Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 819360" data-attributes="member: 32260">You can embed in MS Office document anything you want (shellcode, DLL, EXE, script, etc.).Simply open a document and use OLE. This method works for scripts, MSI, and EXE files, but is actually restricted by Microsoft, so some embedded OLE will be blocked:[URL unfurl=&quot;true&quot;]https://support.microsoft.com/en-us/help/4032364/how-to-control-the-blocking-of-ole-com-components-in-microsoft-office[/URL]The shellcode, EXE, or DLL files can be also embedded in VBA macro or hidden in pictures via steganography. In this case, an exploit, script or macro has to be used to decode and execute an EXE.W97M.Downloader works in a slightly different way. It is MS Office Word document with embedded macro or exploit, which try to download and execute an EXE (or another payload). The EXE (or payload) is not embedded in the MS Office file.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" />This is the most common way of abusing Word documents.The method of embedding the payload (for example an EXE file) into MS Office documents is rarely used, because of default MS Office restrictions.</blockquote>

[QUOTE="Andy Ful, post: 819360, member: 32260"] You can embed in MS Office document anything you want (shellcode, DLL, EXE, script, etc.). Simply open a document and use OLE. This method works for scripts, MSI, and EXE files, but is actually restricted by Microsoft, so some embedded OLE will be blocked: [URL unfurl="true"]https://support.microsoft.com/en-us/help/4032364/how-to-control-the-blocking-of-ole-com-components-in-microsoft-office[/URL] The shellcode, EXE, or DLL files can be also embedded in VBA macro or hidden in pictures via steganography. In this case, an exploit, script or macro has to be used to decode and execute an EXE. W97M.Downloader works in a slightly different way. It is MS Office Word document with embedded macro or exploit, which try to download and execute an EXE (or another payload). The EXE (or payload) is not embedded in the MS Office file.:giggle: This is the most common way of abusing Word documents. The method of embedding the payload (for example an EXE file) into MS Office documents is rarely used, because of default MS Office restrictions. [/QUOTE]

Verification