SonicWall Capture Labs Threat Research team has observed a malicious PDF file, comes as an e-mail attachment, detected by SonicWall RTDMI ™ engine which is delivering REMCOS RAT as the final payload.

Infection Cycle:

The PDF file has a malicious embedded doc file, which is dropped and executed from %temp% folder. PDF file has an OpenAction tag, set to a javascript which is embedded in PDF. On opening the PDF file the script is executed. Embedded DOC file name is “has been verified. However PDF, SVG, xlsx, .docx”.

Java Script inside PDF, which drops and executes DOC file

The DOC file has a reference to an external URL, which is a RTF file. It loads the RTF file from “hxxps://shortener[.]vc/fSpur”, whose final redirected URL is “hxxp://45[.]85[.]190[.]156/receipt/290.doc”. This RTF file has a CVE-2017-11882 exploit, which further downloads an .Net executable at “C:\Users\Public\vbc.exe” and executes it.

External Frame Object Link in webSettings.xml.rels

The .Net executable ‘vbc.exe’ makes a copy of itself in %APPDATA% as ‘doc.exe’, and creates RUN registry entry for it as ‘wix’. And then executes doc.exe.

The .Net executable file has a compressed .Net DLL file in its ‘AppPropsLib.Documents.resources’ resource object named as ‘_22’. It decompresses the resource and loads the obfuscated DLL(internal name of the DLL is Periodicity.dll) in the memory and calls its second export, and passes it three string arguments “5374617469634172726179496E69745479706553697A65”, “7157624F” and “AppPropsLib”. First argument is “StaticArrayInitTypeSize” (passed in hex format) name of another Bitmap object present in the doc.exe resource, second argument is the decryption key “qWbO” (passed in hex format) and third argument is the resource name in doc.exe.

Then Periodicity.dll loads the bitmap resource present in doc.exe and extracts ARGB values for all the pixels in an array. It then gets the encrypted data size from the first pixel ARGB value and copies the encrypted data into another array, then starts decrypting it using the key passed as an argument and the last byte of the encrypted data array.

Loading ARGB value of pixels in an array

Decrypting using the key passed in the argument

The decrypted data is yet another .Net highly obfuscated DLL file whose internal name is Thookinieng.dll. The .Net DLL has encrypted resources, one of which is  REMCOS RAT. Its decrypted data has some interesting string :

Strings Used to check Sandbox or VM

Powershell command to add ExclusionPath for Defender

REMCOS keeps the configuration information in the resource named as settings. The very first byte tells us the RC4 key size, followed by RC4 key which is further followed by the encrypted configuration information:

The version of REMCOS Rat payload is ‘v3.4.0 Pro’ .It reads the key from the resource and decrypts configuration data using RC4 algorithm which contains Command and Control (C&C) server’s IP address, port number, password, REMCOS executable’s name and key logging filename etc.:

Malicious PDF hashes:

• f33170bbdf2c134c5de88cd931f850db16c093a9a26694040f889cea2c485cec
• 677011006f557a3c25befb217086f099708077c6d27e091e16be15f619fa9547
• 1f8a033bf8d5ab6d08b618980565c7f633985c154f5b8f6086f48b3d8304f906
• baa63cbb933cd6b69e18a9db664b95eb03902deb49767d94ab5b23322aeed650
• 3c29a03355bf0daea04e1c9f14523f71b88d839a3aab4ef52326f5632973d747
• d762702d22cbd585c26f778dd47cbb6807679f7a5b7e7b8eedb63676db0bcf71

The file is detected by few security vendors on popular threat intelligence sharing portal VirusTotal at the time of writing this blog, this indicates its spreading potential:

Evidence of detection by RTDMI ™ engine can be seen below in the Capture ATP report for this file:

SonicWall Threat Research Lab has observed the vulnerabilities that are actively being exploited from the beginning of this month. Please find below the list of vulnerabilities, vendor advisory information  and the SonicWall signatures to protect against these exploits 

CVE-2017-11882 | Microsoft Office EQNEDT32 Stack Buffer Overflow

This is a stack buffer overflow vulnerability in Microsoft Office. The vulnerability is due to incorrect handling of embedded Equation Editor OLE objects in Office documents. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted file. Successful exploitation could lead to arbitrary code execution under the context of the currently logged on user.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882

GAV: 21982  Malformed.doc.MP.10
GAV: 4094 JScript.Doc_229

CVE-2017-0147 | Microsoft Windows SMB Server SMBv1 CVE-2017-0147 Information Disclosure

This is an information disclosure vulnerability in the SMBv1 component of Microsoft Windows SMB server. The vulnerability is due to improper handling of SMBv1 requests. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted SMB messages to a target server. Successful exploitation could result in the disclosure of sensitive information from the target server

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147

GAV Cloud ID: 55251134 WannaCrypt

CVE-2010-2568 | Microsoft Windows LNK File Code Execution

This exists in Microsoft Windows that may allow execution of arbitrary code on the target machine. The vulnerability is due to a design weakness in Windows Shell which incorrectly parses shortcuts in such a way that malicious code may be executed when the crafted file is opened either manually or automatically with Windows Explorer. This can be most likely exploited through removable drives containing malicious LNK files, especially on systems that have AutoPlay enabled.

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046

IPS: 13508 LNK File HTTP Download 2

CVE-2017-8570 | Microsoft Office Remote Code Execution Vulnerability

This is a remote code execution vulnerability in Microsoft Office. The vulnerability is due to incorrect handling of embedded OLE objects in Office documents. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted file. Successful exploitation could lead to arbitrary code execution under the context of the currently logged on user. 

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8570

GAV: 32260 JScript.RTF_4

CVE-2013-3346 | Adobe Acrobat Reader ToolButton Use After Free

A use after free vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to an error in the handling of callback functions associated with ToolButton objects. A remote attacker can exploit this vulnerability by enticing the user to open a specially crafted file. Successful exploitation could result in arbitrary code execution in the context of the currently affected user.

http://www.adobe.com/support/security/bulletins/apsb13-15.html

IPS: 6207 HTTP Client Shellcode Exploit 42

CVE-2010-2883 | Adobe Acrobat and Reader CoolType.dll Stack Buffer Overflow

A code execution vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to a stack-based buffer overflow error within the CoolType.dll module when handling PDF files containing TTF fonts. Remote attackers could exploit this vulnerability by enticing target users to open a malicious PDF document. Successful exploitation would result in arbitrary code execution in the context of the logged on user.

http://www.adobe.com/support/security/advisories/apsa10-02.html

GAV– 43643 Malformed.pdf.MT.2

CVE-2015-1641| Microsoft Office Component CVE-2015-1641 Use After Free

This is a remote code execution vulnerability in Microsoft Office. The vulnerability is due to improper manipulation of objects in memory while parsing specially crafted Office files. A remote attacker can exploit this vulnerability by enticing a user open a maliciously crafted Office file. Successful exploitation could result in code execution in the context of the affected user.

https://technet.microsoft.com/en-us/library/security/ms15-033.aspx

GAV: 43643 Malformed.pdf.MT.2

CVE-2018-8174 | Microsoft Windows VBScript Engine CVE-2018-8174 Use After Free

A memory corruption vulnerability exists in the Microsoft Windows VBScript engine. The vulnerability is due to the way that the VBScript engine handles certain objects in memory.
A remote attacker can exploit this vulnerability by enticing a user to open a crafted web page using Internet Explorer or a crafted Microsoft Office document.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174

IPS: 4604 HTTP Client Shellcode Exploit 1

CVE-2018-8120 | Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. This affects Win32k, Windows, Windows Kernel, Windows Common Log File System Driver, DirectX Graphics Kernel & Windows Image. A local, authenticated attacker could exploit these vulnerabilities by running a maliciously crafted application on the target system. Successful exploitation allows the attacker elevate their privileges to an administrative level on the target.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120

GAV Cloud Id: 66194921 Btrojan Exploit

The risk posed by these vulnerabilities can be mitigated by upgrading to the latest non-vulnerable version