[STRELiTZIA]

Hello,
Just for fun... :mrgreen:

Tests:
1- Uses fake "vba32w.dll" to Hijacking "Vba32Arkit.exe".
2- Uncheck Use AntiVirus kernel before testing.

User-mode hook (WinVerifyTrust proc) performed to returns valid value for no signed application.


Attached fake "vba32w.dll"

Regards.

[EP_X0FF]

Hi,

Does it not check it's own dlls before working?

Regards.

[STRELiTZIA]

Does it not check it's own dlls before working?

Yes

[EP_X0FF]

So as in fact you can put any malicious code inside this dll and VBA app will execute it. I suppose it runs only with admin privileges.

[STRELiTZIA]

Hello,
Flash demo attached.

Vba32arkit (VirusBlokAda Ltd)
Process Explorer (Sysinternals)
sigcheck (Sysinternals)

Regards.

[sergey ulasen]

Hi,

STRELiTZIA, thx!

We will work on the self-protection more closely.

You can send your researches to support@anti-virus.by .