adb

Adaptive Document Builder

A framework for generating simulated malicious office documents.

Features

VBA is distinct for every document (level of distinction depends on the adversary document builder selected)
Random author based on easily updated/replaced name lists (sets local system registry keys before each document build)
Random file name based on the most commonly seen file names in malicious document campaigns
Multiple file formats (doc, docm, XML flat OPC)
Multiple file extensions (.doc, .docm, .rtf)
Supports multiple payloads
Functions for building and randomizing VBA are in a shared library for use across multiple adversary builders
Modular design and architecture for easy addition of more adversary builders
debug mode that outputs audit trail of document creation details including VBA contents

Runs on

Python 3 on Windows
COM is used to interface with an installed and configured Office product

Pre-requisites

Office installed
Office opened once to create first-time-run registry entries
Office must "Trust access to the VBA project object model" (must be checked)
https://support.office.com/en-us/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6
Python modules in requirements.txt installed

Run this on a virtual machine!

Disable Windows Defender or add an exclusion for the adb files (before cloning) and your output directory or they might get cleaned
Registry entries will be changed when setting the author of documents, so don't run this with any production Office software

Usage

List available adversary emulation builders

>python adb.py -l
sample_with_network_test
underscore_crew_201806

Build documents

Build 5 documents with vba and payload style resembling underscore_crew_201806 (group that delivered agent tesla during this time period)

Extension: .doc
File Format: XML flat OPC

>python adb.py -a underscore_crew_201806 -c 5 -o C:\users\h\desktop\out -f flatxml -e doc
[*] Building document Sales_Invoice_6619.doc with author: Valentia A Petersen
[*] Building document Your_Invoices_5801.doc with author: Nydia Shields
[*] Building document Selected_Ticket_9047.doc with author: Felipa Henson
[*] Building document Past_Due_Receipt_4278.doc with author: Minh J Mosley
[*] Building document Final_Bill_7431.doc with author: Kaile Perkins

Modify documents

VBA stomp (overwrite the compressed VBA storage) a macro enabled document (specified by -v). For more information about VBA Stomping see vbastomp.com.

>python adb.py -a emotet_20190222 -o C:\users\h\desktop\out -v

VBA stomp a single document (regardless of how it was created)

>python internals\stomp_vba.py C:\users\h\desktop\out\Incorrect_Payment_7457.doc
[*] Stomped VBA - new file at: C:\users\h\desktop\out\Incorrect_Payment_7457.doc.stomped

Note: VBA stomping works for Word (.doc and .docm) and Excel (.xlsm) files. Currently, Excel .xls (Office 97-2003 format) is not supported.

Help Output

usage: program_name [-h] [-a ADVERSARY] [-f FILETYPE] [-e EXTENSION]
                    [-c COUNT] [-l] [-o OUTDIR] [-d]

program description

optional arguments:
  -h, --help            show this help message and exit
  -a ADVERSARY, --adversary ADVERSARY
                        -a --adversary {adversary name} (use -l to list)
  -f FILETYPE, --filetype FILETYPE
                        -f --filetype doc | docm | flatxml
  -e EXTENSION, --extension EXTENSION
                        -e --extension doc | docm | rtf
  -c COUNT, --count COUNT
                        -c --count {# of docs to create}
  -l, --listadversaries
                        -l --listadversaries : list available adversaries and
                        exits
  -o OUTDIR, --outdir OUTDIR
                        -o --outdir {path\to\outdir}
  -d, --debug           -d --debug : print debug statements and playbook for
                        each document
  -v VBASTOMP, --vbastomp VBASTOMP
                        -v --vba-stomp : VBA stomp each document as they are built

HackingLZ/adb

adb