We analyzed a Sharp Dragon APT chain targeting Malaysian government officials
A weaponized Word document posing as a US-China policy brief. Same actor. New campaign. New geography.
The document is convincing, formatted as a legitimate diplomatic policy brief titled “Malaysia Policy Brief: Trump China Visit”, with a professional structure clearly designed for senior officials tracking US-China-ASEAN relations.
The payload is a VBA macro that hides the embedded binary across 15 Form TextBox objects in the document’s UserForm. Nothing is dropped to disk until execution.
Execution chain:
VBA macro decodes the 15 TextBox chunks at runtime → assembles and drops a loader disguised as OneNote.exe → custom AES-128-ECB LZ4 decompression, intentionally avoiding CryptoAPI → Download_s.dll beacon → HTTP GET to /microsoftonline/common/oauth2/authorize.php impersonating Microsoft → NtMapViewOfSection into rundll32.exe → Stage 4 delivered
Our @thor_scanner run produced the following YARA hits:
SUSP_VBA_Dropper_Feb26
valhalla.nextron-systems.com…
APT_MAL_DLL_Loader_May24
valhalla.nextron-systems.com…
Doc sample (2/62)
virustotal.com/gui/file/88b9…
Second stage
virustotal.com/gui/file/dccb…
Downloader (stage3) sample
virustotal.com/gui/file/d013…
Learn how to restrict a VBA UserForm TextBox to numbers only using the VBA KeyPress event and KeyAscii argument. Negative numbers and decimals are also allowed.
wellsr.com/vba/2017/excel/vb…
Step 2: Add the Code in PowerPoint
Open PowerPoint and go to Options
Select Customize Ribbon and enable Developer
Click Developer → Visual Basic
Insert a UserForm
Click Modules, paste the code, and run it
Customize and design your presentation template
Step 2: Add Code in PowerPoint
- Open PowerPoint, go to 'Options'
- Choose 'Customize Ribbon' and check 'Developer'
- Click 'Developer' > 'Visual Basic'
- Insert 'Userform'
- Click 'Modules', paste code, and play
- Design your template