Thread by @VessOnSecurity

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini No, the code isn't there, although there is something strange...

You are looking at the raw file with a hex editor and are seeing stuff that's in unallocated clusters that aren't part of the OLE2 stream structures at all. You need a more intelligent tool.

Take a look:

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini First, we have the OLE2 structure of the file. This is what you have to look at. The VBA structures are there. The module streams are:

Module1
UserForm1
ThisDocument

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini Now, let's inspect each one of them as a stream, not as raw sectors from the file. Again, you need a tool that understands this. The compressed source is at the end of the stream, with the p-code immediately preceding it.

Module1:

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini As you can see, the compressed source is very small, the module is empty of code. The small area of zeroes before that is where normally the p-code should be, again it is small and empty of code.

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini Next, UserForm1. Again, the source is small and contains only headers, no code. P-code area is small and empty.

See that FE CA marker? That's the line table, if I remember correctly. Also small and empty.

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini Now we're getting to ThisDocument and things are starting to get weird.

The source code is small and empty, alright (look at the second image). But it is preceded by a LARGE area of zeroes, where the p-code normally ought to be.

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini And see those FF FF FF FF things before that? That's the line table. This is how empty lines are marked.

However, if the thing contained empty lines naturally, it wouldn't have such a large area of zeroed-out p-code.

This is weird.

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini This (the large area of zeroed-out p-code) *could* be caused by an anti-virus. However, an AV would have definitely wiped the source code too; it wouldn't have replaced it with headers-only compressed source.

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini And it couldn't have been an inferior AV that wipes only the p-code, because then the original source code would have remained.

I don't know what has caused this. Don't think it's an AV, but it doesn't seem normal, either.

@siri_urz @Malwageddon @decalage2 @DissectMalware @James_inthe_box @ItsReallyNick @_devonkerr_ @likethecoins @angealbertini I mean, that's not how stuff looks when you normally delete the lines with the VBA editor; it would have compressed the p-code area just like it is small in the other modules.