The maldoc in a nutshell: when the spreadsheet is opened, the VBA code builds a long JScript script and then executes it. This script contains base64 code for an executable (ransomware Petya GoldenEye version), which is written to disk and executed. The building of the script is done with heavily obfuscated VBA code, so we thought it would be a good idea to try ViperMonkey. ViperMonkey is a free, open-source VBA emulator engine written in Python. You can use it to emulate VBA code on different platforms without MS Office.
Here is the end of the VBA code:
Let’s analyze this with ViperMonkey:
Since there are a lot of VBA statements, it will take ViperMonkey some time (couple of minutes) to parse this:
In the end we get this result:
ViperMonkey doesn’t identify any suspicious actions, but we see that the ActiveX object to be created is “MSScriptControl.ScriptControl”. This string was obfuscated with Chr concatenations, and ViperMonkey was able to parse it. To parse all obfuscated expressions like this, we provide option -e to ViperMonkey:
vmonkey.py -e sample.vir
We this information, we can understand what subroutine Workbook_Open does: it executes a JScript script stored in variable LQ3.
How to we get the value of LQ3? We can set ViperMonkey’s log level to debug, and log the emulation of all statements. This will produce a lot of output, so it’s beter to redirect this to file.
vmonkey.py -l debug sample.vir > output.log 2> debug.log
Searching for the last occurrence of string “setting LQ3” in debug.log, we find the JScript script: