A few days back, Kaspersky blogged on “Brazilian bankers gone wild: now using malicious Office files”. They stated:
New trick from cybercriminals of Brazil – a suspicious message arrives to the user with a file attached named “Comprovante_Internet_Banking.rtf”, translated from Portuguese it means “Receipt from Internet Banking”:
An image of the bank receipt is presented in the file and the user is asked to double-click the image. Once the image is clicked, the user is asked to execute it and it begins to infect by running as a CPL file. Also, the reported MD5: 563707b4edcc0bb0c88365a6702d4ba0 (CPL file) and the detection as Trojan.Win32.ChePro. I searched the MD5 in nad and VT, ended up with no result. I also, searched the family name- unable figure out the file, I’m looking for. I can find the MD5 in http://www.threatexpert.com/report.aspx?md5=563707b4edcc0bb0c88365a6702d4ba0 only. Again, I perform a quick search in google : “Comprovante_Internet_Banking.rtf”.
I found the VT link and located the file in our malware collection.
I downloaded the sample- it is the RTF file and looks exactly like what Kaspersky blogged. It is sure that this RTF has an embedded object in it. I need to extract it now.
(snap of the RTF file)
There is a good tool – RTFSCAN from http://reconstructer.org (OFFICEMALSCANNER). Using this tool, I am able to extract the file inside the RTF doc.
(Snapshot of extracting the embedded object in RTF using RTF scan)
I executed the dll file with the extension as cpl and it shows as follow in the snap:
The system gets restarted automatically and gives up the following error after the restart:
There is a copy of that dll file present in Appdata location. Xvwmmav.mod is not found in the app data. So that is the only error that was presented.
