ViperMonkey | VBA parser and emulation engine | Reverse Engineering library
kandi X-RAY | ViperMonkey Summary
kandi X-RAY | ViperMonkey Summary
ViperMonkey is a VBA Emulation engine written in Python, designed to analyze and deobfuscate malicious VBA Macros contained in Microsoft Office files (Word, Excel, PowerPoint, Publisher, etc). See the article "[Using VBA Emulation to Analyze Obfuscated Macros] for real-life examples of malware deobfucation with ViperMonkey. ViperMonkey was also demonstrated at the Black Hat Europe 2019 conference: see the [slides] and [video] (at 18:38). ViperMonkey was created by [Philippe Lagadec] in 2015-2016, and the project is maintained in the repository Since November 2017, most of the development is done by [Kirk Sayre] and other contributors in the repository The main repository is synchronised regularly, but cutting edge improvements are usually available first in Kirk’s version. Quick links: [Report Issues/Suggestions/Questions] - [Contact the Author] - [Repository] - [Updates on Twitter] - [API Tutorial] docs/APITutorial.md).
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- Fix problematic code .
- Strip unused variables .
- Evaluate an expression .
- Fixes VBA code .
- Decode VBA code .
- Set the value of a variable .
- Read payloads from payload .
- Create a context of the engine .
- Extract OLE text values from a file object .
- Get the values for each variable .
ViperMonkey Key Features
ViperMonkey Examples and Code Snippets
Community Discussions
Trending Discussions on ViperMonkey
QUESTION
I want to build a manual sandbox to analyze malwares on Windows systems. I mean a manual environment, not something automated like Cuckoo Sandbox.
There are many tools and I selected some of them, but I can't really see if each of this tool is worth it or not. Can you say me what you think and if these tools are useful for my sandbox?
First I consider some of them are unavoidables like IDA, winDBG, Wireshark, npcap, an HTTP Proxy like Fiddler, the Sysinternals suite, Volatility, maybe Foremost.
Then there are others tools I never really tried but which seems to be interesting. About static analysis, I have spotted the following tools and I would like to have an eventual feedback about it : Log-MD (a tool which look at the system using advanced Windows audit policies), Cerbero Profiler, Pestudio, Unpacker (it seems it is an automated tool to unpack binaries, seems faster but I am bit skeptical but I'm not a RE specialist, if you know this tool...), oledump.py by Didier Stevens (to identify various elements like heuristic patterns, IP, strings)...
About dynamic analysis, I noted Hook Analyzer (statically analyze elements with heuristic patterns and allow you to hook applications), Malheur (detect "malicious behavior"), ViperMonkey (detect VBA macro in Microsoft Office documents and emulate their behavior.
Do you have any recommandations about my setup and tools I could have forgotten? I want to analyze classic malicious elements (PE, PDF, various scripts, Office documents, ...).
About malware evasion, is there a risk a malware refuse to be analyzed while detecting RE and analysis tools?
Finally should I use Internet in the sandbox? Most of malwares today use C&C server and I see that some sandboxes are built with simulators like iNetSim but since the connection is not real, will I lost some information?
Thank's!
...ANSWER
Answered 2017-Mar-29 at 08:18You might want to consider the SEE framework to build your analysis platform.
Its plugins based design will allow you to integrate scanning tools in a pretty flexible manner.
Bear in mind that lots of malware inspect the execution environment and, if any RE tool will be spotted, will refuse to run.
For what concerns the Internet connection, it depends on how much information you want to gather. It is indeed true that lots of malware communicate with C&C nowadays, yet they must ensure their persistence on the target machine.
Therefore, the injection mechanism will still be executed even if Internet connection is absent. My 2 cents on the matter is to run without Internet by default and activate it only when necessary.
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install ViperMonkey
Install docker.
Run docker/dockermonkey.sh MYFILE to analyze file MYFILE.
If PyPy is not installed on your system, see http://pypy.org/download.html and download PyPy 2.7. (not 3.x)
Check if pip is installed for pypy: run pypy -m pip
If pip is not installed yet, run pypy -m ensurepip on Windows, or sudo -H pypy -m ensurepip on Linux/Mac
Make sure pip is up-to-date, by running pypy -m pip install -U pip
Download the archive from the repository: https://github.com/decalage2/ViperMonkey/archive/master.zip
Extract it in the folder of your choice, and open a shell/cmd window in that folder.
Under Ubuntu install pypy-dev (sudo apt-get install pypy-dev).
Install dependencies by running pypy -m pip install -U -r requirements.txt on Windows, or sudo -H pypy -m pip install -U -r requirements.txt on Linux/Mac
Check that Vipermonkey runs without error: pypy vmonkey.py
Make sure you have the latest Python 2.7 installed: https://www.python.org/downloads/
If you have both Python 2 and 3 versions installed, use pip2 instead of pip in the following commands, to install in Python 2 and not 3.
Make sure pip is up-to-date, by running pip install -U pip
Use pip to download and install vipermonkey with all its dependencies, by running the following command on Windows:
Check that Vipermonkey runs without error: open a shell/cmd window in any directory, an simply run vmonkey
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page