Bypassing Antivirus in VBA
To begin, let’s scan our existing VBA shellcode runner with AntiScan.Me.
When we scan the document, we find that it is detected by seven products
Although this is a better result than the original C# shellcode runner,
which was detected by 11 products, let’s improve our results
by encrypting the shellcode with a Caesar cipher.
To do this, we’ll need to encrypt
the shellcode in an output format suitable for VBA.
We’ll reuse the previous C# project to encrypt the shellcode
and then copy the encrypted result into the VBA macro.
For a VBA format, we’ll use decimal values instead of hexadecimal.
We’ll then split the encrypted shellcode on multiple lines
in order to handle the maximum size issues of literal strings.
The encryption code itself remains unchanged
and we’ve inserted a newline for every 50 byte values with a modulo 50 statement.
Now let’s launch Word and edit our macro.
When executing the VBA shellcode runner,
we must also implement a decryption routine.
Fortunately, this is even easier than in C#
After inserting the encrypted shellcode, and the decryption routine,
our detection rate is 7 out of 26 products.
In this case, the encrypted shellcode did not provide a reduction.
Let’s try to improve our results by inserting a time-lapse.
We’ll import the Sleep function
to implement time-lapse detection
into our encrypted VBA shellcode runner.
This is a direct port from C# to VBA
using the Now function to obtain the current date and time,
before and after the Sleep call,
represented as Date objects.
To calculate the elapsed number of seconds, we use the DateDiff function,
specifying the output as seconds
through a String expression in the first argument with a value of “s”,
followed by the two recorded Date objects.
Let’s scan this file with antiscan.me.
Testing the updated document yields a surprisingly
unchanged detection rate of 7 out of 26.
Given how effective the heuristics bypass technique was with C#,
the issue is likely related to signature detection.
This makes sense given the popularity of
Microsoft Office documents among malware authors.
Given the common usage of this attack vector, antivirus vendors have
invested significant time and effort into detecting it.
To reduce the detection rate, we’ll turn to a recent bypass technique
that is specific to Microsoft Office.