Microsoft warns users of new macro trick used to activate ransomware

By: Madeleine Dean
2 minute read

Researchers from Microsoft’s Malware Protection Center are warning users of a potentially high-risk new macro trick used by hackers to activate ransomware programs. The malicious macro targets Office apps and it’s a Word file that contains seven very skilfully hidden VBA modules and a VBA user form.

When researchers first checked the malicious macro, they could not detect it, as the VBA modules looked like legitimate SQL programs powered by a macro. After a second look, they realized the macro was actually a malicious code incorporating an encrypted string.

However, there wasn’t an immediate, obvious identification that this file was actually malicious. It’s a Word file that contains seven VBA modules and a VBA user form with a few buttons (using the CommandButton elements). […] However, after further investigation we noticed a strange string in the Caption field for CommandButton3 in the user form. […]

We went back and reviewed the other modules in the file, and sure enough – there’s something unusual going on in Module2. A macro there (UsariosConectados) decrypts the string in the Caption field for CommandButton3, which turns out to be a URL. It uses the deaultautoopen() macro to run the entire VBA project when the document is opened.

The macro connects to the URL (hxxp://clickcomunicacion.es/<uniqueid>) to download a payload detected as Ransom:Win32/Locky (SHA1: b91daa9b78720acb2f008048f5844d8f1649a5c4). It activates when users enable macros in Office files.

The only way to avoid getting your computer infected by viruses via Office-targeting macro-based malware is to enable macros only if you wrote them yourself, or you completely trust the person who wrote them. You can also install BitDefender’s AntiRansomware tool, a standalone tool, that doesn’t require Bitdefender security to be installed. Unlike other free security tools, BDAntiRansomware doesn’t pester you with ads.

Should you ever become the target of a ransomware attack, you can use this tool, ID Ransomware to identify the ransomware that encrypted your data. All you have to do is upload an infested file or the message the malware is displaying to your screen.  ID Ransomware can currently detect 55 types of ransomware but does not offer any file recovery services.

RELATED STORIES YOU NEED TO CHECK OUT:

For various PC problems, we recommend this tool.

This software will repair common computer errors, protect you from file loss, malware, hardware failure and optimize your PC for maximum performance. Fix PC issues now in 3 easy steps:

  1. Download this PC Repair Tool rated "Excellent" on TrustPilot.com.
  2. Click “Start Scan” to find Windows issues that could be causing PC problems.
  3. Click “Repair All” to fix all issues with Patended Technologies (requires upgrade).

Next up

Best Windows 10 antivirus software to use in 2018

By: Radu Tyrsina
7 minute read

Update – 2018 will soon come to an end and we already have a guide on what is the best antivirus you should get in […]

Continue Reading

These features are out for good with Windows 10 version 1809

iamsovy@gmail.com' By: Sovan Mandal
2 minute read

Microsoft is all set to launch its next big update, Windows 10 version 1809 in October. While that should be a nice piece of news […]

Continue Reading

Windows 10 18H2 builds no longer receive new features

By: Matthew Adams
3 minute read

The Windows 10 October 2018 Update (otherwise 18H2) rollout might now be two to three weeks away. For the last few months, new build previews […]

Continue Reading

Discussions