June 30, 2023 11:45 AM (GMT+2) - **YONATHAN BAUM & DANIEL WOLFMAN**

This lecture will discuss a new technique discovered by the Mimecast Research Team.

This technique can be used for embedding malicious scripts in Excel documents using one of the latest Excel new features – LAMBDA, bringing new life to a previously considered dead threat. In the lecture, it will be shown how easily the technique can be used to evade existing static analysis engines and allows the user to run arbitrary code on their machine. The lecture will begin by introducing some background of the key terms such as Lambda, Macro, past Office malicious attacks – and then discuss the current state of threats using Lambda. The lecture will then delve into the technical background of the method, specifically into the use of Excel 4.0 macros and obfuscation to hide the malicious payload. The lecture will conclude with a demonstration of the technique, PoC of evading some engines in VirusTotal, and a discussion on its implications for security.

Excel 4.0 Macros Malware

https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros-xlm/

https://blog.stmcyber.com/excel-4-0-for-red-team/

Using Excel 4.0 Macros to open calc.exe and obfuscate to dodge virustotal static code analysis

Vuln in Excel

Lamda function

exploitation

Excel 4.0 macro enabled

Static code analysis -> almost bypassed by just using a symmetric encryption lambda (encrypt/decrypt payload) VBA -> ExecuteExcel4Macro