Wrong object names

[SecSamDev]

The code is using the wrong object names. And more specifically, it's choosing the name of the previous object as the current one, so all the names of the objects / functions in the macro are wrong.
Maybe the (empty macro) is making the algorithm confused.

-------------------------------------------------------------------------------
VBA MACRO Baouaxfdk.cls 
in file: ./1/82606821.doc - OLE stream: 'Macros/VBA/Baouaxfdk'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Geweminsodx.bas 
in file: ./1/82606821.doc - OLE stream: 'Macros/VBA/Geweminsodx'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Function Zmflvlba()
On Error Resume Next
   Dim bYDMLFjw, OXvnd
Dim bHGnFxjFH()
ReDim bHGnFxjFH(1)
bHGnFxjFH(0) = "Sergio"

Dim JzLZO()
ReDim JzLZO(2)
JzLZO(0) = "Credit Card Account"
JzLZO(1) = "Adamczak - Chmielewski"

Dim PGcpCJVwA()

Line #0:
	FuncDefn (Function Geweminsodx())
Line #1:
	OnError (Resume Next) 
Line #2:
	Dim 
	VarDefn Zmflvlba
	VarDefn bYDMLFjw
Line #3:
	Dim 
	VarDefn OXvnd
Line #4:
	OptionBase 
	LitDI2 0x0001 
	Redim OXvnd 0x0001 (As Variant)
Line #5:
	LitStr 0x0006 "Sergio"
	LitDI2 0x0000 
	ArgsSt OXvnd 0x0001 
Line #6:
Line #7:
	Dim 
	VarDefn bHGnFxjFH
Line #8:
	OptionBase 
	LitDI2 0x0002 
	Redim bHGnFxjFH 0x0001 (As Variant)
Line #9:
	LitStr 0x0013 "Credit Card Account"
	LitDI2 0x0000 
	ArgsSt bHGnFxjFH 0x0001 
Line #10:
	LitStr 0x0016 "Adamczak - Chmielewski"
	LitDI2 0x0001 
	ArgsSt bHGnFxjFH 0x0001 
Line #11:

[bontchev]

Normally that doesn't happen. Can I get a copy of the actual document with macros? Maybe there's something weird in it.

[SecSamDev]

Sure, sample sended.

[bontchev]

Thanks. OK, I can see why this is happening. Problem is, I don't see how to fix it...

The code that is causing the problem is this:

                if idCode > 0xBE:
                    idCode -= 1

If I don't subtract 1, this sample will be disassembled correctly. But then others (that are now disassembled correctly) won't be. I'll have to see if I can find a way to fix it properly, but for now I have no idea how.

[SecSamDev]

I would be happy to help you.
But I don't understand what exactly idCode does.

[bontchev]

The purpose of the function this code resides in is to take the operand of an opcode instruction that refers to a symbolic argument (like a variable or function name) and locate the corresponding symbol in the symbol table. Problem is, the algorithms have changed with the VBA and Office versions and it's a bit of a hit-and-miss to figure out the correct one. I'll keep digging.

The problem is further exacerbated by the fact that I don't have all the Office versions. The last one that I have is 2002. I have some documents created by later versions (like 2010 and 2013) but I don't have these versions of Office, so I can't freely experiment with them. And I don't think I have anything created with Office 2016 or Office 365...

[bontchev]

I really don't know how to solve this... If I don't subtract 1 there, the macro in the document in this repository won't be disassembled correctly. If I do, your Emotet sample won't be disassembled correctly.... On the top of everything, both problematic documents are made with an Office version that I don't have and can't experiment freely with... I'll keep digging but for now I'm out of ideas.

[decalage2]

If you need sample files created with different versions of Office, maybe we can help. What would you need exactly?

[bontchev]

I'm not really sure; I would have preferred to experiment with different things myself... For starters, the problem seems to occur when the VBA project uses lots of different symbols - like 200 or more.

[inshua]

Thanks. OK, I can see why this is happening. Problem is, I don't see how to fix it...

The code that is causing the problem is this:

                if idCode > 0xBE:
                    idCode -= 1

If I don't subtract 1, this sample will be disassembled correctly. But then others (that are now disassembled correctly) won't be. I'll have to see if I can find a way to fix it properly, but for now I have no idea how.

I met this problem too, any more progress?

[bontchev]

No, I couldn't figure out how to solve it, sorry.

[DissectMalware]

Share with me a sample where this occurs and a normal one; I will dig it and see whether I can figure it out

[KevinW1998]

I really don't know how to solve this... If I don't subtract 1 there, the macro in the document in this repository won't be disassembled correctly. If I do, your Emotet sample won't be disassembled correctly.... On the top of everything, both problematic documents are made with an Office version that I don't have and can't experiment freely with... I'll keep digging but for now I'm out of ideas.

I've noticed that the Pafish.docm document has an empty identifier. Empty identifiers are not appended to the identifier list, and I guess that is the reason why the index does not match?

I'd suggest:

            if idLength:
                ident = decode(vbaProjectData[offset:offset + idLength])
                identifiers.append(ident)
                offset += idLength
            else:
                identifiers.append("<unknown>")

[bontchev]

What is an empty identifier?

Anyway, your proposed change does not solve the problem - it just makes the output wrong in a different way. I'm not accepting it.