Enable Me

You’ve received a confidential document! Follow the instructions to unlock it.

Note: This is not malware

Author: SteakEnthusiast
invoice.docm

After a bit of exploring, googling “ctf tool to point out what files might contain malware”, I found this. Following the steps in the writeup, I got this:

1
===============================================================================
2
FILE: invoice.docm
3
Type: OpenXML
4
WARNING  For now, VBA stomping cannot be detected for files in memory
5
-------------------------------------------------------------------------------
6
VBA MACRO ThisDocument.cls
7
in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'
8
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
9
Sub AutoOpen()
10
    Dim v6 As Variant, v7 As Variant
11
    v6 = Array(98, 120, 113, 99, 116, 99, 113, 108, 115, 39, 116, 111, 72, 113, 38, 123, 36, 34, 72, 116, 35, 121, 72, 101, 98, 121, 72, 116, 39, 115, 114, 72, 99, 39, 39, 39, 106)
12
    v7 = Array(44, 32, 51, 84, 43, 53, 48, 62, 68, 114, 38, 61, 17, 70, 121, 45, 112, 126, 26, 39, 21, 78, 21, 7, 6, 26, 127, 8, 89, 0, 1, 54, 26, 87, 16, 10, 84)
13

14
    Dim v8 As Integer: v8 = 23
15

16
    Dim v9 As String, v10 As String, v4 As String, i As Integer
17
    v9 = ""
18
    For i = 0 To UBound(v6)
19
        v9 = v9 & Chr(v6(i) Xor Asc(Mid(Chr(v8), (i Mod Len(Chr(v8))) + 1, 1)))
20
    Next i
21

22
    v10 = ""
23
    For i = 0 To UBound(v7)
24
        v10 = v10 & Chr(v7(i) Xor Asc(Mid(v9, (i Mod Len(v9)) + 1, 1)))
25
    Next i
26

27
    MsgBox v10
28
End Sub
29

30
-------------------------------------------------------------------------------
31
VBA MACRO Module1.bas
32
in file: word/vbaProject.bin - OLE stream: 'VBA/Module1'
33
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
34
(empty macro)
35
+----------+--------------------+---------------------------------------------+
36
|Type      |Keyword             |Description                                  |
37
+----------+--------------------+---------------------------------------------+
38
|AutoExec  |AutoOpen            |Runs when the Word document is opened        |
39
|Suspicious|Chr                 |May attempt to obfuscate specific strings    |
40
|          |                    |(use option --deobf to deobfuscate)          |
41
|Suspicious|Xor                 |May attempt to obfuscate specific strings    |
42
|          |                    |(use option --deobf to deobfuscate)          |
43
+----------+--------------------+---------------------------------------------+

Seems like some sort of program created in Microsoft Office’s VBA. We can find the documentation of certain functions on Microsoft by searching up [function] vba online. Here’s my analysis:

1
Sub AutoOpen()
2
    Dim v6 As Variant, v7 As Variant
3
    v6 = Array(98, 120, 113, 99, 116, 99, 113, 108, 115, 39, 116, 111, 72, 113, 38, 123, 36, 34, 72, 116, 35, 121, 72, 101, 98, 121, 72, 116, 39, 115, 114, 72, 99, 39, 39, 39, 106) # array
4
    v7 = Array(44, 32, 51, 84, 43, 53, 48, 62, 68, 114, 38, 61, 17, 70, 121, 45, 112, 126, 26, 39, 21, 78, 21, 7, 6, 26, 127, 8, 89, 0, 1, 54, 26, 87, 16, 10, 84) # array
5

6
    Dim v8 As Integer: v8 = 23
7

8
    Dim v9 As String, v10 As String, v4 As String, i As Integer
9
    v9 = ""
10
    For i = 0 To UBound(v6) # loop through all of v6
11
        v9 = v9 & Chr(v6(i) Xor Asc(Mid(Chr(v8), (i Mod Len(Chr(v8))) + 1, 1))) # append v8 ^ v6[i] to v9
12
    Next i
13

14
    v10 = ""
15
    For i = 0 To UBound(v7)
16
        v10 = v10 & Chr(v7(i) Xor Asc(Mid(v9, (i Mod Len(v9)) + 1, 1))) # append v7[i] ^ v9[i] to v10
17
    Next i
18

19
    MsgBox v10
20
End Sub

We can easily simulate the same process in Python:

1
v6 = [98, 120, 113, 99, 116, 99, 113, 108, 115, 39, 116, 111, 72, 113, 38, 123, 36, 34, 72, 116, 35, 121, 72, 101, 98, 121, 72, 116, 39, 115, 114, 72, 99, 39, 39, 39, 106]
2
v7 = [44, 32, 51, 84, 43, 53, 48, 62, 68, 114, 38, 61, 17, 70, 121, 45, 112, 126, 26, 39, 21, 78, 21, 7, 6, 26, 127, 8, 89, 0, 1, 54, 26, 87, 16, 10, 84]
3
v8 = 23
4

5
for i in range(len(v6)):
6
    v6[i] ^= v8
7
for i in range(len(v7)):
8
    v7[i] ^= v6[i]

Let’s print out v7:

1
for i in v7:
2
    print(chr(i), end='')

Except v7 contains some irrelevant message saying “you’ve been hacked”.
Well, v6 is longer than v7 but used in v7’s decryption. This is suspicious. Maybe we try to print out v6?

1
for i in v6:
2
    print(chr(i), end='')

And we get the flag!

1
uoftctf{d0cx_f1l35_c4n_run_c0de_t000}