Attackers concealing malicious macros in XML files

XML files are harmless text files right? Wrong! The group behind the malicious Microsoft Office document campaigns have started to utilize Microsoft Office XML formats to hide malicious macros. This week, our spam traps were flooded with spam with XML file attachments claiming to be a "remittance advice" from random companies.

The attachment is in fact a Microsoft Word document (the older 2003 binary format) that was saved as an XML file. A Windows OS with Microsoft Office installed will recognize the file as a MS Word document. Double clicking the XML file will automatically open the Word application and may result in accidentally running the malicious macro if the user has enabled macros in MS Office.

Hidden in this seemingly harmless XML file is a malicious macro document file which is compressed, encoded in base64, and stored in XML format. Below is diagram showing how the malicious document was stored.

The VBA macro script is obfuscated and, to make a long story short, it downloads an info-stealing Trojan known as Dridex. In our sample, the Trojan is hosted in hxxp://46.30.42.90:8080/azvxjdfr31k/abs5ajsu.exe and when downloaded is saved in the Windows Temp folder with the filename "fdgfdgdfga.exe".

SANS Institute provided some good advice on how to block this kind of malicious email in your email gateway; check if the attached XML file is a Word Office document and if attribute w:macrosPresent="yes" is present.

The Trustwave Secure Email Gateway (SEG) blocked this campaign out of the box.