Malicious VBA Challenge — LetsDefend

Challenge Name: Malicious VBA
Description: One of the employees has received a suspicious document attached in the invoice email. They sent you the file to investigate. You managed to extract some strings from the VBA Macro document. Can you refer to CyberChef and decode the suspicious strings? Please, open the document in Notepad++ for security reasons unless you are running the file in an isolated sandbox.
Malicious Macro: /root/Desktop/ChallengeFiles/invoice.vb
Role: Security Analyst
Skill Level: Easy

What is Malicious VBA ?

Malicious VBA (Visual Basic for Applications) refers to VBA code embedded within Microsoft Office documents (such as Word, Excel, or PowerPoint files) that is intentionally designed to perform harmful actions on a victim’s system. Attackers commonly use malicious VBA macros to execute commands, download and run malware, steal sensitive information, establish persistence, or communicate with command-and-control (C2) servers. These macros are often delivered through phishing emails and rely on social engineering techniques to trick users into enabling macro execution. Once enabled, the VBA code can leverage Windows components such as PowerShell, WMI, or CMD to perform malicious activities while attempting to evade detection, making malicious VBA a frequently used initial access technique in cyberattacks and malware campaigns.

A malicious VBA (Visual Basic for Applications) macro embedded in a Word or Excel document can perform many malicious actions once the user enables macros. Some of the most important attacker capabilities are:

1. Execute arbitrary commands on the victim machine.
2. Download additional malware from the internet.
3. Establish persistence by creating registry keys, scheduled tasks, or startup entries.
4. Steal stored credentials from browsers and applications.
5. Collect system information (hostname, OS version, installed software, domain membership).
6. Exfiltrate sensitive files to attacker-controlled servers.
7. Capture keystrokes using a keylogger.
8. Enumerate local drives, folders, and network shares.
9. Disable or bypass security controls and antivirus protections.
10. Execute shellcode directly in memory (fileless malware execution).
11. Inject malicious code into legitimate processes.
12. Use Windows APIs to perform advanced malicious operations.
13. Move laterally to other systems within the network.
14. Steal browser cookies and session tokens.
15. Access Outlook and send phishing emails from the victim’s account.
16. Trigger malicious actions only under specific conditions (sandbox evasion).

Common Attack Chain

Malicious Document → User Enables Macros → VBA Executes → PowerShell/CMD Launched → Payload Downloaded → Persistence Created → C2 Communication → Credential Theft/Data Exfiltration

This is why Office documents containing VBA macros are one of the most common initial access vectors used by threat actors in phishing campaigns.

On the desktop, you will find a folder named “ChallengeFiles”. Inside this folder, there is a file called “invoice.vb”, which is the file we need to analyze in order to solve this challenge.

VBA Macro Code Analysis

You can use multiple methods to analyze a VBA macro and extract meaningful information from the code. In this challenge, I used the following command:

grep -oP '"(.*?)"' invoice.vb | while read -r line; do echo ; echo $line | xxd -r -p ; done

This command extracts all quoted strings from the invoice.vb file. It treats each extracted string as a hexadecimal value and decodes it into readable text.

Specifically, grep -oP ‘“(.*?)”’ finds and outputs every string enclosed in double quotes, while read -r line processes each extracted string one by one, and xxd -r -p converts the hexadecimal data back into its original ASCII format. This is a common technique used during malware analysis to quickly decode obfuscated VBA strings and reveal hidden URLs, filenames, COM objects, commands, and other indicators embedded within malicious macros.

You can also use tools such as oletools and ViperMonkey, which are designed to analyze and deobfuscate malicious VBA macros contained in Microsoft Office files such as Word, Excel, PowerPoint, and Publisher documents. For this challenge, I used oletools with different commands to analyze the macro. The results of the analysis are shown in the screenshots attached below.

Additionally, the hash value of the invoice.vb file is reported as malicious in threat intelligence portals, further indicating that the file contains malicious content.

The VBA macro embedded in inf.docm is a classic malicious downloader macro whose primary purpose is to automatically download and execute a payload on the victim’s system when the document is opened. The execution starts from the AutoOpen() function, which runs automatically when the user opens the Word document and enables macros. The macro uses several obfuscated functions (hgmneqolwgxg, jmkrohkvctnt, and lylhbzknnnzm) that decode hexadecimal strings into readable text, a common technique used by malware authors to evade static detection and hinder analysis.

After deobfuscation, the macro constructs a URL pointing to hxxps[:]//tinyurl[.]com/g2z2gh6f and creates a local file path named dropped[.]exe within the user’s %TEMP% directory. It then creates an instance of MSXML2.ServerXMLHTTP.6.0, a Microsoft COM object commonly used for HTTP communications, and performs an HTTP GET request to the TinyURL address. A custom User-Agent string is added to make the request appear more legitimate. If the web server responds successfully with an HTTP Status Code 200, the macro uses the ADODB.Stream COM object to write the downloaded content to disk as dropped.exe.

Get CipherX9F Security’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Once the file is saved, the macro attempts to execute the downloaded payload using Windows Management Instrumentation (WMI). Specifically, the kshliitwryv() function leverages the Win32_Process class to create a new process while setting the window state to hidden (ShowWindow = 0), allowing the executable to run silently without user interaction. If WMI-based execution fails for any reason, the macro falls back to using WScript.Shell.Run to launch the executable. This dual execution mechanism increases the likelihood that the malware will successfully execute on different systems.

The document itself does not contain the final malware payload; instead, it acts as a dropper/downloader, whose sole objective is to retrieve a second-stage executable from the internet and execute it on the compromised host. Therefore, the primary function of this macro is to establish initial access and deliver a malicious executable payload onto the victim’s machine by downloading and silently executing dropped.exe from a remote location.

Execution Flow

AutoOpen()
 ↓
Download payload from: https://tinyurl.com/g2z2gh6f
 ↓
Save as: %TEMP%\dropped.exe
 ↓
Execute using: Win32_Process.Create() (Hidden Window)
 ↓
If failed: WScript.Shell.Run()

Let’s start solving the questions provided in the challenge. Using the information gathered from the VBA macro analysis, decoded strings, and the output from the analysis tools, we can identify the malicious behavior and answer each question step by step.

1) The document initiates the download of a payload after the execution, can you tell what website is hosting it?

In the VBA script analysis section, we identified that the script contacts the URL “https://tinyurl.com/g2z2gh6f" to download the payload.

We can also use CyberChef to decode this string because it is stored in hexadecimal format. Simply add the From Hex recipe in CyberChef, and the encoded string will be decoded into its original URL.

The URL is reported as malicious by threat intelligence platforms. Since it is a shortened URL, some security vendors may not flag it directly as malicious. To verify its nature, we analyzed the content associated with the URL and reviewed the SHA256 hash of the downloaded file.

The analysis showed that the URL is linked to malicious content, and VirusTotal identified embedded JavaScript within the payload. Therefore, the answer is “https://tinyurl.com/g2z2gh6f".

2) What is the filename of the payload (include the extension)?

The payload filename is dropped.exe. The VBA macro constructs this name by decoding two hexadecimal strings (64726f -> dro and 707065642e657865 -> pped.exe) and combining them to form dropped.exe.

After downloading the file from the remote URL, the macro saves it in the system’s temporary directory (%TEMP%\dropped.exe) using the ADODB.Stream object and then attempts to execute it silently on the host, making it the primary payload delivered by the malicious document.

3) What method is it using to establish an HTTP connection between files on the malicious web server?

The macro establishes an HTTP connection using the MSXML2.ServerXMLHTTP.6.0 COM object.

It creates an instance of this object and uses the Open method with the GET request type to connect to the remote URL (https://tinyurl.com/g2z2gh6f). After setting a User-Agent header, it sends the request using the Send method and checks for an HTTP status code of 200 before downloading the response body. This method allows the macro to retrieve the malicious payload from the external server and save it locally for execution.

This tells us that the macro is using the MSXML2.ServerXMLHTTP.6.0 COM object to establish an HTTP connection and download the payload from the remote server.

4) What user-agent string is it using?

The macro uses the User-Agent string “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)” when sending the HTTP request to the remote server. This value is stored as hex-encoded strings within the VBA code and is decoded at runtime before being added to the request using the setRequestHeader method.

By specifying this User-Agent, the malware makes the network traffic appear as though it originated from an older Internet Explorer 6.0 browser running on Windows NT 5.0, which can help the request blend in with normal web traffic and avoid simple detection mechanisms.

5) What object does the attacker use to be able to read or write text and binary files?

The attacker uses the ADODB.Stream object to read and write binary data. After downloading the payload through the HTTP request, the macro creates an ADODB.Stream instance, opens the stream, sets its type to binary (Type = 1), and writes the contents of the downloaded file from the HTTP response body.

It then saves the data to disk as dropped.exe in the %TEMP% directory using the SaveToFile method. The ADODB.Stream object is commonly abused in malicious macros because it provides an easy way to handle and store downloaded files, including executable malware payloads.

6) What is the object the attacker uses for WMI execution? Possibly they are using this to hide the suspicious application running in the background.

The attacker uses the Win32_Process WMI object to execute the downloaded payload and the Win32_ProcessStartup object to control how the process is launched.

These objects are accessed through the WMI namespace winmgmts:\\.\root\cimv2. The macro creates a Win32_ProcessStartup instance and sets ShowWindow = 0, which hides the process window from the user. It then uses the Win32_Process.Create() method to start the executable in the background. This technique allows the malware to execute silently without displaying a visible command prompt or application window, making its activity less noticeable to the victim.

Key Learning for the above challenge

1. Auto-executing macros can be identified by analyzing functions such as AutoOpen(), which run automatically when a document is opened.
2. Hexadecimal string obfuscation is commonly used to hide URLs, filenames, COM objects, and commands from analysts and security tools.
3. Decoding obfuscated strings often reveals critical indicators such as download URLs and payload filenames.
4. A VBA macro may act only as a downloader, while the actual malware is retrieved from an external source.
5. The MSXML2.ServerXMLHTTP.6.0 object can be abused to establish HTTP connections and download remote content.
6. The User-Agent header can be manually set by malware to make network traffic appear legitimate.
7. The ADODB.Stream object is frequently abused to write downloaded payloads to disk.
8. Malware commonly stores downloaded files in the %TEMP% directory before execution.
9. The Win32_Process WMI class can be used to execute programs directly from VBA code.
10. The Win32_ProcessStartup class allows malware to launch processes with hidden windows.
11. WMI provides an alternative execution method that can make malicious activity less visible to the user.
12. Malware often includes fallback execution mechanisms to ensure the payload runs even if the primary method fails.
13. WScript.Shell.Run is a commonly used backup method for executing downloaded payloads.
14. COM objects referenced in VBA code often reveal the attacker’s intended actions and objectives.
15. grep -oP ‘“(.*?)”’ invoice.vb | while read -r line; do echo ; echo $line | xxd -r -p ; done => This command extracts all hex-encoded strings from invoice.vb and decodes them into readable text, helping reveal hidden URLs, filenames, commands, and other obfuscated indicators within the VBA macro.

With this, the “Malicious VBA” challenge is successfully completed.