Shou – Automated Maldoc Creation with ActiveMime tricks

Shou is a tool designed for automate MalDoc generation.

Explanation:

We use an MHT format

The technique was seen by the Japanese cert in 2023 (MaldocInPDF), it was simply automated (creation of the file, embedding of the macro...).

If the MHT file is renamed to .doc, it executes the macros, so it's a quickwin :)

Thanks to @ttpreport for the help, and permission to use his research :)

Quick Start Guide

1. Installation:

git clone https://github.com/1sis/Shou
cd Shou
pip install -r requirements.txt

Modify your registry key with "EnableVBOM.reg"

Utilisation:

python3 shou.py -f [SCRIPT.vba] -o [OUTPUT.doc]

References:

• OLETools – Detect VBA in Files
• Trustwave - Stealthy VBA Macro in PDF
• JPCert - MaldocInPDF
• Cyren - New tricks for Macro malware
• TTP Report - Release activemaim