A newer anti-sanbox method by malware

[cruelsister]

Just something interesting that I heard about a malicious Office macro going around:

There are just loads of ways that malware try to detect the presence of either a VM and/or Sandbox. Typically this is by dll checking, OS product key checks, direct querying of the environment by stuff like the utilization of the GetTickCount API., etc.

But a former colleague just made me aware of a newer method for malware directed to Businesses, and this is by the Office RecentFiles property. The malware will use this to check on how many Office Docs have been recently opened, and if the number is small (like in a testing environment) it will shut down. Seems the malware will only execute if the number of recent files opened is above 10 (at least in the sample that he found, which he refuses to share unless I date him).

 

[_CyberGhosT_]

Exterminator and I have links to the story here: Security Alert - Malicious Macros in Office Documents Find New Tricks to Evade Detection
It's scary, good in that it will for sure keep the security conscious on their toes
Thanks CruelSis.
PeAcE

 

[jamescv7]

Well sometimes a logical thinking is so powerful where you can definitely trick anything even though the presumption for majority is way too far.

Hence more will be target for Anti-Sandbox; at the moment AV's shines because it is common due to obsolete techniques.