An original, uninfected file has had dangerous macros added to it, Sophos has uncovered. The presentation is about the world ending, created by a preacher in the US who appears to have nothing to do with this booby-trapped version. His legitimate WordPress blog has been compromised and is now serving up search engine manipulation Viagra, questionable casinos, forex fraud and payday loans.
According to SophosLabs researcher Scott Sitar, the file contains a Visual Basic macro code that drops an executable file called VBA[X].exe, where [X] is a random capital letter. The sample requires the user to enable macros, “but didn't include the helpful tip on how to do it or really any good reason you might need a macro to learn about the End Times,” wrote Sophos blogger Chester Wisniewski.
Wisniewski said that the macros are designed to construct valid Windows Portable Executable files from arrays of single bytes – a move that, while not “particularly new,” is enough to obscure their true capabilities from the average user.
The executable file that is extracted is what researchers call a dropper. It extracts another Windows PE file that downloads a picture of an owl, then contacts a command and control server. Wisniewski said that this is designed to download another payload that it will rename as Wmupdate.exe, but during Sophos’ testing no instructions were sent from the command-and-control server to retrieve that payload.
The researchers said they suspect the malicious macros were being automatically generated and not necessarily handcrafted by their creators.
“While macro viruses certainly aren't a new phenomenon, they aren't something many people think about,” said Wisniewski. “Be careful with documents you acquire from random sources and never enable macros in documents you download or receive as email attachments.”
He added, “You never know what might be lurking in there, but I suspect it won't be the end of the world.”