Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 761612" data-attributes="member: 32260">One more sponsor added - mspub.exe, which is Microsoft Publisher installed in MS Office. The sponsor usually opens .pub files. MS Office does not use Protected View for opening those files (when downloaded from the Internet), so they were recently used in a spam campaign.<a href="https://sensorstechforum.com/necurs-botnet-campaign-targets-banks-malware-pub-files/" target="_blank">Necurs Botnet Campaign Targets Banks with Malware .Pub Files</a><a href="https://blog.talosintelligence.com/2017/02/pony-pub-files.html" target="_blank">Cisco&#039;s Talos Intelligence Group Blog: When A Pony Walks Out Of A Pub</a>The .pub files can have VBA Macros like other MS Office documents. Macros are blocked in Hard_Configurator via &lt;Documents Anti-Exploit&gt; = ON (Microsoft Excel, Microsoft FrontPage, Microsoft Outlook, Microsoft PowerPoint, Microsoft Publisher, and Microsoft Word) for MS Office XP, MS Office 2003, ... up to MS Office 2016.Also, the user can add the PUB extension to Designated File Types list, if macros are not blocked.WD ASR will stop/mitigate most malicious PUB documents, too.</blockquote>

[QUOTE="Andy Ful, post: 761612, member: 32260"] One more sponsor added - mspub.exe, which is Microsoft Publisher installed in MS Office. The sponsor usually opens .pub files. MS Office does not use Protected View for opening those files (when downloaded from the Internet), so they were recently used in a spam campaign. [URL="https://sensorstechforum.com/necurs-botnet-campaign-targets-banks-malware-pub-files/"]Necurs Botnet Campaign Targets Banks with Malware .Pub Files[/URL] [URL='https://blog.talosintelligence.com/2017/02/pony-pub-files.html']Cisco's Talos Intelligence Group Blog: When A Pony Walks Out Of A Pub[/URL] The .pub files can have VBA Macros like other MS Office documents. Macros are blocked in Hard_Configurator via <Documents Anti-Exploit> = ON (Microsoft Excel, Microsoft FrontPage, Microsoft Outlook, Microsoft PowerPoint, Microsoft Publisher, and Microsoft Word) for MS Office XP, MS Office 2003, ... up to MS Office 2016. Also, the user can add the PUB extension to Designated File Types list, if macros are not blocked. WD ASR will stop/mitigate most malicious PUB documents, too. [/QUOTE]

Verification