Hello, welcome to the Wednesday, November 8, 2017 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes.

Ulrich, and today I'm recording from Miami, Florida. Xavier came across a fairly convoluted, an interesting infection vector that he saw being used in some spam that he caught in his spam trap.

It all starts out as so often with an RTF document.

That document then downloads a URL that includes an XML document.

The XML document then uses the Microsoft HTML application host in order

to grab another URL that includes an obfuscated VBA script. Now this visual basic for

application script is where it gets sort of interesting. It first kills all

Word instances and then checks which was the last Word document opened, which of course should

be the original RTF document. Now it uses that RTF document to extract a form that's then being displayed in VIRT.

So VIRT is restarted, kind of pretending like nothing happened.

And then an executable that was added at the end of the document is executed.

DDA also saw a second Visual Basic script being downloaded, but that script was

never executed, so not really clear what it's for. Maybe the malware wasn't quite done yet.

Now, from a defensive point of view, these documents are actually pretty easy to spot because

the Windows binary is essentially just appended to the end of the document.

You will see that string, this program cannot be run in DOS mode within the file.

So a simple rule here. If an RTF document that claims to be a Word document

does include this string, this program cannot be run in DOS mode, it's probably malicious.

And the initial download is accomplished with the include picture feature. Again, that string include picture is in the clear,

easy to detect. And if you're listening to this podcast, you probably know enough about security

to not just plug untrusted USB sticks into your computer. Typically, we're really more afraid here about malware that may either automatically or accidentally be executed when we plug in this USB stick.

But it turns out, in particular, if you're using Linux, there are actually a large number of unpatched vulnerabilities

...