Simple Analysis Of A CVE-2021-40444 .docx Document

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Handler on Duty: Didier Stevens

Threat Level: green

Simple Analysis Of A CVE-2021-40444 .docx Document
Analyzing a malicious Word document like prod.docx that exploits CVE-2021-40444 is not difficult. We need to find the malicious URL in this document. As I've shown before, this is quite simple: extract all XML files from the ZIP container (.docx files are OOXML files, that's a ZIP container with (mostly) XML files) and use a regular expression to search for URLs. This can be done with my tools zipdump.py and re-search.py: OOXML files contain a lot of legitimate URLs. Like schemas.microsoft.com. These can be filtered out with my tool re-search.py: Didier Stevens Senior handler Microsoft MVP blog.DidierStevens.com	DidierStevens 677 Posts ISC Handler Sep 18th 2021
Thread locked Subscribe	Sep 18th 2021 1 year ago