Evil Clippy v1.3 releases: hide VBA macros, stomp VBA code and confuse macro analysis tools

by do son · Published April 28, 2019 · Updated October 25, 2022

Evil Clippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX, and Windows. This tool was released during our BlackHat Asia talk (March 28, 2019).

Current features

Hide VBA macros from the GUI editor
VBA stomping (P-code abuse)
Fool analyst tools
Serve VBA stomped templates via HTTP
Set/Remove VBA Project Locked/Unviewable Protection

If you have no idea what all of this is, check out the following resources first:

Our MS Office Magic Show presentation at Derbycon 2018
VBA stomping resources by the Walmart security team
Pcodedmp by Dr. Bontchev

How effective is this?

At the time of writing, this tool is capable of getting a default Cobalt Strike macro to bypass all major antivirus products and most maldoc analysis tools (by using VBA stomping in combination with random module names).

Technology

Evil Clippy uses the OpenMCDF library to manipulate MS Office Compound File Binary Format (CFBF) files, and hereto abuses MS-OVBA specifications and features. It reuses code from Kavod.VBA.Compression to implement the compression algorithm that is used in dir and module streams (see MS-OVBA for relevant specifications).

Evil Clippy compiles perfectly fine with the Mono C# compiler and has been tested on Linux, OSX, and Windows.

Changelog v1.3