🧵 How Joe Reverser unpacked the sample One of the more interesting aspects of this sample is that the malicious payload isn't stored as a conventional macro or embedded executable. Instead, Joe Reverser automatically reconstructed the full payload chain. 🔍 The unpacking workflow looked like this: 1️⃣ OOXML extraction • Identified an external attachedTemplate relationship in word/_rels/settings.xml.rels. • Located multiple suspicious docVar entries inside word/settings.xml. 2️⃣ Document variable decoding • Decoded the mslxm_0 variable to recover the COM/CLSID string. • Decoded the large s2_0 variable using Base64 + XOR (0x2a). 3️⃣ BinaryFormatter recovery • Identified the decoded blob as a .NET BinaryFormatter serialized object. • Detected an ActivitySurrogateSelector gadget chain and located an embedded PE inside the serialized stream. 4️⃣ Embedded DLL extraction • Automatically carved the embedded 32-bit .NET DLL (App.dll). • Decompiled the assembly and recovered hundreds of obfuscated strings. 5️⃣ Stage reconstruction • Recovered the C2 endpoints. • Identified host fingerprinting, AV discovery, anti-analysis logic, and the final Stage 3 download routine. • Determined that the downloaded payload is XOR-decrypted and loaded directly into memory using Assembly.Load(). 💡 Rather than stopping at "malicious document detected," Joe Reverser automatically reconstructed the complete unpacking chain—from OOXML document variables to the embedded .NET loader—making the malware's execution flow immediately understandable. 🔗 Joe Reverser report: joesandbox.com/joereverser/a… #ThreatIntel #MalwareAnalysis #ReverseEngineering #SideWinder #JoeReverser #DFIR

Full Prompt