{
  "timestamp": "2025-02-05T23:29:50.595188",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a cybersecurity expert specializing in company websites and product documentation.\n        Analyze the content and classify it into the given categories.\n        Return only the applicable categories as a comma-separated list, nothing else."
      },
      {
        "role": "user",
        "content": "\n        Categories to choose from:\n        product_security_features, end_user_security, compliance_certifications, security_best_practices, data_protection, access_management, threat_prevention, incident_response, privacy_policy, technical_documentation\n        \n        Content to classify:\n        Search Free Trial Get Demo Email Malware without Macros or Attachments  Beware Rogue Outlook Meeting Invites October 24, 2017 A new security vulnerability found in the Microsoft Office Dynamic Data Exchange DDE protocol is allowing malware authors to send macro-less malicious attachments and potentially even attachment-less malicious emails and calendar invites. The implications here are significant, given that many of todays security solutions rely on the ability to identify and halt malicious macros usually found in attached documents. Attachments Without Macros Initially discovered by researchers at SensePost , the Microsoft DDE vulnerability is already being used to deliver malware campaigns via attachments without using macros . Different malware campaigns using the DDE exploit in malicious email attachments which deploy remote access trojans, banking trojans, and ransomware payloads are being found on an almost daily basis. For email messages, the DDE exploit is triggered if you click on the reply button in some cases, and in others is triggered by simply opening the emails. Cyren detects the malicious Word documents exploiting the DDE features as XMLDDEDownldr.A!Camelot and XMLDDEDownldr.B!Camelot. And a New Infection Technique No Attachments Necessary In addition to this newly discovered DDE technique using Microsoft Word, there is an alternative infection technique discovered by researcher Kevin Beaumont that works in Outlook Email and Calendar invites, which further eliminates the need for maliciously crafted and attached documents. In these instances, the criminal need only embed the malware code in the body of the email or calendar invite. Once the email or invite is opened, the malware executes. We tried to replicate the newly found vector, which has not been found in the wild yet, and can confirm that it works. We describe the process below. For calendar invites, the DDE exploit is triggered every time the invitatation is opened, both when received and when opened as calendar notifications. Outlook messages and calendar invites are detected as RTFDDEDownldr.A!Camelot and RTFDDEExploit.gen!Camelot. Figure 1 DDE was successfully triggered by the crafted calendar invite How It Works To examine how an Outlook mail message stores the DDE links, we exported the DDE calendar invite POC to disk. Outlook saves email messages and calendar invites in the Microsoft MSG file format. Using a modified version of the olebrowse module from oletools , we can view the following MSG stream details both in the GUI and from the console output Stream path Stream size Stream property tag ID Stream property tag data type First 0x20 bytes of the stream console output only Figure 2 Modified olebrowse window output Figure 3 Modified olebrowse console output As highlighted in figure 3, we find a compressed RTF object after the PidTagBody value !Unexpected End of Formula from the olebrowse window. By selecting this stream, we can dump the following hex data Figure 4 PidTagRtfCompressed object hex dump The compressed RTF file format specification follows the structure below Offset Size Description Remarks 0x00 0x04 COMPSIZE 0x04 0x04 RAWSIZE 0x08 0x04 COMPTYPE COMPRESSED  0x75465a4c LZFu 0x0c 0x04 CRC Integrating the decompress function created by Dmitry Alimov in olebrowse save stream functionality, we were able to dump the decompressed format of the RTF containing the DDE link and see the following RTF entries Figure 5. Save decompressed stream to file Figure 6. Decompressed RTF format showing DDE field entry What To Do About It Although we have yet to see this Office feature exploited in the wild, there are several ways to mitigate or prevent infection. This particular attack still needs user intervention to be successful. One way to protect from attacks leveraging DDE is by disabling the Update Automatic Links at Open option in the Microsoft Office programs. Please note that we only tested it on Microsoft Word 2016. Figure 7 Option to disable Update Automatic links at open in Word 2016 File-Options-Advanced-General- Uncheck Update automatic links at open The attack can be also mitigated by modifying the registry as shared by wdormann . It will disable DDE to automatically execute the payload for Microsoft Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Figure 8 The DDE mitigation script content to modify the registry Figure 9 Successfully modified the registry Figure 10 The crafted Calendar Invite was mitigated. Of course, we highly advise users to always be vigilant and think first before clicking or opening email or meeting invites from unknown senders. You can get a copy of the modified oletools modules from  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Cyren erg\u00e4nzt die SAAS-Security- Plattform durch E- Mail-Archiving How to Identify  Spot Phishing Links Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n        "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "product_security_features, end_user_security, data_protection, access_management, threat_prevention, incident_response, security_best_practices",
    "usage": {
      "prompt_tokens": 1125,
      "completion_tokens": 409,
      "total_tokens": 1534
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}