

0 comments:

Post a Comment

Categories

Article How-to All Posts WordPress Android Web design Blogger Plugins CSS Google JQuery Plugins Programming Reviews Web Hosting Blogger Blogging Blogging Tips Tricks Web Development Facebook Git Internet Make Money Online Social Plugins Tips Tips and Tricks Tools Tutorials Windows WordPress Plugins Blogging Tips and Tricks Freebies GSM Google Analytics HTML How To's JavaScript Plugin Development S.E.O SEO SMS SmartPhone Social Media Tips amp; Tricks Top-Most Updates Webmaster Tools Whatsapp Applications Apps Blogger Basics Documentary Downloads Entertainment Gadgets Games Gmail Google AdSense Guest Post IPhone Make Money Blogging SVN Security Softwares Web Hosting Tips and Tricks Wordpress Tips Wordpress Tips and Tricks hostgator iOS Advertising Networks Advertising Technology Affiliates Antivirus Audience amp; Traffic Biography Blog post Blog post Blogger Blogger Errors Blogger Tips Blogger Tools Blogger Widget Blogosphere Bogger Widgets CSS selectors CSS symbols CSS3 Computer amp; Internet Content Writing Coupon Codes Data amp; Analytics Deleted blog Design DoubleClick for Publishers Email and newsletter marketting Email marketing Excel Tips Excel Tips and Tricks Facebook Tricks Feed Feedburner Feedburner subscribers Font Fun GitHub Giveaways Gmail primary inbox Gmail tabs Google sign-in Guides HTML amp; CSS HTML5 Infographics Inspirational Instagram Internet Marketing Internet Tips amp; Tricks Job Listings Knowledge Life Hacks Lists Make-Money Monetization amp; Conversion Monetize Navigation Online Marketing Other PHP Tutorials Passport Publishing amp; Content Quotes RSS Sidebar Smartphones Social Networking Status Tech Tech Blog Technology Telegram Themes UI / UX User Psychology amp; Research VB.Net Web Tools Web browser Widget Windows Tips Windows-10 ad viewability admin notice blogging tools bluehost cherry-pick clone cors custom scrollbar customizer dismissible notices duplicate post feed title git branch git clone gpg gpg2 hybridauth iPad icon font notice responsive wordpress theme same origin policy scrollbar signed git commit smartsvn theme customizer vcs wordpress theme wordpress themes

Blog Archive