Advanced VBA Macros Attack & Defence
summary
VBA macros remain a primary malware delivery vector in 2019, with campaigns like Emotet sending hundreds of thousands of phishing emails daily; attackers use EvilClippy to perform VBA stomping (replace readable source while leaving executable P‑code intact) and hide payloads. Analysis and tooling evolve: olevba extracts and auto‑decrypts VBA/P‑code and integrates into Cuckoo/Hybrid/VT, while ViperMonkey emulates VBA to reveal second‑stage JavaScript and shellcode. A simple detector (MacroRaptor) flags auto‑run + write/execute patterns and is fast enough for mail‑gateway filtering.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:15Disclaimer
- 1:29Agenda
- 2:08History of Macros
- 4:31Macro Based Campaigns
- 5:40Typical Macro Viewer
- 5:51What can happen
- 7:25Macros in 2019
- 10:07Macro Example
- 11:55VBA Encryption
- 13:33Analysis Tools
- 14:56VBA
- 16:40Demo
- 18:03Integrations
- 18:37Macros
- 19:29How it works
- 23:04VBA stomping
- 23:54The problem
- 25:27The demo
- 28:02The new technique
- 29:33Excel for macros
- 31:47Quick demo
- 32:27How does it work
- 33:08Detection Prevention
- 34:47Detecting Macros
- 35:46Macro Raptor
- 38:32Macro Block
- 39:19Microsoft GPO
- 39:32Application Guard
- 40:24Safe Features
- 42:28Future Work
related talks
27mA Machine Learning approach for detecting a Malware
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
42mD2T1 - Sandbox Evasion Using VBA Referencing
25mCommSec D1 - A Deep Dive Into Malicious Documents
01h 40mDefending against PowerShell attacks - in theory, and in practice
28mAVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
22mMalware Hunting - Using python as an attack weapon
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32