ReversingLabs' YARA rule detects a Cobalt payload exploiting CVE-2017-11882

Seeing that Microsoft Office is the world's most widely used office suite, vulnerabilities found in its components present a major security issue. The risk is even greater with remote code execution vulnerabilities, as the attacker does not need physical access to take control of the affected system.

One such vulnerability is CVE-2017-11882, discovered in Microsoft Office Equation Editor, the application for creating math and science equations within Office documents. The memory-corruption issue has been present in the Microsoft Office code for 17 years - not even the latest Windows 10 Creators Update was spared.

Exploits that take advantage of this vulnerability have already been detected and analyzed. Sample analysis performed by ReversingLabs supports the conclusion that the infamous Cobalt relies on this particular vulnerability for their attacks. Read on for more details from our findings.

The starting point of our analysis was an RTF seen in the wild:
bc4d2d914f7f0044f085b086ffda0cf2eb01287d0c0653665ceb1ddbc2fd3326

Using MS Equation CVE-2017-11882, it contacted
hxxp://104.254.99[.]77/x.txt
for first-stage payload, executed through MSHTA:
5f434901d4f186bdc92ee679783bdfad80281423848462e445704d5a10b0dc20

When run, it downloads the next stage payload from
hxxp://104.254.99[.]77/out.ps1
677426cdd9c6945de3a3858f12fae62914e4d914a24f51475b859f2bcb545095

The script drops the embedded final second-stage payload - Cobalt, one 32-bit or second 64-bit DLL, depending on the system architecture:
d8e1403446ac131ac3b62ce10a3ee93e385481968f21658779e084545042840f (32-bit)
fb97a028760cf5cee976f9ba516891cbe784d89c07a6f110a4552fc7dbfce5f4 (64-bit)

The MS Office dropper can be detected using the YARA rule “potential_CVE_2017_11882_v2.yara”. Download the YARA rule here.

Additional IOCs:

MS Office documents exploiting CVE 2017-11882 seen in the wild, leading to malware payload:

e14d0f34b2eafd600234d4d6c1e3e9970eaabec497cdc8b8cd62681e43760a39
a6d6a9107d992048739cb04bd4fb89647b28877d7d4d86b747d7920de04bb116
5734f4a975d39ca6d6d3ff7c2e4d5133501fa39489c1c6ade7c7c1c261d4656c
0a596c67b3733fbc6b7dffbce69d65dc649162c2ac7a25c54c0e4679b5baf5c9
94b9dd0eecc2ee5411c91bb6bef4edcf0db00d4360937a0fc31fdb9aae811844
b6bafc9586de3b5d351ffabaee47157a1eb9ddf93bd2c04c28d68df8e374824f
17f9db18327a29777b01d741f7631d9eb9c7e4cb33aa0905670154a5c191195c
3312ffa9941e1eb2ba2d64a4c6dcdb7a39fef86babd086efeeb1d6efc970bce8
c5f5f136bcdc259671d47ea30dd459b67dc1478a99f25a45c30950533ff150cf43b58a960f6a29da9a755dd3c44c490124a70b52e6e2fcc4ec620be4367f09cac46af34a952e65cd964ff382e142e78176e660801f4f876095926656950ff5f5ffc8be3a00cf241cacec8f919535ede12c7afd0202769653d4deebebec99dd8b2b6004fe60b1896ca50ef9eef59d869df068c821e09a6050211ac4781538a2625c68c0a32a8c59271afe3456430125f77b02b240fe578da6b7f398656f6cf972172151f122193b2229ec6a6a63c259198e1d4ace06381ff20f74a9369612dd576ccdae80c4ae74c3c5ce47341fabfab53a09ac726c6ed8eec02ca549db532a771f689e3cb16533604fccfbe9b36ea913d4c354d2730e0ceac41a0ef711a0c5df2b5b13215944f124cbff1e0029073e2e432c9788ec1a8c8d31a303ac827ac3d32e9ed723ed8f3f97ed205c534881f997a25546b3d2d8ef5719636a034dc9045894b6f39f0203c9d82ed69a99a0443e4f9814394bb181359ffd906840696ff88a1157602a1cfd3de2d448f0a18d4a3e6b7ddac9e9902bbabd46347a3295a1aa4ec02b94af36f84f3c9a958f2b75eecde382c7438b837c2160ebe65b40e64058e00f282bb3a1913c8d4e807ece231c891d1faac8b16d02f6d7a965f7ca9d2fe5415f27a664f38890e5dadac69a3c8e33679d4511cdbf65a4423a1fbb16ddf5edf06f2dbb3eb9f40fe5326f60bceff5fe58e7458ba2991dbe6e1aa500f4b44130e80fd8e3a2e55b4306b817396ea469aa4ef78612686934c1ec1bc8eabb337ed1331bcc44b25363a6e9a2303eb8f1d00815d65c3f1d3ac870b6aafbba3b9c72f0fdde45a12f21654bae67d0531b02603cef5ef2849609bfda7f96ae6ab10d53d769e5217688074d10fd3a94761de1f8fbffd09caa7d7a89c567d551d2b5916c0fc2f8274bbffb680bae6c6e8a7665149d83e06c6e5bfc4d056548bc8b44a030dc451b1bbe51dd75e00126b704ac80fce72178b05d96c145e28fb353ab55999a419e1fefd2fc644d38d1c6e180e5edb65acacf90291f757c93a2c7af64aa3b24355702a69029bf2b0c97bfb9ddbbe6e89409f1b11007a92d8ca4a6df6597b72eb45318eed3b1f1fec188d0479b3247c6d857a946aaaf6e611f9ea739e511a622851f34d791f76ca94cc971db533c99ce1ddf1f7dd2089f02bcda3e123dbab483c270a85edbbc88bb10f663eeb1a9d9821f7c17d6316a7cab8216146337dc89ea70c0aadfd6f891c0d3247e7ae010632d04c3b00d705924f0c024e2e8c2ea58cf3b7abc4d2d914f7f0044f085b086ffda0cf2eb01287d0c0653665ceb1ddbc2fd33262a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b75074508e2452cc5836603326c4bd7cfffb6c56d3181d4399d0df245d7f0a11fd9473f6539ade41798c93e754e2bb63c0cebd7722538c871e097f125116f939d56b28384f8c9c8dff0a842cc8d2654bd887dbac85973e0de8e2fa0a28208457ac0b8153338d99d658853f44e4529a21c36c4dffd340ad20971b84b86648b729ca5cf8eb4260e9edb33de8bb6c7bd191e456d53ad2183b8600d54e1b75a17090f5596