TROJ_CVE20170199.JEJOVK

This malware exploits a vulnerability found in Microsoft Office known as CVE-2017-0199. There are reports that exploits using the said vulnerability are in the wild. A security patch for the vulnerability is already out and available.

This Exploit arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This Exploit arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Exploit connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.16.242/myguy.xls

It takes advantage of the following software vulnerabilities to download possibly malicious files:

• CVE-2017-0199 | Microsoft Office Remote Code Execution Vulnerability

As of this writing, the said sites are inaccessible.

Other Details

This Exploit does the following:

• Upon opening the document, shows the following user prompt:
  

NOTES:
The malware contains an embedded object which contains the malicious URL:

The malware is capable of connecting to the malicious URL upon execution, since it contains an "Update Object Class" that points to the embedded object, that will trigger the malware to connect to the malicious URL.