It appears there is another layer of embedded base 64 string but I can’t figure this out. It is seriously obfuscated. I am guessing it is trying to send some data to somewhere, but I can’t figure out what data or where it wants to go.
The first thing I did was to notify them. I used the contact form on their web site, assuming the email had been hacked.
I just ran Malware Bytes and it didn’t find anything. Windows Defender virus detection had been disabled and I had to edit the registry to remove the disable. That suggests that some malware did that, but I don’t know how long it’s been like that. Defender just ran a scan and found no threats.
The code I showed in my second post is similar to the Veil Stream attack in the link you posted, but the encoded part seems to be the payload and it translated to complete nonsense.
Even the VBA code was obfuscated to an impressive degree (e.g., the encoded string was the default text of a textbox on a userform) but I am very knowledgeable about VBA and could see something nefarious was going on, and was able to extract the string I showed in my post through stepping through the debugger.
If you ran a random bash script you got in an email, it too could do the same kind of damage. It would have access to all your home folder files. Windows isn’t that different in this regard.
IMHO, if you followed the same best practices, all the major operating systems are sufficiently safe these days, though Windows remains the biggest target. None of them are invulnerable to zero-days and all of their protections can be circumvented by unwitting users. The second biggest target is in fact already Linux, via shitty Android phones and clueless users.
“Sufficiently safe” is widely optimistic. Just saw this on Slashdot yesterday.
A hole in the IP stack of VxWorks OS which runs on hundreds of millions of IoT and such devices. And since the makers of such devices quite often don’t do updates, this is a bad, bad thing.
I assume, on the other hand, that there are an unfathomable number of holes in all the common OSes several of which are currently being exploited but even those won’t be found for while, sometimes years.
Yeah, as I said, none of them are invulnerable to zero-days. IoT is especially vulnerable, but they usually don’t store particularly valuable data (yet). And then there are things like energy grids and C&C infrastructure, but those tend to attract state-sponsored opponents rather than opportunistic hackers.
For the average home user though, it’s not THAT big a deal. Just update your software regularly and run a basic firewall and ad blocker, don’t download random programs, and chances are you’ll no longer be a big target.
Thing is, a lot of our actual data is stored with third parties already, and they get hacked all the time (Target, Capital One, Equifax, etc.). And then much of the world willingly surrenders more of it to Google and Facebook, who then willingly share it through an open auction.
Ransomware may be a particular threat, but again, best practices. Back up your stuff (even just Dropbox or Google Drive), don’t run random shit, you’ll likely be fine.
Maybe I should have phrased it as such: Most consumer operating systems are sufficiently safe, if you follow best practices, given that no one individual is worth a whole lot of effort, and their data is probably easier harvested through institutional breaches anyway.
In terms of “best practices”, one of the standard ones is to use a top notch ad blocker. But that’s not good for the future of the Internet. I try to be a bit lenient on blocking ads but all too often “normal” sites have skeevy ads and I have to knock that crap off.
I’m guessing - not conversant with Powershell - that *$vuRDOAzC * is a list of server (IP’s?) that get downloaded from the master site.
It then uses the userenv to determine which type of software is needed (win x86 or x64?) to download the pieces of the take over program?
Something like that. The code isn’t complex, it’s just obfuscated. Basically sets a bunch of strings and concatenates them into filenames and URLs, and then downloads components.
I think it’s like…
$secret_file_path=$users_home_directory + $blah + ".exe";
$downloader = new downloader object;
$list_of_stuff = download some list and split it by % sign;
foreach ($url in $list_of_stuff)
download $url and save it to $secret_file_path;
if $secret_file_path's filesize is greater than or equal to 2977 bytes, run it;
otherwise do nothing really;
go to 3.php;
So it downloads a bunch of chunks, tests the size of each, running the downloaded app only if it’s big enough. Then it hits another random URL, maybe just to let some command center know it’s still alive.
Also keep in mind that the example in the OP is of a malicious macro in a downloaded Microsoft Word document. I’m pretty sure that the default security settings in Word for years prevents it from running macros in documents unless you specifically authorize it to.