Input: Search Free Trial Get Demo A view from the exhibition floor three takeaways from Infosecurity Europe June 10, 2019 This years Infosecurity Europe again made me realise that I am privileged to work in such an exciting industry. As always, there was a lot of hype to cut through, but once you did, there were great insights to be found. Here are my top three takeaways from walking the floor. 1. Too few vendors were talking about email security The 2019 Verizon Data Beach Investigations Report recognises phishing as number one in a list of Top threat action varieties in breaches and email as the most common point of entry for malware. Why then, were so few companies talking about email security? Even those with market leading products and services seemed to be avoiding the subject. The migration to cloud email platforms is changing email security and I expect it will have a far higher profile next year. Watch out for an emerging category of service, Inbox Detection and Response IDR, that is going to change the way we protect users from phishing attacks. Only a few of the start-up vendors in this space were exhibiting this year, but expect to see more next year. 2. Its all about the user This segues nicely to my next takeaway  are we giving up on technology and placing too much emphasis on the user? Every information security professional understands the concept of technology, people and process controls, and a people-centric security strategy, but are we relying too heavily on users? One thing is for sure, there was no shortage of choice for those looking for companies to help train users in cyber security awareness and more specifically, phishing awareness. The problem is that while continuous training does help, there are numerous studies that suggest training does not move the needle sufficiently. A recent Osterman Research survey demonstrated this 93 of respondents provide users with phishing awareness training, yet 44 suffered a successful phishing attack. Clearly, we need a better mechanism to engage users at the point of risk, when they open an email. Again, there are emerging technologies that do this, providing users with the help they need and reinforcing the training they are given. Expect to see more vendors offering these services at next years event. 3. Vendors should be clearer about how they are solving a problem Walking the floor, far too often, I found myself standing and staring at a booth to try and understand what the exhibiting vendor was selling. Too many vendors were vague about the problem they are solving and even more so about how they do solve it. As an industry, we need to get better at articulating how we help and how we differentiate ourselves from others. As a marketer, I fully understand that I need to demonstrate the value my products and services bring, but I also need to explain in very clear terms how the technology actually does this. My number one action from Infosec is to review how we at Cyren tell our story. We like to educate and ran a number of presentations on our booth. If you missed them, I have condensed them to 5 minutes each and recorded them. You can access them by clicking the links below. Evasive malware insight into tactics  defences Evasive phishing insight into tactics Phishing kits democratizing evasive phishing Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Its Back! Facebook Cryptominer Worm Reemerges Attack Exploits Vulnerability in Half of Email MTAs Globally Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of Product Security Features**

1. **Key Security Features:**
   - **Email Security Focus:** The product emphasizes protection against phishing attacks, recognizing it as a major threat. This includes advanced detection mechanisms to identify phishing attempts in real-time.
   - **Inbox Detection and Response (IDR):** This emerging technology enables real-time detection and response at the inbox level, providing immediate protection against phishing emails.
   - **Evasive Malware and Phishing Tactics:** The product offers insights and defenses against sophisticated tactics used in evasive malware and phishing attacks.
   - **URL Filtering:** A feature like the Cyren URL Category Checker helps in assessing the safety of links, preventing access to malicious websites.

2. **User Benefits and Protection Measures:**
   - **Real-Time Engagement:** The product engages users at the point of risk, such as when opening an email or clicking a link, providing immediate warnings or advice.
   - **Augmented Security Awareness:** Complements traditional training with tools that offer real-time guidance, enhancing user ability to recognize threats.
   - **Comprehensive Protection:** Reduces the risk of successful phishing attacks by integrating real-time analysis and alerts.

3. **Integration with Existing Security Systems:**
   - **Cloud Email Platforms:** Likely integrates with platforms like Office 365 and Gmail via APIs or plugins, ensuring seamless protection across cloud-based email services.
   - **Security Infrastructure Compatibility:** Works with SIEM systems and other security tools to provide holistic threat intelligence and response.

4. **Compliance and Certification:**
   - The product is expected to comply with data protection regulations such as GDPR and CCPA. Certifications like ISO 27001 are anticipated, ensuring robust data handling practices.

5. **Security Best Practices for Users:**
   - **Education:** Encourages users to recognize phishing signs, verify email sources, and avoid suspicious links.
   - **Tool Utilization:** Promotes the use of provided tools like link scanners and warnings.
   - **Updates and Maintenance:** Advises regular software updates and patches to maintain security effectiveness.

6. **Technical Specifications and Requirements:**
   - **Compatibility:** Requires compatibility with cloud email platforms and specific browser versions.
   - **Client and Browser Support:** May include lightweight clients for desktops and support for mobile devices.
   - **Trial and Demo Options:** Offers free trials and demos, possibly including a sandbox environment for testing.

This structured approach provides a clear overview of the product's security features and benefits, ensuring users understand how they are protected and how the product fits into their existing security framework.


Input: Search Free Trial Get Demo A view from the exhibition floor three takeaways from Infosecurity Europe June 10, 2019 This years Infosecurity Europe again made me realise that I am privileged to work in such an exciting industry. As always, there was a lot of hype to cut through, but once you did, there were great insights to be found. Here are my top three takeaways from walking the floor. 1. Too few vendors were talking about email security The 2019 Verizon Data Beach Investigations Report recognises phishing as number one in a list of Top threat action varieties in breaches and email as the most common point of entry for malware. Why then, were so few companies talking about email security? Even those with market leading products and services seemed to be avoiding the subject. The migration to cloud email platforms is changing email security and I expect it will have a far higher profile next year. Watch out for an emerging category of service, Inbox Detection and Response IDR, that is going to change the way we protect users from phishing attacks. Only a few of the start-up vendors in this space were exhibiting this year, but expect to see more next year. 2. Its all about the user This segues nicely to my next takeaway  are we giving up on technology and placing too much emphasis on the user? Every information security professional understands the concept of technology, people and process controls, and a people-centric security strategy, but are we relying too heavily on users? One thing is for sure, there was no shortage of choice for those looking for companies to help train users in cyber security awareness and more specifically, phishing awareness. The problem is that while continuous training does help, there are numerous studies that suggest training does not move the needle sufficiently. A recent Osterman Research survey demonstrated this 93 of respondents provide users with phishing awareness training, yet 44 suffered a successful phishing attack. Clearly, we need a better mechanism to engage users at the point of risk, when they open an email. Again, there are emerging technologies that do this, providing users with the help they need and reinforcing the training they are given. Expect to see more vendors offering these services at next years event. 3. Vendors should be clearer about how they are solving a problem Walking the floor, far too often, I found myself standing and staring at a booth to try and understand what the exhibiting vendor was selling. Too many vendors were vague about the problem they are solving and even more so about how they do solve it. As an industry, we need to get better at articulating how we help and how we differentiate ourselves from others. As a marketer, I fully understand that I need to demonstrate the value my products and services bring, but I also need to explain in very clear terms how the technology actually does this. My number one action from Infosec is to review how we at Cyren tell our story. We like to educate and ran a number of presentations on our booth. If you missed them, I have condensed them to 5 minutes each and recorded them. You can access them by clicking the links below. Evasive malware insight into tactics  defences Evasive phishing insight into tactics Phishing kits democratizing evasive phishing Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Its Back! Facebook Cryptominer Worm Reemerges Attack Exploits Vulnerability in Half of Email MTAs Globally Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Security Advisory: Practical Guidance for Enhanced Protection**

**1. Security Best Practices**
- **Strengthen Email Security**: Implement multi-factor authentication (MFA) and email authentication protocols like SPF, DKIM, and DMARC. Consider emerging Inbox Detection and Response (IDR) tools to combat phishing.
- **Enhance User Education**: Use interactive training tools to simulate phishing attacks and provide real-time feedback to improve awareness.
- **Develop Incident Response Plans**: Ensure your team is prepared to respond swiftly and effectively in case of a security incident.

**2. Data Protection Recommendations**
- **Regular Backups**: Schedule frequent backups of critical data and test their integrity to ensure recoverability.
- **Encrypt Sensitive Information**: Use encryption for data both at rest and in transit.
- **Secure Backup Storage**: Protect backup data with strong access controls and store them separately from primary data.

**3. Safe Usage Guidelines**
- **Exercise Email Caution**: Verify sender addresses and avoid opening suspicious links or attachments.
- **Use Strong Passwords**: Employ password managers to generate and store complex passwords.
- **Regular Updates**: Keep software and systems updated to patch vulnerabilities.

**4. Common Security Risks and Prevention**
- **Phishing Attacks**: Utilize IDR tools and email filtering solutions to detect and block malicious emails. Conduct regular drills to test preparedness.
- **Ransomware**: Secure backups and implement network segmentation to limit attack spread. Use endpoint detection and response tools for early detection.

**5. Privacy Protection Measures**
- **Minimize Data Collection**: Only collect essential data and ensure compliance with regulations like GDPR.
- **Use Encrypted Tools**: Opt for encrypted communication platforms and services.
- **Anonymous Browsing**: Consider using tools like Tor or VPNs to protect online activity.

**6. When to Seek Additional Support**
- **Uncertainty in Security**: Consult experts if unsure about securing systems or data.
- **Post-Incident Response**: Engage professionals immediately after a breach for damage control.
- **Lack of Expertise**: Outsource security operations to specialists if internal expertise is lacking.

By following these guidelines, individuals and organizations can significantly enhance their security posture and protect against evolving threats.


Input: Search Free Trial Get Demo Exploiting CAPTCHA The Latest Evasive Phishing Tactic November 20, 2019 The Completely Automated Public Turing test to tell Computers and Humans Apart CAPTCHA has been used in commercial applications since the early 2000s. As its name suggests, it is a mechanism for ascertaining that a real human is performing an action at a web site. CAPTCHA is generated by distorting letters and numbers in such a way that a computer using OCR cannot resolve it. Typical applications were originally centered on authentication. For example, if you enter an incorrect password multiple times, you might be presented with a CAPTCHA to ensure that a bot is not attempting to brute force a login. Today there are other applications, such as preventing bots automatically posting good product reviews to falsify scores on review sites. Hiding phishing sites behind CAPTCHA Phishing evasion tactics have evolved over time, each a new attempt to thwart cyber security companies, who, in turn, evolved their detection techniques. The latest tactic Cyrens security analysts are seeing on the increase is extremely simple. If you dont want security companies automated crawlers, bots and user agents to be able to access your phishing page, simply control that access using a mechanism devised specifically to block computers  CAPTCHA. Like the use of block lists, if the phishing page cannot be reached, even the best detection engine cannot do its job. If it is so simple, one might ask why it has not been widely used. The answer is that for it to be successful, it has to be presented prior to the phishing page, and this is unusual. Most users expect a CAPTCHA to appear on the same page as the request for credentials, and this unusual behaviour might lead perceptive users to realize they are being phished. Phishers are using multiple CAPTCHAs CAPTCHA has evolved over the years, with projects dubbed reCAPTCHA created to improve security and reduce user friction. Techniques now include a simple checkbox, clicking images that include specific objects, and tracking human-like behaviors. The latter requires no human intervention at all, so is not an appropriate evasive phishing technique, but Cyrens security lab have seen all other variants. This makes life even more difficult for cyber security companies, who have to figure out how to defeat each of the tactics in use. Here are a few examples found recently by Cyrens security analysts. A simple CAPTCHA that controls access to a PayPal phishing site CAPTCHA controlling access to an Apple phishing site. Note the URL attempts to appear as a genuine apple.com site, but the actual domain is apps-personal.services. When a cyber security companys bots, crawlers or analysts come across phishing evasion techniques, their very existence raises suspicion. For example, if a security bot attempts to access a suspected phishing page and is blocked, because its IP addresses are included in the phishers block lists, that very behavior is noted as potentially suspicious. The next step in this situation might be to access the page from an IP address unknown to the phishers, and if a different response is received, suspicion is increased significantly. Before discovering this new CAPTCHA evasion tactic, reaching a CAPTCHA page was not deemed suspicious, but now detection has evolved to understand how this combines with other attributes of the attack, to ensure that users are protected. To read more about other evasive phishing tactics, such as block lists, mentioned in this post, see Evasive Phishing Driven by Phishing-as-a-Service. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Suspected BEC Campaign Targeting Banks Top 20 Brands Targeted for Yuletide Phishing Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of CAPTCHA Use in Phishing Evasion Tactics**

**1. Key Security Features and Benefits:**
- **CAPTCHA as a Phishing Tool:** Phishers use CAPTCHA to block security bots, making it harder for automated systems to detect phishing sites. However, this tactic can alert cautious users due to its unusual placement.
- **Cyren's Detection Capabilities:** The key benefit is the enhanced detection by companies like Cyren, which analyze such evasion tactics, improving overall security measures against phishing.

**2. Compliance Certifications:**
- **Regulatory Compliance:** While specific certifications aren't mentioned, companies employing such detection systems likely comply with regulations like GDPR and CCPA, which prioritize data protection.

**3. User-Focused Recommendations:**
- **Recognize Unusual CAPTCHA Use:** Users should be wary of CAPTCHAs appearing before login credential requests.
- **Verify URLs:** Check URLs for legitimacy, especially those that mimic known brands but have different domains.
- **Employ Security Tools:** Use anti-phishing tools and browser extensions that verify URLs anddetect suspicious activities.

**4. Technical Implementation Details:**
- **CAPTCHA Implementation by Phishers:** Phishers use CAPTCHA to block access to phishing sites, preventing automated detection systems from functioning effectively.
- **Advanced Detection Techniques:** Security companies analyze IP addresses, behavior patterns, and combine indicators to detect phishing, enhancing detection accuracy.

**5. Data Protection Measures:**
- **Automated Detection Systems:** Implement systems that analyze traffic and detect evasion tactics, preventing data breaches.
- **User Education:** Educate users to recognize phishing attempts, ensuring they understand the risks and consequences of data compromise.

**6. Best Practices:**
- **User Vigilance:** Encourage users to be cautious and report suspicious activities promptly.
- **Employ Security Tools:** Utilize two-factor authentication and browser security extensions to add layers of protection.
- **Educational Campaigns:** Conduct regular training to keep users informed about the latest phishing tactics and prevention strategies.

By systematically addressing each area, organizations and users can enhance their defenses against evolving phishing threats, ensuring a proactive approach to security.


Input: Search Free Trial Get Demo Exploiting CAPTCHA The Latest Evasive Phishing Tactic November 20, 2019 The Completely Automated Public Turing test to tell Computers and Humans Apart CAPTCHA has been used in commercial applications since the early 2000s. As its name suggests, it is a mechanism for ascertaining that a real human is performing an action at a web site. CAPTCHA is generated by distorting letters and numbers in such a way that a computer using OCR cannot resolve it. Typical applications were originally centered on authentication. For example, if you enter an incorrect password multiple times, you might be presented with a CAPTCHA to ensure that a bot is not attempting to brute force a login. Today there are other applications, such as preventing bots automatically posting good product reviews to falsify scores on review sites. Hiding phishing sites behind CAPTCHA Phishing evasion tactics have evolved over time, each a new attempt to thwart cyber security companies, who, in turn, evolved their detection techniques. The latest tactic Cyrens security analysts are seeing on the increase is extremely simple. If you dont want security companies automated crawlers, bots and user agents to be able to access your phishing page, simply control that access using a mechanism devised specifically to block computers  CAPTCHA. Like the use of block lists, if the phishing page cannot be reached, even the best detection engine cannot do its job. If it is so simple, one might ask why it has not been widely used. The answer is that for it to be successful, it has to be presented prior to the phishing page, and this is unusual. Most users expect a CAPTCHA to appear on the same page as the request for credentials, and this unusual behaviour might lead perceptive users to realize they are being phished. Phishers are using multiple CAPTCHAs CAPTCHA has evolved over the years, with projects dubbed reCAPTCHA created to improve security and reduce user friction. Techniques now include a simple checkbox, clicking images that include specific objects, and tracking human-like behaviors. The latter requires no human intervention at all, so is not an appropriate evasive phishing technique, but Cyrens security lab have seen all other variants. This makes life even more difficult for cyber security companies, who have to figure out how to defeat each of the tactics in use. Here are a few examples found recently by Cyrens security analysts. A simple CAPTCHA that controls access to a PayPal phishing site CAPTCHA controlling access to an Apple phishing site. Note the URL attempts to appear as a genuine apple.com site, but the actual domain is apps-personal.services. When a cyber security companys bots, crawlers or analysts come across phishing evasion techniques, their very existence raises suspicion. For example, if a security bot attempts to access a suspected phishing page and is blocked, because its IP addresses are included in the phishers block lists, that very behavior is noted as potentially suspicious. The next step in this situation might be to access the page from an IP address unknown to the phishers, and if a different response is received, suspicion is increased significantly. Before discovering this new CAPTCHA evasion tactic, reaching a CAPTCHA page was not deemed suspicious, but now detection has evolved to understand how this combines with other attributes of the attack, to ensure that users are protected. To read more about other evasive phishing tactics, such as block lists, mentioned in this post, see Evasive Phishing Driven by Phishing-as-a-Service. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Suspected BEC Campaign Targeting Banks Top 20 Brands Targeted for Yuletide Phishing Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**User Guidance on Data Security: Navigating the New CAPTCHA Phishing Tactic**

In response to the evolving phishing tactics using CAPTCHA, here is a structured guidance to enhance your data security:

### 1. **Spotting Unusual CAPTCHAs**
   - Be cautious if you encounter a CAPTCHA unexpectedly, especially before entering credentials. This could indicate a phishing attempt.
   - Check the URL: Ensure it matches the service you're using. Suspicious or mismatched URLs are red flags.

### 2. **Verifying Site Authenticity**
   - If prompted for sensitive information after solving a CAPTCHA, verify the site's authenticity by contacting the company through an official channel.
   - Avoid using provided links; instead, type the official URL or use a bookmark.

### 3. **Avoiding Information Disclosure**
   - Refrain from sharing sensitive information if requested after solving a CAPTCHA. Phishers may use this tactic to harvest your data.

### 4. **Keeping Software Updated**
   - Regularly update your browser and security software to benefit from the latest security patches that can detect and block evasive phishing tactics.

### 5. **Reporting Suspicious Activity**
   - Report phishing attempts to your email provider or the company being impersonated. This helps in taking down phishing sites and protecting others.

### 6. **Enabling Two-Factor Authentication (2FA)**
   - Activate 2FA wherever possible. This adds an extra security layer, making it harder for phishers to access your accounts even if your credentials are compromised.

### 7. **Monitoring for Suspicious Activity**
   - Regularly check your bank statements, email logs, and account activity for any unusual behavior. If you spot something, act promptly to secure your accounts.

### 8. **Seeking Help When Needed**
   - If you suspect you've entered information into a phishing site, contact your bank or IT support immediately. They can help mitigate potential damage.

### 9. **Protecting Privacy**
   - Be cautious about sharing personal information online. Use secure connections (HTTPS) and think twice before trusting sites that request unnecessary details.

### 10. **Trusting Your Instincts**
   - If a situation feels off, even without concrete evidence, err on the side of caution. Your intuition can be a powerful tool in preventing phishing attacks.

By following these guidelines, you enhance your security posture and reduce the risk of falling victim to phishing tactics. Stay vigilant and proactive in protecting your digital identity.


Input: Search Free Trial Get Demo Excel4 Macro Malware Delivers GoziUrsnif via a VelvetSweatshop Revival April 17, 2020 We have been seeing a surge in Excel malware using Excel4 Macros XLM in hidden worksheets. Recently , malicious actors started reviving an age-old technique to further hide the malicious XLM code by leveraging the VelvetSweatshop secret password in Excel workbooks. What is Macro Malware? Macro malware has been a popular choice for hackers since the 1990s and even in recent years the technique has continued to be a simple way of delivering malware to the unwary. Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. An Analysis of Excel4 Macro Malware The email attachments are encrypted Excel workbooks, which contain Excel4 XLM Formula macros found in hidden sheets. Many years ago, a default secret password used in Excel worksheets was exploited by malicious actors to deliver malware , and today this same secret password is being taken advantage of to thwart scan engines from easily detecting malicious Excel workbooks using Excel4 macros. This can be checked by using msoffcrypto-tool to see if an Office document is encrypted and try to decrypt using the default secret password VelvetSweatshop. Figure 1.0 Checking XLS sample with msoffcrypto-tool Opening the decrypted Excel workbook, you may be able to unhide the hidden worksheets by right-clicking on the sheet tab and selecting Unhide. You may opt to unhide all the hidden sheets by simply selecting the sheet name from the dialog box and clicking on OK. Figure 2.0 Unhiding hidden sheets in Excel Once you have unhidden the hidden sheets, click on the label drop-down to check for any presence of auto-executable Excel4 Macros. In this case, the Excel4 Macro automatically run when the workbook is opened by using the built-in name Auto_Open. Figure 3.0 Auto-executable cell Looking at the code in Excel is quite intimidating and following it manually will also be time consuming. So to quickly analyze the Excel4 macro code, we run our modified version of olevba to dump the Excel4 macro code to file and run our own XLM parser to see what the code does. Figure 4.0 Running modified olevba tool on sample Figure 4.1 Running xlm_parse on extracted XLM code from olevba With this we can now see that the code simply attempts to download a file from hxxpswww.remsoft.itconrolpack.php , save it to CProgramDatavKrJuyZ.exe and execute it via ShellExecute. Final Payload A Gozi Malware Variant The final payload is a variant of the Gozi malware family, which monitors network traffic and may attempt to steal login credentials from browsers or mail applications. This variant also makes use of WMI Query Language to gather data about the system it is running on, which is then added to the info it sends out to its server. Figure 5.0 Gozi WMI Query Figure 5.1 Collected system information Figure 5.2 Gozi ISFB RM3 Config Indicators of Compromise Email Subject  Important information about CoVid-19  1208302495  1208302495 Email SHA256  782FE75B25105E479F05A248BA03F6B2B7BCBE3EF42588B88FC7335FDE2AFA9A Attachment  dmitry.nosickow-1208302495-.xls Attachment SHA256  3a9bf49d9fd37eafc03241183b906b7c326e6bb996a747c788d2593f431a322b Attachment Detection  XLSEncBook.B.gen!Camelot Payload URL  hxxpsambrella.itlicenzabhostwindpackage.php Payload SHA256  1cffc61225af1735b653923723d82a40b68668450a7fbf843fcd9c057aca3aec Payload Executable Path  CProgramDatanCjBmqQ.exe Payload Detection  W32Agent.BRU.gen!Eldorado Email Subject statement  ! 655079-655079 Email SHA256 1edf92cca219c97029ae997f91ef8febdc2df807f887df68942af1517459429d Attachment mcerullo655079.xls Attachment SHA256  de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Attachment Detection XLSEncBook.A.gen!Camelot Attachment SHA256 de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Payload URL hxxpsistitutobpascalweb.itmynotescomrenoovohostinglilnuxadvanced.php Payload SHA256 df11bd82dc0f4b9f5b3e15ad6e1bc575db769066f7797eb7872859c9013a74db Payload Executable Path  CRPJbYuRpvrDGVqrCLGjyS.exe Payload Detection W32Agent.BRK.gen!Eldorado Email Subject  WARNING  MESSAGE ENCRYPTEDCo-Vid Important information- 462588175  462588175 Email SHA256  1AE77BED5F3E42A7C2E087A68C19EBBDCEB46339564B937F6E40AA9BF39E641D Attachment  keiran-462588175.xls Attachment Detection  XLSEncBook.B.gen!Camelot Attachment SHA256  e35f99ba6352f36294435ae2216de027ba83fbcd678d8c4d6fb17fff8ffd205d Payload URL  hxxpswww.remsoft.itconrolpack.php Payload SHA256  0f28ce7cab6badbfca27ce8907ef0c34b9d15a4e5c7034318097db815a534715 Payload Executable Path  CProgramDatavKrJuyZ.exe Payload Detection  W32Kryptik.ARD How to Protect Against Excel Malware There are a few different ways you can protect your business from Excel malware attacks Ensure macros are disabled within any Microsoft Office applications. Do not open any suspicious emails or attachments. Delete emails from unknown people or those that may contain suspicious Office 365 links or content. Spam or phishing emails are the usual way macro malware spreads. Run executable content by using ASR rules. Final Thoughts Ready to learn more about how you can protect your business from O365 Excel malware attacks? Request a demo with the Cyren team today. References        et_pb_textet_pb_columnet_pb_rowet_pb_row _builder_version3.25 background_sizeinitial background_positiontop_left background_repeatrepeat global_colors_infoet_pb_column type4_4 _builder_version3.25 custom_padding pac_dcm_carousel_specific_module_num0 global_colors_info custom_padding__hoveret_pb_text _builder_version3.27.4 background_sizeinitial background_positiontop_left background_repeatrepeat global_colors_info We have been seeing a surge in Excel malware using Excel4 Macros XLM in hidden worksheets. Recently , malicious actors started reviving an age-old technique to further hide the malicious XLM code by leveraging the VelvetSweatshop secret password in Excel workbooks. What is Macro Malware? Macro malware has been a popular choice for hackers since the 1990s and even in recent years the technique has continued to be a simple way of delivering malware to the unwary. Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. An Analysis of Excel4 Macro Malware The email attachments are encrypted Excel workbooks, which contain Excel4 XLM Formula macros found in hidden sheets. Many years ago, a default secret password used in Excel worksheets was exploited by malicious actors to deliver malware , and today this same secret password is being taken advantage of to thwart scan engines from easily detecting malicious Excel workbooks using Excel4 macros. This can be checked by using msoffcrypto-tool to see if an Office document is encrypted and try to decrypt using the default secret password VelvetSweatshop. Figure 1.0 Checking XLS sample with msoffcrypto-tool Opening the decrypted Excel workbook, you may be able to unhide the hidden worksheets by right-clicking on the sheet tab and selecting Unhide. You may opt to unhide all the hidden sheets by simply selecting the sheet name from the dialog box and clicking on OK. Figure 2.0 Unhiding hidden sheets in Excel Once you have unhidden the hidden sheets, click on the label drop-down to check for any presence of auto-executable Excel4 Macros. In this case, the Excel4 Macro automatically run when the workbook is opened by using the built-in name Auto_Open. Figure 3.0 Auto-executable cell Looking at the code in Excel is quite intimidating and following it manually will also be time consuming. So to quickly analyze the Excel4 macro code, we run our modified version of olevba to dump the Excel4 macro code to file and run our own XLM parser to see what the code does. Figure 4.0 Running modified olevba tool on sample Figure 4.1 Running xlm_parse on extracted XLM code from olevba With this we can now see that the code simply attempts to download a file from hxxpswww.remsoft.itconrolpack.php , save it to CProgramDatavKrJuyZ.exe and execute it via ShellExecute. Final Payload A Gozi Malware Variant The final payload is a variant of the Gozi malware family, which monitors network traffic and may attempt to steal login credentials from browsers or mail applications. This variant also makes use of WMI Query Language to gather data about the system it is running on, which is then added to the info it sends out to its server. Figure 5.0 Gozi WMI Query Figure 5.1 Collected system information Figure 5.2 Gozi ISFB RM3 Config Indicators of Compromise Email Subject  Important information about CoVid-19  1208302495  1208302495 Email SHA256  782FE75B25105E479F05A248BA03F6B2B7BCBE3EF42588B88FC7335FDE2AFA9A Attachment  dmitry.nosickow-1208302495-.xls Attachment SHA256  3a9bf49d9fd37eafc03241183b906b7c326e6bb996a747c788d2593f431a322b Attachment Detection  XLSEncBook.B.gen!Camelot Payload URL  hxxpsambrella.itlicenzabhostwindpackage.php Payload SHA256  1cffc61225af1735b653923723d82a40b68668450a7fbf843fcd9c057aca3aec Payload Executable Path  CProgramDatanCjBmqQ.exe Payload Detection  W32Agent.BRU.gen!Eldorado Email Subject statement  ! 655079-655079 Email SHA256 1edf92cca219c97029ae997f91ef8febdc2df807f887df68942af1517459429d Attachment mcerullo655079.xls Attachment SHA256  de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Attachment Detection XLSEncBook.A.gen!Camelot Attachment SHA256 de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Payload URL hxxpsistitutobpascalweb.itmynotescomrenoovohostinglilnuxadvanced.php Payload SHA256 df11bd82dc0f4b9f5b3e15ad6e1bc575db769066f7797eb7872859c9013a74db Payload Executable Path  CRPJbYuRpvrDGVqrCLGjyS.exe Payload Detection W32Agent.BRK.gen!Eldorado Email Subject  WARNING  MESSAGE ENCRYPTEDCo-Vid Important information- 462588175  462588175 Email SHA256  1AE77BED5F3E42A7C2E087A68C19EBBDCEB46339564B937F6E40AA9BF39E641D Attachment  keiran-462588175.xls Attachment Detection  XLSEncBook.B.gen!Camelot Attachment SHA256  e35f99ba6352f36294435ae2216de027ba83fbcd678d8c4d6fb17fff8ffd205d Payload URL  hxxpswww.remsoft.itconrolpack.php Payload SHA256  0f28ce7cab6badbfca27ce8907ef0c34b9d15a4e5c7034318097db815a534715 Payload Executable Path  CProgramDatavKrJuyZ.exe Payload Detection  W32Kryptik.ARD How to Protect Against Excel Malware There are a few different ways you can protect your business from Excel malware attacks Ensure macros are disabled within any Microsoft Office applications. Do not open any suspicious emails or attachments. Delete emails from unknown people or those that may contain suspicious Office 365 links or content. Spam or phishing emails are the usual way macro malware spreads. Run executable content by using ASR rules. Final Thoughts Ready to learn more about how you can protect your business from O365 Excel malware attacks? Request a demo with the Cyren team today. References        Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Schützen Sie sich mit tiefgehender E-Mail-Sicherheit Email Security Defense-in-Depth vor Evasive Phishing Covid AgentTesla Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Comprehensive Analysis of Excel Macro Malware Content

This analysis examines the provided content on Excel macro malware, focusing on key security features, compliance, user recommendations, technical details, data protection, and best practices. The goal is to provide a clear understanding of the threat and how to mitigate it.

#### 1. Key Security Features and Their Benefits

- **Advanced Security Tools**: Tools like msoffcrypto-tool, olevba, and xlm_parse are essential for identifying and decrypting malicious files. These tools help security professionals detect hidden macros and analyze their behavior.
- **Azure Security Rules (ASR)**: Implementing ASR rules in Microsoft Defender prevents malicious executables from running, adding a layer of defense against macro-based attacks.
- **Encryption and Password Protection**: While the VelvetSweatshop password is used maliciously, understanding encryption mechanisms is crucial for both protecting data and detecting threats.

#### 2. Compliance Certifications and Regulatory Adherence

While specific certifications like ISO 27001 or GDPR aren't mentioned, the techniques discussed align with broader compliance principles. For instance, using ASR rules supports compliance with standards requiring robust access controls and incident response plans.

#### 3. User-Focused Security Recommendations

- **Disable Macros**: Macros should remain disabled by default in Microsoft Office to prevent automatic malware execution.
- **Avoid Suspicious Emails**: Educate users to recognize phishing attempts and refrain from opening unexpected attachments.
- **删除可疑附件**: Regularly delete emails with suspicious links or content to reduce exposure.
- **使用 ASR Rules**: These rules block executable content, enhancing protection against macro-based attacks.

#### 4. Technical Security Implementation Details

- **Encryption with VelvetSweatshop Password**: Attackers use this password to encrypt malicious Excel files, evading detection.
- **Hidden Worksheets**: Malware hides in sheets that users can't see, requiring manual unhide actions.
- **Auto_Open Macro**: Automatically executes upon file opening, initiating the attack without user interaction.
- **Payload Delivery**: Downloads and executes Gozi malware, which steals credentials and gathers system info using WMI.

#### 5. Data Protection Measures

- **Credential Theft Prevention**: Protect login credentials by avoiding suspicious downloads and using robust antivirus.
- **Network Monitoring**: Monitor for unusual traffic to detect and block data exfiltration.
- **Endpoint Protection**: Use security software to detect and block malicious macros and payloads.

#### 6. Best Practices for End Users

- **定期更新和修补**: Ensure all software is updated to protect against vulnerabilities.
- **用户教育**: Train users on phishing identification and safe email practices.
- **备份数据**: Regular backups mitigate data loss from attacks.
- **启用安全设置**: Use security features like ASR and keep macros disabled.

### Conclusion

The analysis highlights the sophisticated nature of Excel macro malware and the importance of a multi-layered defense strategy. By understanding the threat and implementing the recommended measures, organizations can significantly reduce their vulnerability to such attacks.


Input: Search Free Trial Get Demo Excel4 Macro Malware Delivers GoziUrsnif via a VelvetSweatshop Revival April 17, 2020 We have been seeing a surge in Excel malware using Excel4 Macros XLM in hidden worksheets. Recently , malicious actors started reviving an age-old technique to further hide the malicious XLM code by leveraging the VelvetSweatshop secret password in Excel workbooks. What is Macro Malware? Macro malware has been a popular choice for hackers since the 1990s and even in recent years the technique has continued to be a simple way of delivering malware to the unwary. Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. An Analysis of Excel4 Macro Malware The email attachments are encrypted Excel workbooks, which contain Excel4 XLM Formula macros found in hidden sheets. Many years ago, a default secret password used in Excel worksheets was exploited by malicious actors to deliver malware , and today this same secret password is being taken advantage of to thwart scan engines from easily detecting malicious Excel workbooks using Excel4 macros. This can be checked by using msoffcrypto-tool to see if an Office document is encrypted and try to decrypt using the default secret password VelvetSweatshop. Figure 1.0 Checking XLS sample with msoffcrypto-tool Opening the decrypted Excel workbook, you may be able to unhide the hidden worksheets by right-clicking on the sheet tab and selecting Unhide. You may opt to unhide all the hidden sheets by simply selecting the sheet name from the dialog box and clicking on OK. Figure 2.0 Unhiding hidden sheets in Excel Once you have unhidden the hidden sheets, click on the label drop-down to check for any presence of auto-executable Excel4 Macros. In this case, the Excel4 Macro automatically run when the workbook is opened by using the built-in name Auto_Open. Figure 3.0 Auto-executable cell Looking at the code in Excel is quite intimidating and following it manually will also be time consuming. So to quickly analyze the Excel4 macro code, we run our modified version of olevba to dump the Excel4 macro code to file and run our own XLM parser to see what the code does. Figure 4.0 Running modified olevba tool on sample Figure 4.1 Running xlm_parse on extracted XLM code from olevba With this we can now see that the code simply attempts to download a file from hxxpswww.remsoft.itconrolpack.php , save it to CProgramDatavKrJuyZ.exe and execute it via ShellExecute. Final Payload A Gozi Malware Variant The final payload is a variant of the Gozi malware family, which monitors network traffic and may attempt to steal login credentials from browsers or mail applications. This variant also makes use of WMI Query Language to gather data about the system it is running on, which is then added to the info it sends out to its server. Figure 5.0 Gozi WMI Query Figure 5.1 Collected system information Figure 5.2 Gozi ISFB RM3 Config Indicators of Compromise Email Subject  Important information about CoVid-19  1208302495  1208302495 Email SHA256  782FE75B25105E479F05A248BA03F6B2B7BCBE3EF42588B88FC7335FDE2AFA9A Attachment  dmitry.nosickow-1208302495-.xls Attachment SHA256  3a9bf49d9fd37eafc03241183b906b7c326e6bb996a747c788d2593f431a322b Attachment Detection  XLSEncBook.B.gen!Camelot Payload URL  hxxpsambrella.itlicenzabhostwindpackage.php Payload SHA256  1cffc61225af1735b653923723d82a40b68668450a7fbf843fcd9c057aca3aec Payload Executable Path  CProgramDatanCjBmqQ.exe Payload Detection  W32Agent.BRU.gen!Eldorado Email Subject statement  ! 655079-655079 Email SHA256 1edf92cca219c97029ae997f91ef8febdc2df807f887df68942af1517459429d Attachment mcerullo655079.xls Attachment SHA256  de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Attachment Detection XLSEncBook.A.gen!Camelot Attachment SHA256 de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Payload URL hxxpsistitutobpascalweb.itmynotescomrenoovohostinglilnuxadvanced.php Payload SHA256 df11bd82dc0f4b9f5b3e15ad6e1bc575db769066f7797eb7872859c9013a74db Payload Executable Path  CRPJbYuRpvrDGVqrCLGjyS.exe Payload Detection W32Agent.BRK.gen!Eldorado Email Subject  WARNING  MESSAGE ENCRYPTEDCo-Vid Important information- 462588175  462588175 Email SHA256  1AE77BED5F3E42A7C2E087A68C19EBBDCEB46339564B937F6E40AA9BF39E641D Attachment  keiran-462588175.xls Attachment Detection  XLSEncBook.B.gen!Camelot Attachment SHA256  e35f99ba6352f36294435ae2216de027ba83fbcd678d8c4d6fb17fff8ffd205d Payload URL  hxxpswww.remsoft.itconrolpack.php Payload SHA256  0f28ce7cab6badbfca27ce8907ef0c34b9d15a4e5c7034318097db815a534715 Payload Executable Path  CProgramDatavKrJuyZ.exe Payload Detection  W32Kryptik.ARD How to Protect Against Excel Malware There are a few different ways you can protect your business from Excel malware attacks Ensure macros are disabled within any Microsoft Office applications. Do not open any suspicious emails or attachments. Delete emails from unknown people or those that may contain suspicious Office 365 links or content. Spam or phishing emails are the usual way macro malware spreads. Run executable content by using ASR rules. Final Thoughts Ready to learn more about how you can protect your business from O365 Excel malware attacks? Request a demo with the Cyren team today. References        et_pb_textet_pb_columnet_pb_rowet_pb_row _builder_version3.25 background_sizeinitial background_positiontop_left background_repeatrepeat global_colors_infoet_pb_column type4_4 _builder_version3.25 custom_padding pac_dcm_carousel_specific_module_num0 global_colors_info custom_padding__hoveret_pb_text _builder_version3.27.4 background_sizeinitial background_positiontop_left background_repeatrepeat global_colors_info We have been seeing a surge in Excel malware using Excel4 Macros XLM in hidden worksheets. Recently , malicious actors started reviving an age-old technique to further hide the malicious XLM code by leveraging the VelvetSweatshop secret password in Excel workbooks. What is Macro Malware? Macro malware has been a popular choice for hackers since the 1990s and even in recent years the technique has continued to be a simple way of delivering malware to the unwary. Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. An Analysis of Excel4 Macro Malware The email attachments are encrypted Excel workbooks, which contain Excel4 XLM Formula macros found in hidden sheets. Many years ago, a default secret password used in Excel worksheets was exploited by malicious actors to deliver malware , and today this same secret password is being taken advantage of to thwart scan engines from easily detecting malicious Excel workbooks using Excel4 macros. This can be checked by using msoffcrypto-tool to see if an Office document is encrypted and try to decrypt using the default secret password VelvetSweatshop. Figure 1.0 Checking XLS sample with msoffcrypto-tool Opening the decrypted Excel workbook, you may be able to unhide the hidden worksheets by right-clicking on the sheet tab and selecting Unhide. You may opt to unhide all the hidden sheets by simply selecting the sheet name from the dialog box and clicking on OK. Figure 2.0 Unhiding hidden sheets in Excel Once you have unhidden the hidden sheets, click on the label drop-down to check for any presence of auto-executable Excel4 Macros. In this case, the Excel4 Macro automatically run when the workbook is opened by using the built-in name Auto_Open. Figure 3.0 Auto-executable cell Looking at the code in Excel is quite intimidating and following it manually will also be time consuming. So to quickly analyze the Excel4 macro code, we run our modified version of olevba to dump the Excel4 macro code to file and run our own XLM parser to see what the code does. Figure 4.0 Running modified olevba tool on sample Figure 4.1 Running xlm_parse on extracted XLM code from olevba With this we can now see that the code simply attempts to download a file from hxxpswww.remsoft.itconrolpack.php , save it to CProgramDatavKrJuyZ.exe and execute it via ShellExecute. Final Payload A Gozi Malware Variant The final payload is a variant of the Gozi malware family, which monitors network traffic and may attempt to steal login credentials from browsers or mail applications. This variant also makes use of WMI Query Language to gather data about the system it is running on, which is then added to the info it sends out to its server. Figure 5.0 Gozi WMI Query Figure 5.1 Collected system information Figure 5.2 Gozi ISFB RM3 Config Indicators of Compromise Email Subject  Important information about CoVid-19  1208302495  1208302495 Email SHA256  782FE75B25105E479F05A248BA03F6B2B7BCBE3EF42588B88FC7335FDE2AFA9A Attachment  dmitry.nosickow-1208302495-.xls Attachment SHA256  3a9bf49d9fd37eafc03241183b906b7c326e6bb996a747c788d2593f431a322b Attachment Detection  XLSEncBook.B.gen!Camelot Payload URL  hxxpsambrella.itlicenzabhostwindpackage.php Payload SHA256  1cffc61225af1735b653923723d82a40b68668450a7fbf843fcd9c057aca3aec Payload Executable Path  CProgramDatanCjBmqQ.exe Payload Detection  W32Agent.BRU.gen!Eldorado Email Subject statement  ! 655079-655079 Email SHA256 1edf92cca219c97029ae997f91ef8febdc2df807f887df68942af1517459429d Attachment mcerullo655079.xls Attachment SHA256  de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Attachment Detection XLSEncBook.A.gen!Camelot Attachment SHA256 de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Payload URL hxxpsistitutobpascalweb.itmynotescomrenoovohostinglilnuxadvanced.php Payload SHA256 df11bd82dc0f4b9f5b3e15ad6e1bc575db769066f7797eb7872859c9013a74db Payload Executable Path  CRPJbYuRpvrDGVqrCLGjyS.exe Payload Detection W32Agent.BRK.gen!Eldorado Email Subject  WARNING  MESSAGE ENCRYPTEDCo-Vid Important information- 462588175  462588175 Email SHA256  1AE77BED5F3E42A7C2E087A68C19EBBDCEB46339564B937F6E40AA9BF39E641D Attachment  keiran-462588175.xls Attachment Detection  XLSEncBook.B.gen!Camelot Attachment SHA256  e35f99ba6352f36294435ae2216de027ba83fbcd678d8c4d6fb17fff8ffd205d Payload URL  hxxpswww.remsoft.itconrolpack.php Payload SHA256  0f28ce7cab6badbfca27ce8907ef0c34b9d15a4e5c7034318097db815a534715 Payload Executable Path  CProgramDatavKrJuyZ.exe Payload Detection  W32Kryptik.ARD How to Protect Against Excel Malware There are a few different ways you can protect your business from Excel malware attacks Ensure macros are disabled within any Microsoft Office applications. Do not open any suspicious emails or attachments. Delete emails from unknown people or those that may contain suspicious Office 365 links or content. Spam or phishing emails are the usual way macro malware spreads. Run executable content by using ASR rules. Final Thoughts Ready to learn more about how you can protect your business from O365 Excel malware attacks? Request a demo with the Cyren team today. References        Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Schützen Sie sich mit tiefgehender E-Mail-Sicherheit Email Security Defense-in-Depth vor Evasive Phishing Covid AgentTesla Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Understanding Excel4 Macro Malware and Protection Strategies**

**1. Key Security Features:**
   - **Encryption with VelvetSweatshop Password:** Malware uses an old secret password to encrypt Excel files, making detection harder.
   - **Hidden Sheets and Auto-Executable Macros:** Malicious code is concealed in hidden sheets, automatically executing upon opening.
   - **Tools for Analysis:** Utilizes tools like msoffcrypto-tool, olevba, and xlm_parse to decrypt and analyze malicious macros.
   - **Indicators of Compromise (IOCs):** Specific email subjects, file hashes, URLs, and executable paths help identify infections.

**2. User Benefits and Protection Measures:**
   - **Disable Macros:** Prevents automatic execution of malicious code.
   - **Avoid Suspicious Emails:** Be cautious with unexpected attachments, especially those named to entice or scare.
   - **Inspect Office Files:** Use specialized tools or services to check for hidden threats before opening.
   - **Enhanced Protection:** Utilize advanced threat protection services for deeper inspection of Office files.

**3. Integration with Existing Security Systems:**
   - **IOC Implementation:** Integrate identified IOCs into firewalls and antivirus software for real-time blocking.
   - **Advanced Threat Protection:** Use services that specialize in Office document analysis to complement existing security measures.
   - **Application Security Rules:** Implement ASR rules in Windows to block macro execution and executable content.

**4. Compliance and Certification:**
   - **Data Protection Standards:** Align with standards like GDPR or ISO 27001 to ensure robust data protection measures.
   - **Certified Solutions:** Ensure email security solutions meet relevant certifications for compliance and effectiveness.

**5. Security Best Practices:**
   - **User Education:** Train users to recognize and avoid suspicious emails, and understand the risks of macros.
   - **Regular Updates:** Keep software updated to guard against known vulnerabilities.
   - **Administrative Measures:** Monitor Office file behavior and use Endpoint Detection and Response (EDR) solutions.
   - **Email Filtering:** Enhance email security with advanced filtering and sandboxing.

**6. Technical Specifications:**
   - **Analysis Tools:** Use msoffcrypto-tool, olevba, and xlm_parse for decrypting and analyzing malicious macros.
   - **Compatibility:** Ensure tools are compatible with Excel versions and can handle decryption and parsing effectively.

By understanding and implementing these strategies, users can enhance their defenses against Excel4 Macro Malware, ensuring a proactive approach to security.


Input: Search Free Trial Get Demo Excel4 Macro Malware Delivers GoziUrsnif via a VelvetSweatshop Revival April 17, 2020 We have been seeing a surge in Excel malware using Excel4 Macros XLM in hidden worksheets. Recently , malicious actors started reviving an age-old technique to further hide the malicious XLM code by leveraging the VelvetSweatshop secret password in Excel workbooks. What is Macro Malware? Macro malware has been a popular choice for hackers since the 1990s and even in recent years the technique has continued to be a simple way of delivering malware to the unwary. Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. An Analysis of Excel4 Macro Malware The email attachments are encrypted Excel workbooks, which contain Excel4 XLM Formula macros found in hidden sheets. Many years ago, a default secret password used in Excel worksheets was exploited by malicious actors to deliver malware , and today this same secret password is being taken advantage of to thwart scan engines from easily detecting malicious Excel workbooks using Excel4 macros. This can be checked by using msoffcrypto-tool to see if an Office document is encrypted and try to decrypt using the default secret password VelvetSweatshop. Figure 1.0 Checking XLS sample with msoffcrypto-tool Opening the decrypted Excel workbook, you may be able to unhide the hidden worksheets by right-clicking on the sheet tab and selecting Unhide. You may opt to unhide all the hidden sheets by simply selecting the sheet name from the dialog box and clicking on OK. Figure 2.0 Unhiding hidden sheets in Excel Once you have unhidden the hidden sheets, click on the label drop-down to check for any presence of auto-executable Excel4 Macros. In this case, the Excel4 Macro automatically run when the workbook is opened by using the built-in name Auto_Open. Figure 3.0 Auto-executable cell Looking at the code in Excel is quite intimidating and following it manually will also be time consuming. So to quickly analyze the Excel4 macro code, we run our modified version of olevba to dump the Excel4 macro code to file and run our own XLM parser to see what the code does. Figure 4.0 Running modified olevba tool on sample Figure 4.1 Running xlm_parse on extracted XLM code from olevba With this we can now see that the code simply attempts to download a file from hxxpswww.remsoft.itconrolpack.php , save it to CProgramDatavKrJuyZ.exe and execute it via ShellExecute. Final Payload A Gozi Malware Variant The final payload is a variant of the Gozi malware family, which monitors network traffic and may attempt to steal login credentials from browsers or mail applications. This variant also makes use of WMI Query Language to gather data about the system it is running on, which is then added to the info it sends out to its server. Figure 5.0 Gozi WMI Query Figure 5.1 Collected system information Figure 5.2 Gozi ISFB RM3 Config Indicators of Compromise Email Subject  Important information about CoVid-19  1208302495  1208302495 Email SHA256  782FE75B25105E479F05A248BA03F6B2B7BCBE3EF42588B88FC7335FDE2AFA9A Attachment  dmitry.nosickow-1208302495-.xls Attachment SHA256  3a9bf49d9fd37eafc03241183b906b7c326e6bb996a747c788d2593f431a322b Attachment Detection  XLSEncBook.B.gen!Camelot Payload URL  hxxpsambrella.itlicenzabhostwindpackage.php Payload SHA256  1cffc61225af1735b653923723d82a40b68668450a7fbf843fcd9c057aca3aec Payload Executable Path  CProgramDatanCjBmqQ.exe Payload Detection  W32Agent.BRU.gen!Eldorado Email Subject statement  ! 655079-655079 Email SHA256 1edf92cca219c97029ae997f91ef8febdc2df807f887df68942af1517459429d Attachment mcerullo655079.xls Attachment SHA256  de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Attachment Detection XLSEncBook.A.gen!Camelot Attachment SHA256 de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Payload URL hxxpsistitutobpascalweb.itmynotescomrenoovohostinglilnuxadvanced.php Payload SHA256 df11bd82dc0f4b9f5b3e15ad6e1bc575db769066f7797eb7872859c9013a74db Payload Executable Path  CRPJbYuRpvrDGVqrCLGjyS.exe Payload Detection W32Agent.BRK.gen!Eldorado Email Subject  WARNING  MESSAGE ENCRYPTEDCo-Vid Important information- 462588175  462588175 Email SHA256  1AE77BED5F3E42A7C2E087A68C19EBBDCEB46339564B937F6E40AA9BF39E641D Attachment  keiran-462588175.xls Attachment Detection  XLSEncBook.B.gen!Camelot Attachment SHA256  e35f99ba6352f36294435ae2216de027ba83fbcd678d8c4d6fb17fff8ffd205d Payload URL  hxxpswww.remsoft.itconrolpack.php Payload SHA256  0f28ce7cab6badbfca27ce8907ef0c34b9d15a4e5c7034318097db815a534715 Payload Executable Path  CProgramDatavKrJuyZ.exe Payload Detection  W32Kryptik.ARD How to Protect Against Excel Malware There are a few different ways you can protect your business from Excel malware attacks Ensure macros are disabled within any Microsoft Office applications. Do not open any suspicious emails or attachments. Delete emails from unknown people or those that may contain suspicious Office 365 links or content. Spam or phishing emails are the usual way macro malware spreads. Run executable content by using ASR rules. Final Thoughts Ready to learn more about how you can protect your business from O365 Excel malware attacks? Request a demo with the Cyren team today. References        et_pb_textet_pb_columnet_pb_rowet_pb_row _builder_version3.25 background_sizeinitial background_positiontop_left background_repeatrepeat global_colors_infoet_pb_column type4_4 _builder_version3.25 custom_padding pac_dcm_carousel_specific_module_num0 global_colors_info custom_padding__hoveret_pb_text _builder_version3.27.4 background_sizeinitial background_positiontop_left background_repeatrepeat global_colors_info We have been seeing a surge in Excel malware using Excel4 Macros XLM in hidden worksheets. Recently , malicious actors started reviving an age-old technique to further hide the malicious XLM code by leveraging the VelvetSweatshop secret password in Excel workbooks. What is Macro Malware? Macro malware has been a popular choice for hackers since the 1990s and even in recent years the technique has continued to be a simple way of delivering malware to the unwary. Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. An Analysis of Excel4 Macro Malware The email attachments are encrypted Excel workbooks, which contain Excel4 XLM Formula macros found in hidden sheets. Many years ago, a default secret password used in Excel worksheets was exploited by malicious actors to deliver malware , and today this same secret password is being taken advantage of to thwart scan engines from easily detecting malicious Excel workbooks using Excel4 macros. This can be checked by using msoffcrypto-tool to see if an Office document is encrypted and try to decrypt using the default secret password VelvetSweatshop. Figure 1.0 Checking XLS sample with msoffcrypto-tool Opening the decrypted Excel workbook, you may be able to unhide the hidden worksheets by right-clicking on the sheet tab and selecting Unhide. You may opt to unhide all the hidden sheets by simply selecting the sheet name from the dialog box and clicking on OK. Figure 2.0 Unhiding hidden sheets in Excel Once you have unhidden the hidden sheets, click on the label drop-down to check for any presence of auto-executable Excel4 Macros. In this case, the Excel4 Macro automatically run when the workbook is opened by using the built-in name Auto_Open. Figure 3.0 Auto-executable cell Looking at the code in Excel is quite intimidating and following it manually will also be time consuming. So to quickly analyze the Excel4 macro code, we run our modified version of olevba to dump the Excel4 macro code to file and run our own XLM parser to see what the code does. Figure 4.0 Running modified olevba tool on sample Figure 4.1 Running xlm_parse on extracted XLM code from olevba With this we can now see that the code simply attempts to download a file from hxxpswww.remsoft.itconrolpack.php , save it to CProgramDatavKrJuyZ.exe and execute it via ShellExecute. Final Payload A Gozi Malware Variant The final payload is a variant of the Gozi malware family, which monitors network traffic and may attempt to steal login credentials from browsers or mail applications. This variant also makes use of WMI Query Language to gather data about the system it is running on, which is then added to the info it sends out to its server. Figure 5.0 Gozi WMI Query Figure 5.1 Collected system information Figure 5.2 Gozi ISFB RM3 Config Indicators of Compromise Email Subject  Important information about CoVid-19  1208302495  1208302495 Email SHA256  782FE75B25105E479F05A248BA03F6B2B7BCBE3EF42588B88FC7335FDE2AFA9A Attachment  dmitry.nosickow-1208302495-.xls Attachment SHA256  3a9bf49d9fd37eafc03241183b906b7c326e6bb996a747c788d2593f431a322b Attachment Detection  XLSEncBook.B.gen!Camelot Payload URL  hxxpsambrella.itlicenzabhostwindpackage.php Payload SHA256  1cffc61225af1735b653923723d82a40b68668450a7fbf843fcd9c057aca3aec Payload Executable Path  CProgramDatanCjBmqQ.exe Payload Detection  W32Agent.BRU.gen!Eldorado Email Subject statement  ! 655079-655079 Email SHA256 1edf92cca219c97029ae997f91ef8febdc2df807f887df68942af1517459429d Attachment mcerullo655079.xls Attachment SHA256  de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Attachment Detection XLSEncBook.A.gen!Camelot Attachment SHA256 de568458357e128c3fc523781cd417d505a9b2c9df82604d91eea4f623750cea Payload URL hxxpsistitutobpascalweb.itmynotescomrenoovohostinglilnuxadvanced.php Payload SHA256 df11bd82dc0f4b9f5b3e15ad6e1bc575db769066f7797eb7872859c9013a74db Payload Executable Path  CRPJbYuRpvrDGVqrCLGjyS.exe Payload Detection W32Agent.BRK.gen!Eldorado Email Subject  WARNING  MESSAGE ENCRYPTEDCo-Vid Important information- 462588175  462588175 Email SHA256  1AE77BED5F3E42A7C2E087A68C19EBBDCEB46339564B937F6E40AA9BF39E641D Attachment  keiran-462588175.xls Attachment Detection  XLSEncBook.B.gen!Camelot Attachment SHA256  e35f99ba6352f36294435ae2216de027ba83fbcd678d8c4d6fb17fff8ffd205d Payload URL  hxxpswww.remsoft.itconrolpack.php Payload SHA256  0f28ce7cab6badbfca27ce8907ef0c34b9d15a4e5c7034318097db815a534715 Payload Executable Path  CProgramDatavKrJuyZ.exe Payload Detection  W32Kryptik.ARD How to Protect Against Excel Malware There are a few different ways you can protect your business from Excel malware attacks Ensure macros are disabled within any Microsoft Office applications. Do not open any suspicious emails or attachments. Delete emails from unknown people or those that may contain suspicious Office 365 links or content. Spam or phishing emails are the usual way macro malware spreads. Run executable content by using ASR rules. Final Thoughts Ready to learn more about how you can protect your business from O365 Excel malware attacks? Request a demo with the Cyren team today. References        Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Schützen Sie sich mit tiefgehender E-Mail-Sicherheit Email Security Defense-in-Depth vor Evasive Phishing Covid AgentTesla Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Security Guidance: Protecting Against Excel4 Macro Malware

#### 1. Security Best Practices
- **Disable Macros**: Turn off macros in Microsoft Office applications unless absolutely necessary. Only enable them for trusted sources.
- **Software Updates**: Regularly update software, especially Microsoft Office, to patch vulnerabilities.
- **Email Security**: Use email security solutions to scan attachments and links for threats.
- **Antivirus**: Install and update antivirus software to detect and block malicious files.
- **Backups**: Schedule regular backups of important data to an external drive or cloud storage.

#### 2. Data Protection Recommendations
- **Data Encryption**: Encrypt sensitive data both at rest and in transit.
- **Regular Backups**: Ensure backups are secure and tested for integrity.
- **Access Controls**: Limit access to sensitive data to authorized personnel only.

#### 3. Safe Usage Guidelines
- **Email Caution**: Avoid opening suspicious emails or attachments from unknown sources. Hover over links to check their true destination.
- **AvoidUnsafeDownloads**: Do not download files from untrusted websites or sources.
- **Strong Passwords**: Use complex passwords and consider a password manager for security.

#### 4. Common Security Risks and Prevention
- **Phishing Risks**: Phishing emails may appear legitimate but often contain malicious attachments. Train users to identify red flags such as urgent requests or spelling errors.
- **Prevention Measures**: Implement email filters, conduct phishing simulations, and monitor for suspicious activity.
- **Weak Passwords**: Educate users on the dangers of weak passwords and enforce password policies.

#### 5. Privacy Protection Measures
- **Anonymization Tools**: Use tools to mask data when sharing publicly.
- **Minimize Data Sharing**: Only share necessary information and avoid oversharing online.
- **Secure Communication**: Use encrypted channels for sensitive communications.

#### 6. When to Seek Additional Support
- **Signs of Compromise**: If suspicious activity is detected, such as unexpected downloads or network behavior, contact IT support immediately.
- **Complex Threats**: For advanced threats like Gozi malware, engage cybersecurity experts.
- **Incident Response**: Have a plan for security incidents, including containment and post-incident analysis.

By following these guidelines, users can significantly reduce the risk of falling victim to Excel4 macro malware and protect their data effectively.


Input: Search Free Trial Get Demo Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open the document properly. Or at least thats what the bad guys would like email or AV scanners to think. Figure 1 Looking at the e-mail, which is couched as a very generic price quote request, the sender did not provide any password for the attachment, so what gives? Figure 2 Sounds like something weve already seen a few years back, six years to be exact. Do you remember VelvetSweatshop and the infamous CVE-2012-0158 exploit which took advantage of the Microsoft Excel default password hidden feature to evade detection? Well, this malware campaign will surely bring you back to those old days. First lets try to open the document to see if Microsoft Office will be able to load it properly. Figure 3 Figure 4 And sure thing, Microsoft Office Excel was able to open the document with no problems at alland no request to enter a password. So lets take a look at whats happening in the background. Exploits Office Vulnerability CVE-2017-11882 The first thing youll notice is the presence of EQNEDT32.EXE being loaded by svchost.exe. This behavior indicates a possible exploitation of CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability. Figure 5 Digging a little deeper, we debugged the exploit shellcode to see what this document really does in the background. Sure enough, this sample does indeed exploit CVE-2017-11882 and attempts to download and execute an executable payload supposedly saved as PUBLICvbc.exe in the affected computers system, as shown in the screenshots below. Figure 6 Figure 7 VelvetSweatshop Default Password Ploy Still Being Used We also decrypted the email attachment and confirmed that this document is taking advantage of the old Microsoft Office hidden feature that uses a default password to load encrypted documents, as shown in the lines of code in the screenshot below. Figure 8 Unfortunately, the download link from this exploit sample was inaccessible as of this writing, so we are not able to provide an analysis of its payload. Indicators of Compromise and Cyren Detection SHA256 Object Type Remarks Cyren Detection 04ee59add6c2df247f97a17eab8594a2a28b7e17e7ce3e9cc5c334ae0ac265de EML Subject Prices required  CVE1711882 fe5568568d4930866d29699b46e11711c462bfcefd05589e98c6b5250da074ff EML Subject Prices required  CVE1711882 73675e415abe136fa06070d5781d5d0d84c415111b0c65d43910e44146124642 XLS Password-protected VelvetSweatsho CVE1711882  URL Saved to PUBLICvbc.exe Payload Inaccessible as of this writing Prevention and Mitigation We remind readers that Microsoft issued a patch for the CVE-2017-11882 exploit in 2017. Outdated software, operating systems, browsers, and plugins are major vectors for malware infections. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Police Phishing Attack Targets Bank Credentials Fileless Malware Already Targeting Holiday Suppliers Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Comprehensive Analysis of Security Content**

1. **Key Security Features and Their Benefits to Users:**
   - **Default Password Feature:** The Excel file uses a hidden default password, which, while intended to facilitate ease of use, poses a security risk by allowing unauthorized access. This highlights the importance of user awareness in recognizing such manipulations.
   - **Microsoft Patches:** Microsoft's issuance of patches for vulnerabilities like CVE-2017-11882 is a crucial feature that addresses security loopholes, ensuring a safer environment for users.

2. **Compliance Certifications and Regulatory Adherence:**
   - **Vulnerability Management:** Compliance with standards often requires regular software updates. The patch for CVE-2017-11882 aligns with such regulatory requirements, emphasizing the importance of timely updates for security.

3. **User-Focused Security Recommendations:**
   - **Caution with Emails:** Users should be vigilant with unsolicited emails, especially those with attachments, and avoid interacting with them without verification.
   - **Software Updates:** Keeping software updated is essential to protect against known vulnerabilities.

4. **Technical Security Implementation Details:**
   - **Vulnerability Exploitation:** The exploit uses CVE-2017-11882, targeting Microsoft Office's memory corruption. Awareness of such vectors aids in understanding attack mechanisms.
   - **Process and Network Monitoring:** Monitoring processes like EQNEDT32.EXE and network activities for suspicious URLs can help detect and prevent attacks.

5. **Data Protection Measures:**
   - **Encryption and Backups:** While not explicitly mentioned, protecting data through encryption and regular backups is implied to safeguard against potential data loss from malware.

6. **Best Practices for End Users:**
   - **Email Hygiene:** Users should avoid opening suspicious attachments and report such emails.
   - **Regular Updates:** Ensuring all software is updated is crucial to prevent exploitation of known vulnerabilities.

This analysis underscores the importance of a multi-faceted approach to security, combining technical measures with user education to mitigate risks effectively.


Input: Search Free Trial Get Demo Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open the document properly. Or at least thats what the bad guys would like email or AV scanners to think. Figure 1 Looking at the e-mail, which is couched as a very generic price quote request, the sender did not provide any password for the attachment, so what gives? Figure 2 Sounds like something weve already seen a few years back, six years to be exact. Do you remember VelvetSweatshop and the infamous CVE-2012-0158 exploit which took advantage of the Microsoft Excel default password hidden feature to evade detection? Well, this malware campaign will surely bring you back to those old days. First lets try to open the document to see if Microsoft Office will be able to load it properly. Figure 3 Figure 4 And sure thing, Microsoft Office Excel was able to open the document with no problems at alland no request to enter a password. So lets take a look at whats happening in the background. Exploits Office Vulnerability CVE-2017-11882 The first thing youll notice is the presence of EQNEDT32.EXE being loaded by svchost.exe. This behavior indicates a possible exploitation of CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability. Figure 5 Digging a little deeper, we debugged the exploit shellcode to see what this document really does in the background. Sure enough, this sample does indeed exploit CVE-2017-11882 and attempts to download and execute an executable payload supposedly saved as PUBLICvbc.exe in the affected computers system, as shown in the screenshots below. Figure 6 Figure 7 VelvetSweatshop Default Password Ploy Still Being Used We also decrypted the email attachment and confirmed that this document is taking advantage of the old Microsoft Office hidden feature that uses a default password to load encrypted documents, as shown in the lines of code in the screenshot below. Figure 8 Unfortunately, the download link from this exploit sample was inaccessible as of this writing, so we are not able to provide an analysis of its payload. Indicators of Compromise and Cyren Detection SHA256 Object Type Remarks Cyren Detection 04ee59add6c2df247f97a17eab8594a2a28b7e17e7ce3e9cc5c334ae0ac265de EML Subject Prices required  CVE1711882 fe5568568d4930866d29699b46e11711c462bfcefd05589e98c6b5250da074ff EML Subject Prices required  CVE1711882 73675e415abe136fa06070d5781d5d0d84c415111b0c65d43910e44146124642 XLS Password-protected VelvetSweatsho CVE1711882  URL Saved to PUBLICvbc.exe Payload Inaccessible as of this writing Prevention and Mitigation We remind readers that Microsoft issued a patch for the CVE-2017-11882 exploit in 2017. Outdated software, operating systems, browsers, and plugins are major vectors for malware infections. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Police Phishing Attack Targets Bank Credentials Fileless Malware Already Targeting Holiday Suppliers Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Security Analysis and Features Based on the Content

**1. Key Security Features and Capabilities:**

- **Password Evasion Technique:** The document uses a hidden default password feature in Microsoft Office, allowing it to appear protected while opening without a password, bypassing traditional security checks.
- **Exploitation of CVE-2017-11882:** This vulnerability in Microsoft Office is exploited to execute arbitrary code, potentially downloading and running malicious payloads.
- **Suspicious Process Behavior:** The loading of EQNEDT32.EXE by svchost.exe indicates malicious activity, suggesting exploit behavior.
- **Indicators of Compromise (IoCs):** Specific SHA256 hashes and filenames (e.g., PUBLICvbc.exe) help identify and block malicious files and URLs.

**2. User Benefits and Protection Measures:**

- **Detection of Known Vulnerabilities:** Identifies and blocks exploits targeting CVE-2017-11882, preventing malicious code execution.
- **Email Filtering:** Detects and blocks malicious emails with suspicious attachments, reducing infection risk.
- **Behavioral Analysis:** Monitors for suspicious processes and quirks, enhancing detection of unknown threats.
- **Sandboxing:** Analyzes documents in a controlled environment to detect hidden threats without risking the main system.

**3. Integration with Existing Security Systems:**

- **SIEM and IDS/IPS Integration:** IoCs can be fed into these systems to enhance threat detection and response.
- **Firewall and Proxy Integration:** Blocks known malicious URLs and files, preventing payload download.
- **EDR and Antivirus:** Enhances detection with known IoCs and behavioral analysis, improving real-time threat response.

**4. Compliance and Certification Details:**

- **Patching Compliance:** Ensures compliance with security best practices by applying patches for known vulnerabilities, critical for regulatory standards like GDPR and HIPAA.
- **Data Protection Regulations:** Mitigates risks of data breaches, aligning with regulations requiring robust security measures.

**5. Security Best Practices for Users:**

- **Regular Updates:** Keep software updated to patch vulnerabilities like CVE-2017-11882.
- **Caution with Emails:** Avoid opening suspicious attachments or clicking links from unknown senders.
- **Monitoring:** Use endpoint protection to monitor for suspicious activity and maintain antivirus updates.
- **Backup:** Regularly back up critical data to mitigate ransomware risks.

**6. Technical Specifications and Requirements:**

- **Software Updates:** Microsoft Office must be updated beyond the patch for CVE-2017-11882.
- **Antivirus Capabilities:** Requires solutions that detect known and unknown threats, analyze behavior, and integrate with security systems.
- **System Hardening:** Restrict execution of unnecessary processes like EQNEDT32.EXE from svchost.exe.
- **Network Monitoring:** Monitor traffic for hidden command-and-control activities, especially from Office documents.

### Conclusion

The content highlights the importance of multi-layered security, including regular updates, email caution, and robust monitoring. By understanding and implementing these features and practices, users can enhance their security posture against such threats.


Input: Search Free Trial Get Demo Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open the document properly. Or at least thats what the bad guys would like email or AV scanners to think. Figure 1 Looking at the e-mail, which is couched as a very generic price quote request, the sender did not provide any password for the attachment, so what gives? Figure 2 Sounds like something weve already seen a few years back, six years to be exact. Do you remember VelvetSweatshop and the infamous CVE-2012-0158 exploit which took advantage of the Microsoft Excel default password hidden feature to evade detection? Well, this malware campaign will surely bring you back to those old days. First lets try to open the document to see if Microsoft Office will be able to load it properly. Figure 3 Figure 4 And sure thing, Microsoft Office Excel was able to open the document with no problems at alland no request to enter a password. So lets take a look at whats happening in the background. Exploits Office Vulnerability CVE-2017-11882 The first thing youll notice is the presence of EQNEDT32.EXE being loaded by svchost.exe. This behavior indicates a possible exploitation of CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability. Figure 5 Digging a little deeper, we debugged the exploit shellcode to see what this document really does in the background. Sure enough, this sample does indeed exploit CVE-2017-11882 and attempts to download and execute an executable payload supposedly saved as PUBLICvbc.exe in the affected computers system, as shown in the screenshots below. Figure 6 Figure 7 VelvetSweatshop Default Password Ploy Still Being Used We also decrypted the email attachment and confirmed that this document is taking advantage of the old Microsoft Office hidden feature that uses a default password to load encrypted documents, as shown in the lines of code in the screenshot below. Figure 8 Unfortunately, the download link from this exploit sample was inaccessible as of this writing, so we are not able to provide an analysis of its payload. Indicators of Compromise and Cyren Detection SHA256 Object Type Remarks Cyren Detection 04ee59add6c2df247f97a17eab8594a2a28b7e17e7ce3e9cc5c334ae0ac265de EML Subject Prices required  CVE1711882 fe5568568d4930866d29699b46e11711c462bfcefd05589e98c6b5250da074ff EML Subject Prices required  CVE1711882 73675e415abe136fa06070d5781d5d0d84c415111b0c65d43910e44146124642 XLS Password-protected VelvetSweatsho CVE1711882  URL Saved to PUBLICvbc.exe Payload Inaccessible as of this writing Prevention and Mitigation We remind readers that Microsoft issued a patch for the CVE-2017-11882 exploit in 2017. Outdated software, operating systems, browsers, and plugins are major vectors for malware infections. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Police Phishing Attack Targets Bank Credentials Fileless Malware Already Targeting Holiday Suppliers Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Comprehensive Guide to Protecting Against the Excel Exploit (CVE-2017-11882)**

**1. Keep Software Updated:**
   - Enable automatic updates for Microsoft Office and other software to ensure patches are applied without manual intervention.
   - Regularly check for updates if automatic updates aren't enabled.

**2. Use Antivirus Software:**
   - Install reputable antivirus software and ensure it's updated with the latest threat signatures.
   - Use scans to regularly check for and remove malware.

**3. Enhance User Awareness:**
   - Educate users to be cautious with emails from unknown senders, especially those with generic or urgent content.
   - Conduct training sessions on spotting phishing emails and suspicious attachments.

**4. Monitor System Processes:**
   - Use endpoint detection and response tools to monitor for unusual process activity, such as unexpected behavior from svchost.exe or EQNEDT32.EXE.

**5. Implement Strong Password Practices:**
   - Avoid using default passwords; set strong, unique passwords for all documents and accounts.
   - Educate users about the risks of relying on hidden features or default settings.

**6. Practice Safe Computing Habits:**
   - Avoid opening attachments from untrusted sources unless necessary.
   - Use Microsoft's Protected View to open potentially risky files in a sandboxed environment.
   - Refrain from enabling macros in documents from unknown senders.

**7. Utilize Backup Solutions:**
   - Regularly back up critical data and store backups securely, both offsite and encrypted, to prevent data loss in case of an attack.

**8. Leverage Cloud-Based Security:**
   - Consider using cloud-based email security services that scan attachments for threats before delivery.

**9. Develop an Incident Response Plan:**
   - Train users on steps to take if a suspicious file is opened: disconnect from the internet, avoid opening other files, and contact IT support immediately.

**10. Seek Professional Support:**
   - If an attack is suspected or confirmed, seek assistance from IT or cybersecurity professionals to mitigate and remediate the threat.

By following these guidelines, users can significantly reduce the risk of falling victim to such exploits and enhance their overall security posture.


Input: Search Free Trial Get Demo Day October 26, 2018 Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of Security Features and Practices**

1. **Key Security Features and Benefits:**
   - The company employs detection mechanisms to identify evasion techniques, such as the Not-Really-Password-Protected method, enhancing security by preventing unauthorized access.
   - Alerts users to potential threats, thereby protecting sensitive information.

2. **Compliance Certifications:**
   - While specific certifications (e.g., ISO 27001, GDPR) aren't mentioned, the company demonstrates compliance through active monitoring and threat response.

3. **User-focused Security Recommendations:**
   - Educate users about password protection tricks and the importance of verifying attachment sources.
   - Conduct phishing training to enhance awareness and cautious behavior.

4. **Technical Implementation Details:**
   - Utilizes analysis of OLE2 documents to check for the EncryptedPackage stream, indicating use of automated tools for email attachment analysis.

5. **Data Protection Measures:**
   - Monitors emails and attachments to prevent malicious content infiltration.
   - Implements data loss prevention strategies to manage sensitive information.

6. **Best Practices:**
   - Encourage regular software updates, antivirus use, and secure communication.
   - Foster a security-aware culture among employees to promote vigilance and safe practices.

**Conclusion:**
The company's approach highlights robust security features and practices, emphasizing detection, education, and technical measures. While explicit certifications are absent, their proactive monitoring and response underscore a commitment to security. Promoting user awareness and best practices further strengthens their security posture.


Input: Search Free Trial Get Demo Day October 26, 2018 Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Detailed Analysis of Product Security Features

The content provided discusses a security incident involving an email with a malicious Excel Workbook attachment that appears to be password-protected but employs a "Not-Really-Password-Protected" evasion technique. Below is a detailed analysis of the product security features and their implications:

---

### 1. **Key Security Features and Capabilities**
- **EncryptedPackage Stream Detection**: The product appears to identify the presence of an EncryptedPackage stream in OLE2 documents, which indicates password protection. This feature helps detect files that are encrypted or supposedly protected by a password, which could be a sign of malicious intent.
- **Evasion Technique Identification**: The product identifies advanced evasion techniques, such as the "Not-Really-Password-Protected" method, where attackers disguise malicious content as password-protected files to bypass security measures.
- **Behavioral Analysis**: The product likely employs behavioral analysis to inspect the file's structure and detect anomalies, such as inconsistencies in encryption or unexpected file modifications.
- **Sandboxing and Isolation**: While not explicitly mentioned, the product likely uses sandboxing to safely analyze suspicious files, such as the Excel Workbook attachment, to determine their intent without risking infection.
- **Alerting and Notification**: The product probably generates alerts or notifications for users or administrators when suspicious or malicious activity is detected, such as the presence of a fake password-protected file.

---

### 2. **User Benefits and Protection Measures**
- **Early Threat Detection**: Users are protected from malicious files that might otherwise evade detection by traditional security tools. The product identifies threats early, preventing potential infections or data breaches.
- **Prevention of Unauthorized Access**: By detecting fake password protection, the product ensures that users are not tricked into opening malicious files that could compromise sensitive data.
- **Increased Awareness**: The product educates users about advanced threats and evasion techniques, promoting a more security-aware environment.
- **Data Protection**: The solution helps safeguard sensitive information by identifying and blocking malicious content that could lead to data theft or unauthorized access.

---

### 3. **Integration with Existing Security Systems**
- **API Connectivity**: The product likely integrates with other security tools, such as antivirus software, email gateways, or SIEM (Security Information and Event Management) systems, through APIs to provide a comprehensive security posture.
- **Centralized Management**: Integration with existing security systems allows for centralized monitoring and management of threats, ensuring that all security events are logged and addressed in a unified manner.
- **Seamless Compatibility**: The product is designed to work alongside other security measures, such as firewalls, intrusion detection systems, and endpoint protection solutions, to enhance overall security.

---

### 4. **Compliance and Certification Details**
- **GDPR Compliance**: The product likely complies with data protection regulations, such as the General Data Protection Regulation (GDPR), by ensuring the secure handling of sensitive data and preventing unauthorized access.
- **Industry Certifications**: The solution may hold certifications from reputable organizations, such as ISO 27001 or SOC 2, indicating adherence to industry-standard security practices.
- **Regulatory Reporting**: The product might provide detailed logs and reports to assist organizations in meeting compliance requirements and demonstrating due diligence in data protection.

---

### 5. **Security Best Practices for Users**
- **Verify File Origins**: Always verify the source of email attachments before opening them, especially if they appear to be password-protected or encrypted.
- **Use Strong Passwords**: If password-protecting files, use strong, unique passwords and avoid sharing them via insecure channels like email.
- **Regular Updates and Patches**: Ensure that all software, including security tools, is up to date with the latest patches and updates to protect against known vulnerabilities.
- **Employee Training**: Conduct regular security awareness training to educate users about phishing, social engineering, and other advanced threats.
- **Use of Trusted Tools**: Stick to trusted and verified tools for encrypting and decrypting files to prevent falling victim to evasion techniques.

---

### 6. **Technical Specifications and Requirements**
- **Supported File Formats**: The product likely supports a wide range of file formats, including OLE2 and newer Office file formats, to ensure comprehensive protection.
- **Operating System Compatibility**: The solution may be compatible with major operating systems, such as Windows, macOS, and Linux, to provide cross-platform security.
- **Processor and Memory Requirements**: While specific hardware requirements are not mentioned, the product likely requires standard computing resources to analyze files and detect threats effectively.
- **Integration Capabilities**: The product may support integration with popular email clients, antivirus software, and other security tools to enhance its functionality.

---

### Conclusion
The product described in the content appears to offer robust security features designed to detect and prevent advanced threats, such as the "Not-Really-Password-Protected" evasion technique. By providing early threat detection, integration with existing security systems, and compliance with industry standards, the product helps organizations protect sensitive data and maintain a strong security posture. Users are encouraged to follow best practices, such as verifying file origins and using strong passwords, to further enhance their security.


Input: Search Free Trial Get Demo Day October 26, 2018 Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Security Guidance for End Users: Data Security and Protection

Here are practical and easy-to-follow recommendations to help you protect yourself and your organization from potential security threats:

---

### 1. **Security Best Practices**
   - **Verify Email Sources**: Always double-check the sender’s email address and look for any red flags, such as spelling mistakes or unusual domains, before opening attachments or clicking on links.
   - **Be Cautious with Attachments**: Avoid opening attachments from unknown or untrusted sources, especially password-protected files, as they could be malicious.
   - **Use Strong Passwords**: If you must use passwords for files or accounts, use unique, complex passwords and store them securely in a password manager.
   - **Enable Two-Factor Authentication (2FA)**: Protect your email and cloud accounts with 2FA to add an extra layer of security.

---

### 2. **Data Protection Recommendations**
   - **Encrypt Sensitive Data**: Use encryption for sensitive files or data before sharing them. Tools like Microsoft Office’s built-in encryption or third-party encryption software can help.
   - **Backup Regularly**: Keep backups of important files in secure, encrypted storage solutions, like external drives or cloud storage platforms.
   - **Limit File Sharing**: Only share files with trusted individuals and use secure methods, such as encrypted email or secure file-sharing platforms.

---

### 3. **Safe Usage Guidelines**
   - **Avoid Opening Suspicious Files**: If an email attachment (like an Excel file) seems unexpected or unusual, do not open it. Contact the sender to verify its legitimacy.
   - **Use Antivirus Software**: Install and regularly update antivirus software to scan attachments and files before opening them.
   - **Educate Yourself**: Stay informed about common phishing and social engineering tactics to avoid falling victim to scams.

---

### 4. **Common Security Risks and Prevention**
   - **Phishing Attacks**: Be suspicious of emails asking for sensitive information or login credentials. Legitimate organizations will not ask for passwords via email.
   - **Password-Protected Files**: Be wary of password-protected files from unknown sources. Some files may appear encrypted but are not truly secure.
   - **Malware**: Never download or open files from untrusted sources, as they may contain malware or ransomware.

---

### 5. **Privacy Protection Measures**
   - **Limit Personal Information Sharing**: Avoid sharing sensitive personal or company information via email or unsecured channels.
   - **Use Encryption Tools**: Use end-to-end encrypted communication tools (e.g., Signal, WhatsApp) for sharing sensitive information.
   - **Monitor Accounts**: Regularly check your email, cloud storage, and other accounts for unauthorized access or suspicious activity.

---

### 6. **When to Seek Additional Security Support**
   - **Suspicious Files or Emails**: If you receive a suspicious file or email, report it to your IT or security team immediately. Do not open or interact with it further.
   - **Data Breach Concerns**: If you suspect your data has been exposed or compromised, contact your organization’s security team or a professional cybersecurity expert.
   - **Complex Protection Needs**: If you need to protect highly sensitive data or set up encryption, consult with a cybersecurity professional to ensure proper implementation.

---

By following these guidelines, you can significantly reduce the risk of falling victim to security threats and protect your data effectively. Stay vigilant and proactive in maintaining your security posture!