My Little FormBook By Paul Rascagneres Published: 2018-06-20 · Archived: 2026-04-05 15:18:42 UTC Wednesday, June 20, 2018 11:00 This blog post is authored by Warren Mercer and Paul Rascagneres. Summary Cisco Talos has been tracking a new campaign involving the FormBook malware since May 2018 that utilizes four different malicious documents in a single phishing email. FormBook is an inexpensive stealer available as "malware as a service." This means an attacker can purchase a compiled piece of malware based on their desired parameters. This is commonplace with crimeware and stealer type malware such as FormBook. It is able to record keystrokes, steal passwords (stored locally and in web forms) and can take screenshots. The author put a lot of effort in the infection vector using multiple malicious documents in a single phishing email. The author also mixed different file formats (PDF and Microsoft Office document) and used two public Microsoft Office exploits (CVE-2017-0199 and CVE-2017-11882) in order to drop the final payload on the targeted system. The final payload was downloaded during the campaign from a small Japanese file-sharing platform (hosted in Netherland). The platform owner has since deleted the malicious payload binaries from their system. Here is the infection workflow: https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 1 of 12 We identified an infrastructure overlap between this campaign and a previous campaign we published in February 2017 relating to Pony malware which utilized Microsoft Publisher files to deliver its payload. There is the potential that the same actor behind these two attacks is the same due to an overlap in the two attacks' infrastructure. If that is the case, the actor could switch between Pony and FormBook to be able to continue their malicious activities for more than a year. Infection Vector Phishing Campaign This campaign starts with a malicious email containing two attachments. Here is a snippet of the email: https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 2 of 12 The email pretends to be an order sent from the sales department of a company located in Spain. The website's details and phone number appear to have been copied from that of a genuine company. The email contains two attachments: A blank malicious Microsoft Office document template file. (.dotm) A malicious PDF document that is also blank. (.pdf) If an example document from the campaign, named "STMORDER-442799.dotm," is opened, it appears blank. However, like most Office documents, if the file is unzipped and opened, you can access the attributes and XML information. This is where the attacker leverages CVE-2017-0199 to trigger an external download by abusing the relationship elements within "STMORDER-442799\word\_rels\document.xml.rels." Despite the file appearing to be blank, it does contain a large amount of XML information. We see the elements being abused: command and control (C2) server from 2017 hxxp://ukonlinejfk[.]ru/mine/fre.php hxxp://alphastand[.]trade/alien/fre.php -> C2 server from 2017 hxxp://igtckeep[.]com/dor/fre.php hxxp://alphastand[.]win/alien/fre.php -> C2 server from 2017 hxxp://kbfvzoboss[.]bid/alien/fre.php -> C2 server from 2017 hxxp://www.cretezzy[.]com/do/ -> FormBook C2 server hxxp://www.beemptty[.]com/se/ -> FormBook C2 server The infrastructure sharing suggests that this is a common actor currently using two different stealers. Based on the timeline, we assume that the actor is currently moving from Pony to FormBook, another stealer. Conclusion This case shows us that malicious actors play with multiple file formats and embedded objects. In this campaign, the author used a PDF with an embedded Office document template using a vulnerability in order to download an additional Office RTF document, and then a second vulnerability and exploit in order to compromise the target. The attacker used an unfamiliar file-sharing platform in order to store the malicious document and a compromised WordPress site in order to store the final payload. We did notice that the file-sharing platform is reactive, removing the malicious files quickly, stopping the infection chain. Some technical elements, such as infrastructure sharing, show us that the actor behind this campaign is probably the same actor behind a campaign we described one year ago. Last month it used two stealers in parallel on the same infrastructure. Based on the information we have today, he/she no longer uses Pony, but switched to FormBook in order to steal information on compromised systems. https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 8 of 12 Coverage Additional ways our customers can detect and block this threat are listed below. Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks. Email Security can block malicious emails sent by threat actors as part of their campaign. Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), andMeraki MX can detect malicious activity associated with this threat. AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products. Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network. Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. IOCs PDF 8f859c1a9965427848315e9456237e9c018b487e3bd1d632bce2acd0c370341e Embedded And Attached dotm 04f093a3b867918dce921fe2ba40dcdae769b35dbce3047aacdb151e2208ea5c Malicious Document Hosted On The Files Sharing Platform 4c16046966a5fd06c84213aa67bfa37949800980915e9b511384ec17dc7eb7b1 -> hxxps://pomf[.]pyonpyon[.]moe/pajelx.doc https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 9 of 12 04f093a3b867918dce921fe2ba40dcdae769b35dbce3047aacdb151e2208ea5c -> hxxps://pomf[.]pyonpyon[.]moe/cgcvsc.doc 59cf77148cbbf24d395d09192ce43ac5395087f3e499cda350e3a93f13e37de1 -> hxxps://pomf[.]pyonpyon[.]moe/btgppc.doc D83f874dda2fa3e4339399c786e9497c1b440019fa5ee5925738fc3afa67352c -> hxxps://pomf[.]pyonpyon[.]moe/ejmhsu.doc 35ea3d8272751d60bd3106e548444588b1959622dfdcf11be14b80786bdb25e6 -> hxxps://pomf[.]pyonpyon[.]moe/cnlvop.doc 5e9979a9676889a6656cbfa9ddc1aab2fa4b301155f5b55377a74257c9f9f583 -> hxxps://pomf[.]pyonpyon[.]moe/hbhjks.doc 0b0615eb8e4c91983fab37475ecc374f79c394768a33ea68c2208da1c03e5a43 -> hxxps://pomf[.]pyonpyon[.]moe/zkxsam.doc Fccc874f4f741231673f5a3c0bdc4c6bfd07f1b1e93f7c64e2015c393966216e -> hxxps://pomf[.]pyonpyon[.]moe/neitsj.doc 13ce56581c8ad851fc44ad6c6789829e7c250b2c8af465c4a163b9a28c9b8a41 -> hxxps://pomf[.]pyonpyon[.]moe/lhvazm.doc 541ea322a3a6385211566f95cef333580a62341dac397e044a04504625acdd0d -> hxxps://pomf[.]pyonpyon[.]moe/cgcvsc.doc 062ae7152d8e8f3abb093e55c5a90213134dd278ac28cfeb18e81132232dcbe8 -> hxxps://pomf[.]pyonpyon[.]moe/tewkco.doc 0ddf7e87957932650679c99ff2e2380e2be8a203d1142f19a22ad602047f372e -> hxxps://pomf[.]pyonpyon[.]moe/lhvazm.doc 1debc4e22a40f4f87142e7e40094ce1a9aa10462f0c6d1c29aa272d7d6849205 -> hxxps://pomf[.]pyonpyon[.]moe/zkxsam.doc PE32 Hosted On The irishlebanese Website d7f0f3fea2f9935c1dd7bda343ec1e3fb77457e68b16b9d51516a3d8c651d14f 05a945fc7a9eb4c9a4db8eb974333b3938c06d9299976075b2fc00a79cf0a129 91a471ba534219f05c31d204b3c5217cde7c67f70600aa3abba334888f628376 f7e97000615ee77093c4ec49f3cbe4b8cb3dc6feafc74ae8d59f01f05dc4280e 23c40f55797b07b2d9bf1e314ea928b1151af2b2e605aa520a715fe56e481528 1d706a3c85973fe96240a254abff52c0593b4aa0c283d3ecc28df6f8baed853b e8f0136abc46b668d44586a6b5a394b470af6af8e9d91bddca4b70e3e66768d1 958ee876ebaab71ea2ef9fcda6a08598319578ccc1f4bd9baa3a54114b88abdc b031075b8ad2558ee3ee7f0749c2b24484dd6fab7252fad71548276514b9b766 667cc420816fd71ae54869b4c0f05129cc5972dbc47f7a98776fc63a72d77691 7db8273fd25088900cffa036eb631ffcee40302dd7b33a7d4f3e653e7ab091c0 3efdc8b15e324cd9323cdbd34fbd19979d6eeb95fe1120ed3a95dc24fab67397 189e2494b19773f9b72072774891378f5809c7bfb121dcba2cee13e6f91ed619 https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 10 of 12 bd44861de18d5bbf71d2d64e29ff9f1d8495f97f5ba0b49eacb504b3768a89bb e0282f51ac3bfba5774893c8b70c31600d7e4bd7f6d7231fd33315396cd18b78 83fa11d8711ef22437681e09a4be500cfaf49ac7cb29837ff6a42fb46b09d789 14ce215b561dc43104e400c0eb877d876f6e9be77c5b2994b9b8745b2132d914 226d38382415b935d849539c0b6305a4259c26dfa7317b944f8498cd3e65850f dd1eeb128b1d1eb40e74281aec79828d7d7179a0375bda5e85ce5fd2fac064a2 a7422eddb437a33d730ab70bd1267d815fc3761d5eda9781de91d0bdeeb823ff 2a21f728282b33b89e6cbd99db52651931b534be9837d99eacf87cfd748c3cba 91b6219f4a8903773492fd83fe02e6aa8729e378f559c5cc9f115a2304f89e57 4f73923c23354ac5050f012f607342362eaf1d691ce1b64ea1e831038cc4236c ebbed2fcd7fe4dc8a95cc60ab9c8e98609bcf3ba5696507252c65cc6be748b14 d1f9549943b936ba54d87a5befd2d241fcddac6f0caf8c786f6034ab18b8e61d ae7cacc7a16cb48cb40473ad0269331c392f8eb0fef8ebe2d90f3592fccb306c 00cb817330768b33a30bcf7a6a67d0269aa32f8099aee3ecd18da0e31d096610 e93994bf78b13d3bdee1682faf6c6544246fbd6d95a0aa043ac175ad0b905646 822c1239203db0bfdde3d0b65f50e53f7ee155638d4743b14f58267fa3e76531 5aac259cb807a4c8e4986dbc1354ef566a12ced381b702a96474c0f8ff45f825 8f6813634cb08d6df72e045294bf63732c0753f79293f1c9b2765f686f699a72 82ce499994e4b2ee46e887946ef43f18b046639e81dfe1d23537ce6a530d8794 C2 Servers hxxp://www[.]drylipc[.]com/em1/ hxxp://www[.]handanzhize[.]info/d5/ hxxp://www[.]bddxpso[.]info/d7/ hxxp://www[.]newraxz[.]com/as/ hxxp://www[.]atopgixn[.]info/de8/ hxxp://www[.]cretezzy[.]com/am/ hxxp://www[.]casiinoeuros[.]info/d3/ hxxp://www[.]newraxz[.]com/as/ hxxp://www[.]cretezzy[.]com/do/ hxxp://www[.]newraxz[.]com/as/ Overlaps Samples 5aac259cb807a4c8e4986dbc1354ef566a12ced381b702a96474c0f8ff45f825 hxxp://alphastand[.]top/alien/fre.php hxxp://alphastand[.]trade/alien/fre.php hxxp://igtckeep[.]com/dor/fre.php hxxp://alphastand[.]win/alien/fre.php hxxp://kbfvzoboss[.]bid/alien/fre.php hxxp://www[.]cretezzy[.]com/do/ https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 11 of 12 8f6813634cb08d6df72e045294bf63732c0753f79293f1c9b2765f686f699a72 hxxp://ukonlinejfk[.]ru/mine/fre.php hxxp://alphastand[.]top/alien/fre.php hxxp://alphastand[.]trade/alien/fre.php hxxp://alphastand[.]win/alien/fre.php hxxp://kbfvzoboss[.]bid/alien/fre.php hxxp://www[.]beemptty[.]com/se/ 82ce499994e4b2ee46e887946ef43f18b046639e81dfe1d23537ce6a530d8794 hxxp://ukonlinejfk[.]ru/mine/fre.php hxxp://alphastand[.]top/alien/fre.php hxxp://alphastand[.]trade/alien/fre.php hxxp://alphastand[.]win/alien/fre.php hxxp://kbfvzoboss[.]bid/alien/fre.php hxxp://www[.]beemptty[.]com/se/ Source: https://blog.talosintelligence.com/2018/06/my-little-formbook.html https://blog.talosintelligence.com/2018/06/my-little-formbook.html Page 12 of 12