PowerPoint File Downloads Malware When You Hover a Link, No Macros Required

itman · Jun 2, 2017

Security researchers have spotted a booby-trapped PowerPoint file that will download malware to a computer whenever a victim hovers a link, no macro scripts required.

The file is a PowerPoint presentation that is delivered to potential victims as a file attachment with emails bearing the subject line "RE: Purchase orders #69812" or "Fwd:Confirmation". The name of the PowerPoint file itself is "order&prsn.ppsx", "order.ppsx", or "invoice.ppsx", and there's also evidence the file has been spread around inside ZIP files.

Spam email delivering booby-trapped PPSX file

Hello,

Please see attached purchase order for the moving of equipment from=London to Surrey on Wednesday 31st May.

Thanks
Nasim Khan , E-Pharm Limited
Phone : +44 (0) 203 3002245

PPSX files are identical to PPTX files, except they enter the PowerPoint presentational view when opened, instead of the PowerPoint edit mode.

The PowerPoint file contains only one slide with the following content (pictured below), containing the linkified text "Loading...Please wait

Whenever the user hovers the URL, malicious code is executed that will invoke PowerShell and attempt to execute the following code.

If the user is using an Office installation with the Protected View security feature enabled, Office will stop the attack from taking place.
Click to expand...

https://www.bleepingcomputer.com/ne...are-when-you-hover-a-link-no-macros-required/

itman · Jun 9, 2017

Mouseover Macro Campaign Delivers Gootkit Trojan Via PowerPoint

Earlier this week, a researcher analyzed a newly detected technique for delivering malware involving PowerPoint files and mouseover events. Today, Trend Micro has published details on a spam campaign it detected in late May using the same technique.

TrendLabs researchers Rubio Wu and Marshall Chen suggest that although the recent campaign was limited (which in itself is not unusual as attackers try to avoid detection), it could be considered a dry run for future campaigns. The campaign was targeted particularly and organizations in the U.K., Poland, Netherlands, and Sweden.

Similar to the earlier analysis, it used emails with a subject comprising a finance-related word followed by a number. "The pattern we saw," notes the TrendLabs report "is '[fee] #__NUM__', indicating that the operator, or the service provider that sends the spam email on behalf of the operator, are tracking the spam messages they send."

The email is disguised as an invoice or purchase order and has a malicious PowerPoint Show file attached. This opens directly in presentation mode. The malicious macro will attempt to run as soon as the mouse is moved over the presentation; but is generally prevented by Microsoft's Protected View until and unless the user 'enables' macros.

"Hence," say the researchers, "a key ingredient in the infection chain is social engineering -- luring the victim into opening the file and enabling the malware-laced content to run on the system." The report does not elaborate on this, merely pointing out that, "A socially engineered email and mouse hover -- and possibly a click if the latter is disabled -- are all it would take to infect the victim."

Once the macro runs, an embedded malicious PowerShell script is executed to download another downloader (JS_NEMUCOD.ELDSAUGH) in the form of a JScript Encoded File (JSE). It is this that retrieves the final payload from a command-and-control (C&C) server.

The payload detected by TrendLabs is a variant of the OTLARD banking Trojan, also known as Gootkit. This is well-known in Europe for stealing credentials and bank account information. TrendLabs suggests the detected campaign may be the precursor of wider use. "It wouldn't be far-fetched for other malware like ransomware to follow suit," say the researchers; "for instance, considering the notoriety of OTLARD/Gootkit's operators for spreading other threats in their payloads, as well as ransomware's history with using malware-laced Office documents."
Click to expand...

http://www.securityweek.com/mouseover-macro-campaign-delivers-gootkit-trojan-powerpoint

NormanF · Jun 10, 2017

Phishing campaigns work because of human curiosity and well if you know how to get to your intended victim, they will check it out be sure its a genuine communication.

By the time they realize it isn't, its too late.

Sampei Nihira · Jun 11, 2017

https://blog.malwarebytes.com/threa...ngineering-scheme-triggers-on-mouse-movement/

......Malwarebytes users were already protected against this threat thanks to our Application Behavior Protection....
Click to expand...

Log in or Sign up

PowerPoint File Downloads Malware When You Hover a Link, No Macros Required

itman Registered Member

itman Registered Member

NormanF Registered Member

Sampei Nihira Registered Member

Log in or Sign up

PowerPoint File Downloads Malware When You Hover a Link, No Macros Required

itman Registered Member

itman Registered Member

NormanF Registered Member

Sampei Nihira Registered Member

Useful Searches