Microsoft Word Intruder
According to nakedsecurity the new tool Microsoft Word Intruder or MWI allows anyone to develop a high level malware software. It is thought that MWI was created in Russia, it is able to generate “booby-trapped” files by creating Rich Text Format documents allowing attacker to exploit multiple vulnerabilities presented in Microsoft Word.
What type of malware software does it generate?
MWI has the ability to create two types of malware software:
- Downloader – Malicious payload requires to download additional files
- Dropper – Differently from downloader, dropper uses malicious payload located on infected machine. Which means that infection will take place locally even in offline mode after which the primary malware software component is dropped.
The latest version has a feature to pack several vulnerabilities in the same document as advertised by its creator Objekt in underground.
According to FireEye new malware tool includes a tracking feature embedding URL in generated RTF files. Bobby-trapped document with embed URL sample looks like this:
- {\listoverride
- \listid283385527\pgp\ipgp0\utap0\li0\ri0\bin-32\sb0\sa0\listoverrideco
- 0000000000000000000000000000000000000000000000000000000
- 0000000000000000000000000000000000000000000000000000000
- 0000000000000000000000000000000000000000000000002611111
- {\field(\*\fldinst (INCLUDEPICTURE
- http://XXXXXXXX.com/image.php?id=19019691 \\ *MERGEFORMAT
- \fldrslt)}
- {\object\objocx{\*\objclass Word.Document.11)
- {\*\objdata
- 91959999929999991b00000000000000000000000000000000000000
- 00000000000000000000e0000
Vulnerabilities Used by Malware Software
Microsoft Word Intruder uses following vulnerabilities for exploitation:
These same vulnerabilities have been used by ZeuS or Zbot, one of the most sophisticated banking Trojans.
Recommended Security Measures
MWI malware software is mainly spread by email spam. Security Zap recommends NOT to open suspicious emails, especially those containing Microsoft Office files and always update your malware protection software.