[翻译]oledump: Extracting Embedded EXE From DOC

原文地址：[url]http://blog.didierstevens.com/2014/12/23/oledump-extracting-embedded-exe-from-doc/[/url]
RECHNUNG_vom_18122014.doc[url]https://www.virustotal.com/en/file/d3672a6b3bc839d76b1d4c2e98ab8c3ef84cb9e928fc3cadad3f4144aa5f8e29/analysis/[/url]是一个含有恶意VBA宏用来提取创建一个exe的word文档。本文主要用来介绍oledump如何工作
首先看一下数据流(我把word文档使用密码加密zip，用来绕过AV，oledump可以处理这类文件)
[img]http://dl2.iteye.com/upload/attachment/0104/8983/1062a437-26c4-34ca-ae4e-f96ae556df03.png[/img]
Stream 7含有VBA宏，来查看一下：
[img]http://dl2.iteye.com/upload/attachment/0104/8985/546a851b-0198-30aa-8708-bd29afdcc31a.png[/img]
当文档打开的时候，Subroutine v45自动执行。它会创建一个临时文件，搜索word文件中ActiveDocument.Range.Text里面的"1234"，然后把1234后面的加密bytes写到磁盘，然后执行。
如果查看stream 14来检查内容，将会看到：
[img]http://dl2.iteye.com/upload/attachment/0104/8987/3c07268d-b718-3688-9a9b-d6485a461a47.png[/img]
1234后面将会看到&H4d&H5a&h90…
&Hxx是VBA中十六进制的语法。我们可以使用解码器进行转换。解码器(python)使用正则搜索&Hxx，把xx转换成字符把他们连接成字符串。

#!/usr/bin/env python

__description__ = '&H decoder for oledump.py'
__author__ = 'Didier Stevens'
__version__ = '0.0.1'
__date__ = '2014/12/19'

"""

Source code put in public domain by Didier Stevens, no Copyright

https://DidierStevens.com

Use at your own risk

History:
  2014/12/19: start

Todo:
"""

import re

class cAmpersandHexDecoder(cDecoderParent):
    name = '&H decoder'

    def __init__(self, stream, options):
        self.stream = stream
        self.options = options
        self.done = False

    def Available(self):
        return not self.done

    def Decode(self):
        decoded = ''.join([chr(int(s[2:], 16)) for s in re.compile('&H[0-9a-f]{2}', re.IGNORECASE).findall(self.stream)])
        self.name = '&H decoder'
        self.done = True
        return decoded

    def Name(self):
        return self.name

AddDecoder(cAmpersandHexDecoder)

使用下面的命令来调用解码器分析嵌入的文件：
[color=blue][quote]oledump.py -s 14 -D decoder_ah.py RECHNUNG_vom_18122014.doc.zip[/quote][/color]
[img]http://dl2.iteye.com/upload/attachment/0104/8990/b4377c54-48e2-3190-a369-a71aae0a7b13.png[/img]
根据MZ和PE头，可以识别它是一个PE文件，我们可以使用pecheck来检查
[color=blue][quote]oledump.py -s 14 -D decoder_ah.py -d RECHNUNG_vom_18122014.doc.zip | pecheck.py[/quote][/color]

[img]http://dl2.iteye.com/upload/attachment/0104/8993/d582d9fb-2204-3a5b-a8cb-fc808ca1b2fb.png[/img]
[img]http://dl2.iteye.com/upload/attachment/0104/8995/805065bd-7776-3dfb-b69a-15c67edfb7c5.png[/img]

pecheck介绍：[url]http://blog.didierstevens.com/2013/04/19/3462/[/url]
下载地址：[url]http://didierstevens.com/files/software/pecheck_v0_3_0.zip[/url]