Skip to content

MaldocTrace v0.5.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Nov 09:43
· 2 commits to main since this release
v0.5.1
540822f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Coverage fixes from 48 recent MalwareBazaar maldocs: Word altChunk imports and Equation Editor exploits behind randomized MTEF headers and mangled OLE streams.

Downloads

Platform Archive
Windows x64 / ARM64 maldocTrace_0.5.1_windows_amd64.zip, maldocTrace_0.5.1_windows_arm64.zip
Linux x64 / ARM64 maldocTrace_0.5.1_linux_amd64.tar.gz, maldocTrace_0.5.1_linux_arm64.tar.gz
macOS Intel / Apple Silicon maldocTrace_0.5.1_darwin_amd64.tar.gz, maldocTrace_0.5.1_darwin_arm64.tar.gz

You can verify downloads against checksums.txt (SHA-256). The binaries are static and have no dependencies. The macOS builds are not notarized, so remove the quarantine flag before running them: xattr -d com.apple.quarantine maldocTrace.

Added

  • altChunk imports: a .docx that imports a part through w:altChunk (relationship aFChunk; Word converts and merges RTF, HTML, MHT or another document on open) gets an altchunk finding and the imported part is analysed as an embedded file. Formbook and Remcos droppers hide RTF Equation Editor exploits this way inside an otherwise clean .docx.

Fixed

  • Equation Editor exploits with randomized MTEF headers: builders randomize the header (version byte included) and the first record, which EQNEDT32 does not check; a LINE record followed by an overflowing FONT (CVE-2017-11882 / CVE-2018-0802) or MATRIX (CVE-2018-0798) is now found without relying on the header, also when the MTEF data is wrapped in an OLE1 native stream (4-byte size).
  • OLE object streams are matched case-insensitively, as Office does: an Equation Editor object whose MTEF data sits in \x01olE10naTIVe (with no Equation Native stream) is analysed instead of being read as an OLE Package.
  • RTF objects: junk bytes before the OLE1 header are skipped, the exploit check now runs on the Equation Native / OLE1 native streams of the compound file an object holds, and an EQNOLEFILEHDR is looked for in the raw data when that compound file is malformed.
  • A compound file whose mini stream size overruns the file is read with the data its chain holds, instead of being rejected.

Measured on 48 recent MalwareBazaar maldocs (8 each of .doc, .docx, .xls, .xlsx, .rtf, .one): 35 to 44 detected as malicious; the remaining 4 carry no attack content (link spam, a plain document, binary data behind an empty RTF header, an external workbook link).

Assets 9
Loading