Use case 1 executable file embedded in Excel file
In this use case, a malicious Excel file with embedded executable file is analyzed. This Excel files exploits an old Microsoft Office vulnerability (CVE-2012-0158) and does not work on dynamic analysis with patched Microsoft Excel. FileInsight-plugins can extract malware executable file from the Excel file to analyze it.
Open the Excel file with FileInsight.
Use "File type" plugin to check its file type.
Its file type is detected as "File type of the whole file: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 936".
Its end of file is filled with 0x89 (it should be 0x00) and it looks suspicious.
Use "Byte histgram" plugin to check byte frequency.
0x89 is the most frequently appeared in the file. So It is assumed that a malware executable file is embedded into the file and its content is XORed with 0x89.
For such case, XOR text search can be used.
Windows executable files usually contain text string "This program cannot be run in DOS mode." So enter "This program" as search keyword.
There are two search hits. "XOR key: 0x89 -> ROL bit: 5" means that it should be XORed with 0x89, then rotated left five bits to decode embedded executable files.
Hit Ctrl-A key to select the whole file. Then click decode tab in the left pane, set method to Xor and key to 0x89, and click decode button.
Next set method to "Rotate left" and key to 5, and click decode button.
The file content is decoded like this.
The search hits are bookmarked. Jump to a search hit by clicking a bookmark in the left pane. The text string "This program cannot be run in DOS mode." is visible. It seems that malware executable files are decoded successfully.
Use "Find PE file" to extract the malware executable files. This plugin can search Windows executable files and bookmark them based on PE header information.
Two 32bit executable files are found and bookmarked. Actually the second executable file (offset 0x2f53e) is embbedded into the first executable file (offset 0x234ce).
Click the bookmark of the first executable file (offset 0x234ce) to select its region, then use "Copy to new file" plugin to extract the region as new file.
The extracted region is copied to the new tab "New file 0". Use "Hash values" plugin to calculate hash values.
Calculated hash values are as follows.
Use "Send to" plugin to open the extracted executable file with other analysis tool.
Select IDA free to open the file for further analysis.
FileInsight-plugin can be used to decode and extract embedded malware executable file like this. 😉
MD5: 6bb32ce95fbfaadad19212080ed0268b
SHA1: 9bb5442c6778d4ab5716e118bcca558ee46d0ac4
SHA256: ceb0af188c5c1f1fc60c8446ea3cb5fa6d3d6c6b1f173e1161434afc7e3474a3
ssdeep: 6144:dbL6vr7ZtpxBbi636Ls0b64/gbhwD/nv/LMezJUJwf:dbL6zdPxBb56LPzoa7nHLMezJUJG