Tuesday, July 21, 2015

Microsoft Word Intruder RTF Sample Analysis

From my company's blog (Check Point Software Technologies):

Check Point researchers obtained a sample of a malicious Word document that was used in an attack attempt against one of our customers. The sample itself is a Rich Text Format (RTF) file with a .DOC extension. Recently, there has been a resurgence of the trend to use malicious macro code inside office documents. However, this wasn’t the case here.

We were dealing with a sample created by the MWI (Microsoft Word Intruder) Exploit Kit.
MWI is a builder of malicious DOC/RTF files and is accompanied by MWISTAT, a statistics panel which tracks the infections.

In this post I present a deep analysis of the sample, its structure, the different exploit used, mitigations bypass techniques and behaviour.

8 comments:

  1. Makes are actually slowly but surely dimension down his or her recovery on planning for any next big idea - in which in this case, could be small designer watches (reasonably talking in they will never ever possibly be tiny to not view sport activity running watches within 39mm). These kind of small watches really are a wonderful begin designed for model http://www.hotreplicaonline.com, as they quite simply could for sure reel in a completely new plate with prospective buyers who have been not able to accomplish the more expensive variants regarding wearability causes, although even returning full eliptical for the die-hard supporters in whose tastes can be maturing in the evening tremendous in addition to blingy and now have long been crying outside designed for an issue reduced and sustainably wearable.

    ReplyDelete
  2. Are you cerebration about affairs a replica of the Gucci handbag? If so, you are not alone. But in accident you charge to acquirement an 18-carat as against to some replica there are altered factors that it is best to louis vuitton replica consider. The actuality in the accomplish any aberration could possibly be the actuality that Gucci handbags are amidst the about absolute even although in the industry. in accident you charge to acquirement an 18-carat you are a lot of a lot of acceptable active so to the best replica watches cleft styling, elegance, and actually the quality. From again on, the accepting brainwash has about to arise to some complete stop. Today, the necessitie for 18-carat Gucci handbags is so ample that afraid purchasers are even accessible to access a knockoff just to access the Gucci name. Unfortunately, the breitling replica present industry is saturated with apery custom fabricated handbags, which admire to alike Gucci items. If analytic for 18-carat Gucci handbags for the up advancing purchase, there assuredly are a few account you may charge to consider. If you apperceive what blazon you wish you can acquisition it all online at prices as low as $75. Of course, the added big-ticket replicas will be added anxiously crafted. It will be done with accurate attention appropriate down to the stitching, the way the adumbration looks on the bags, the size, the colors of the accoutrements and more. These articles are all fabricated with consecutive numbers and acquiesce every woman to rolex replica accomplish her dream of getting a princess. With these louis vuitton replica accoutrements you get affluence items aggressive by the better names in appearance at prices that are affordable. Anniversary of these accoutrements is fabricated to actor the top superior that is Louis Vuitton after compromising on annihilation but the cost.When arcade for style, it's boxy to do so after elimination your wallet. Artist clothes may accomplish you angle out, but at what price? However, there's a simple band-aid to your wallet woes. Top off your apparel with accessories that attending just like those from your favorite, big-ticket brands but for smidgeon of the http://www.mmoser.co.uk cost; like these replicas of the coveted Louis Vuitton line. Fabricated from the accomplished superior materials, these replicas plan just as well, and attending just as good, as the ones fabricated from this acclaimed abundance - but you will not be lining their pockets. These copies go for alone a atom of the cost. It's a abundant accord no amount how you attending at it!

    ReplyDelete


  3. In order to catch the fashion and beauty, those people longing for genuine Replique Breitling Watches with limited budget go for its replicas instead.There are several websites affairs Fendi Handbags. However, it is not yet accepted whether Miu Miu Handbag are acknowledged or otherwise.





    These Replique Breitling Watches come with high quality, excellent functions and chic design.There are several websites affairs Miu Miu Handbag. However, it is not yet accepted whether Fendi Handbags are acknowledged or otherwise.

    ReplyDelete
  4. Very interesting blog, looking forward to more wonderful! Replica Michael Kors

    ReplyDelete
  5. I have reviewed a lot of blog posts about this issue. And your seemed very simple. But I think it is possible to learn something new. I've started to use the templates. And I found a site where you can find them very much. Here is a link http://www.word.poweredtemplate.com/word-templates/index.html.

    ReplyDelete

  6. Virus attacks occur in our time, more and more often. And that protect personal and corporate files, I recommend using data room due diligence

    ReplyDelete
  7. Gaps are a popular set up for many traders to initiate trades. They are also a great way to lose money. I explain some of the gap formations and profitable gaps to trade. GAP Analysis

    ReplyDelete
  8. All things considered, SysTechConnect is one of the rumored Online Microsoft Technical Support Provider that can address your everything issues. Regardless of where you will be, you can get moment determination by making them one telephone away.microsoft technical support toll free phone number

    ReplyDelete