Orphaned VBA Code in Phishing: A Hidden Vector

Phishing campaigns have long leveraged VBA (Visual Basic for Applications) macros embedded in Office documents to execute malicious payloads. However, a sophisticated evasion technique involves embedding orphaned VBA code into non-Office file types, such as DWG files used in AutoCAD, making them highly effective vectors for phishing attacks. This approach exploits the recipient’s trust in DWG files as they appear unrelated to VBA attacks, thereby evading common detection methods.

This article delves into how adversaries weaponize orphaned VBA code within DWG files and leverage them in sophisticated phishing campaigns. By understanding the mechanics, you, as a practitioner, can orchestrate high-impact engagements that reveal human vulnerabilities within organizational defenses. By the end of this guide, you will be adept at executing this technique, understanding its evasion potential, and showcasing its effectiveness in real-world scenarios.

Prerequisites and Setup

Before you begin executing orphaned VBA code in DWG files for phishing exercises, ensure you have the right tools and environment:

Office Suite: Required to manipulate VBA code. Install the latest Microsoft Office that supports VBA scripting.
AutoCAD Software: Necessary for handling DWG files. You can use AutoCAD 2021 or later. A trial version suffices for non-production testing.
Hex Editor: Use a hex editor like HxD for embedding and manipulating orphaned macro code within DWG files.
File Conversion Software: Tools like Zamzar to convert and prepare files for our eventual payload delivery.
Access to Email Sending Tools: Platforms like GoPhish are essential for crafting and dispatching phishing emails containing DWG attachments.

Ensure your network settings allow for outbound SMTP traffic if using email simulation tools. Familiarity with

VBA

scripting and a basic understanding of the structure of DWG files in AutoCAD will facilitate seamless execution.

Step-by-Step Execution

Embedding VBA Code into a DWG File

Prepare the VBA Payload

First, develop a simple VBA script with malicious intent or a message box for demonstration. Use

Visual Basic for Applications

editor within any Microsoft Office app to write your code.


Sub AutoOpen()

    Shell "cmd.exe /c start notepad.exe"

End Sub

This script is triggered upon opening and executes a command prompt that, for instance, starts Notepad. Modify the payload according to your engagement’s goal.

Hex Embed the Payload

Open the DWG file in HxD editor. Locate the end-of-file marker, often indicated by “0D 0A 25 25 EOF”. Insert the VBA hex payload crafted from the earlier step right before this marker.


Offset 0x1AFA3: 55 6E 70 61 63 6B 20 74 68 65 20 48 65 78 20 56 42 41 20 52 65 73 75 6C 74

The example above shows a hex-embedded indication. Translate your VBA into hex and replace the corresponding section in your target DWG file.

Deploy the Constructed File in a Phishing Campaign

Crafting the Phishing Email

Compose a convincing email with urgency that leverages social engineering techniques to increase interaction:

Subject: Important: Update Required for AutoCAD Design Files

From: IT_Department@architects-firm.co

Date: [Current Date]

Body:

Dear User,

We have identified a critical update required for your recent project files. Attached is the updated DWG file with essential configuration changes. Please review and implement as soon as possible to ensure compliance with our new security protocols.

Regards, 

IT Department

Embed the crafted DWG file as an attachment. Ensure your email layout and sender domains are meticulously tailored to evade both email filters and user suspicion.

Reaction to Execution & Monitoring Engagement

Triggering and Capturing Data

Upon sending the email and receiving interaction, monitor engagement metrics such as open rates and payload execution frequencies. Utilize logs from tools like GoPhish or internal tracking systems to gain insights into user behavior and capture how effectively the evasion worked in a real-world scenario.


SELECT * FROM email_logs WHERE status = 'Opened' AND attachment_interaction='Executed';

This database query fetches interaction data, essential in analyzing and reporting your campaign’s success.

Advanced Variations

Complex VBA Obfuscation

Enhance evasion through advanced VBA obfuscation techniques. This involves employing tools like EnvCode to mask VBA signature patterns, thus eluding Antivirus and VBA scanning solutions. Here’s how you might obfuscate the previous script:


Sub ObfuscatedAutoOpen()

    Dim a As String

    a = Environ("SYSTEMROOT") & "\system32\notepad.exe"

    Shell a, vbHide

End Sub

This approach makes it harder for automated threat detection mechanisms to scrutinize the script.

Utilizing Alternative Document Types

Expand the scope beyond DWG files to PDF or other CAD formats like DXF. Embedding orphaned VBA code into these types utilizes document conversion attacks and multi-layered payload delivery. Use PDF editing tools that support script execution to implant VBA payloads disguised as feature scripts, ensuring similar steps are followed as with DWG files.


qpdf --object-streams=disable --encrypt <password> <input.pdf> <output.pdf>

This command manipulates PDF encryption to conceal script payloads, fooling basic inspection while maintaining script integrity for execution upon file opening.

Do’s and Don’ts

Do: Optimize email authenticity; matching organizational tone and style increases believability. For instance, a subject line such as “Updated Security Protocol Required” closely aligns with regular IT communications.
Don’t: Use generic messages lacking personalization or organizational context. Phrases like “Click this link” or “Download now” tend to arouse suspicion instantly.
Do: Regularly test your VBA payload in different environments.

Test the VBA execution in virtual machines

with varying configurations to ascertain failure points and modify accordingly.
Don’t: Assume a single payload setup is universally effective; dynamic adjustment to new security protocols is key.

Related Concepts

The orphaned VBA code technique relates closely to macro-based attacks that exploit Office suite vulnerabilities. A notable framework crossover is with steganography for payload obfuscation, where malicious code is concealed within images in documents, further evading detection. Cross-discipline knowledge of SPF/DKIM/DMARC can also enhance the effectiveness of email impersonation tactics.

References

Detailed ISC SANS Article on VBA Exploits

Office Support for VBA

HxD Hex Editor Official Page