Archive for June 30th, 2019

Maldoc: Payloads in User Forms, (Mon, Jul 1st)

When malicious Office documents leveraging VBA code became popular again with malware authors, they soon started to look for different places to hide their payload (URLs, commands, shellcode, EXEs, …). User Forms were one of the first components they turned to.

In this example, I add a user form (UserForm1) with a text box (TextBox1). And I “hide” a URL inside the text box.

This results in 4 extra streams under storage UserForm1. Here is the output of

Here is the content of these streams:

When you take a close look, you’ll notice that stream f contains the names of the components (TextBox1) and stream o contains the property values (the URL in our case).

Plugin plugin_stream_o can extract values of textboxes:

When you encounter optional streams in Office documents, make sure to take a look inside: they might contain payloads.

Didier Stevens
Senior handler
Microsoft MVP

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.

Posted in: SANS

Leave a Comment (0) →