Macro Based Malware is on the Rise

Malware Authors Have a Rediscovered their Love for Visual Basic, as the Percentage of Macro Based Malware Rose from Around 6% of All Document Malware in June to 28% in July, Sophos Researchers Have Found. Gabor Szappanos, Principal Researcher at SophosLabs, Explained in a Paper Published Earlier this Year the Advantages of Visual Basic Code over Exploits: "Visual Basic code is easy to write, flexible and easy to refactor. Similar functionality can often be expressed in many different ways which gives malware authors more options for producing distinct, workable versions of their software than they have with exploits". Exploits, on the Other Hands, are More Difficult to Modify to Evade AV Detection and still be Able to Work as Intended. Another Advantage of Visual Basic Code over Exploits is that, it will Work in All Versions of Microsoft Office, Not just the Ones that are Vulnerable to that Particular Exploit. And Even though Microsoft has Made it so that, All Macros from Untrusted Sources are Disabled by Default, Malware Authors Have been Using Social Engineering to Trick Users into Enabling them:

Learning and Writing in Visual Basic for Applications (VBA) is Extremely Easy, Researchers Note but, Even if Malicious Actors Don't Have that Knowledge, there are a Number of VBA Downloader Templates that Can be Bought Online. "The samples in question contain Visual Basic code with helpful comments as to where authors should insert a malicious link as well as details of methods for obfuscating the code", the Researchers Explained. In the Example Pictured above, Once the Macros are Enabled and the Document is Reopened, the Malware Checks for the Presence of the PowerShell Task Automation Management Framework. If it's Present, it is Used to Execute Encoded Scripts and Inject the Shellcode into Memory, which Ultimately Establishes a Reverse Shell on the Affected Computer, Meaning that, the Attacker has Gained Full Remote Access to it and is Free to Tinker Around. "If the host machine does not have PowerShell installed the sample simply reverts to injecting shellcode using good old Visual Basic", the Researchers Pointed Out but, Noted that, despite its Effectiveness, VBA Shellcode Injection is currently Very Rarely Used, because it Improves the Chances of the Malware being Detected by Security Software.