Down the Rabbit Hole: Extracting Maliciousness from MSG Files Without Outlook

Email As Infection Vector

Recently, we noticed a spam email with a Message (.MSG) file attached with it. As you may know, MSG file is a file format for storing Microsoft Outlook and Exchange message files.

This spam email claims to be a Tax Notification from Canada Revenue Agency, and of course the "statement file" is attached with it for the recipient to "find out". As you can see, the .MSG file is an attachment to the spam message.

EmailSample

Extracting The Malware

The objective of this analysis is to extract the malicious object from the .MSG file without the help of MS Outlook. So first things first, let's verify if the .MSG file (MD5: b14b5b1bda41f27976050357f5a59e5a) is indeed an OLE2 (Object Linking and Embedding) compound file – a file format used for storing MS Office documents.

Hiew

At first glance, we can see that the magic header "d0cf11e0"is there. So yes! it seems to be a legitimate OLE compound file. However, it doesn't seem to have any malicious macros, exploits or whatsoever.

So the next step is to extract the .MSG file. I used the 7zip utility which can surprisingly extract OLE containers. By renaming the file extension from .msg to .zip, we can extract the message file with 7zip. You may also use the Microsoft's DocFile viewer - DFVIEW.EXE (which is shipped with MS Visual Studio) to extract the file.

MsgtoZip

And here's a screenshot of the extracted stream objects:

ExtractedMsg

 

The extracted streams contain email properties, headers, body and attachments. The stream object we are interested are inside the "__attach_version*" folders. Most likely, this is where the (malicious) attachments are stored.

Let's take a look at the attachment streams inside those folders:

Folder #1:__attach_version1.0_#00000002
Extracted stream attachment:

__substg1.0_37010102 – image of a PDF file screenshot in .PNG format

Image screenshot:

__substg1 - Copy.0_37010102

 

Folder #2:__attach_version1.0_#00000001
Extracted stream attachment:

__substg1.0_37010102 – image of a PDF file screenshot in .EMF format

Image screenshot:Out - Copy

 

Folder #3:__attach_version1.0_#00000000
Extracted stream attachment__substg1.0_37010102 - Zlib compressed binary data
Binary screenshotOleData.mso

 

As you can see under Folder #1 and #2, it contains an image of a spoofed PDF file, it also uses a spoofed filename "case_645461.pdf". The extracted stream under Folder #3 is the stream __substg1.0_37010102. This is the file we are most interested in. While it is compressed, we can deflate it using ZLIB compression library. The image below shows the compressed data starts at offset \x04 with the Zlib signature [\x78 \x9C]

DeflateStream1

To accomplish this task, I chose to use Python's ZLIB library to deflate the stream.

import zlib #let's import zlib module
compressed_data = file("__substg1.0_37010102","rb").read() #let's read the compressed data
layer2 = zlib.decompress(compressed_data[4:]) #decompress data from offset\x04
f = open("layer2.bin","wb") #and save it to a file
f.write(layer2)
f.close()

Now that we saved the deflated stream to the disk, let's inspect what it looks like:

Layer2.bin

Hmmm, that's another layer of OLE File. Let's extract it once again with 7Zip.

AnotherCompressedData

In the image above, we can see that OLE file contains yet another layer of compressed data. Again we need to deflate it with the help of our previous Python code.

Below is the deflated stream from the OLE file, It contains a bunch of JavaScript code, let's investigate it!

OleJavascriptRaw

The Payload

The JavaScript is heavily obfuscated and, when run, it downloads a malicious executable from the domain "tradestlo.top"

JSDebug

The downloaded executable appears to be a Trojan downloader called Terdot. This Trojan injects its code to Windows Explorer (explorer.exe) process and downloads another banking Trojan Zbot

The Zbot Trojan attempts to connect to the domains: aspect.top and prispectos.top (96.9.244.111) and download its configuration file.

DNSPcap

Zbot is a well-known banking Trojan that has a capability to intercept network traffic and steal system information, online banking credentials and passwords.

Conclusion

We don't often see malicious files embedded in .MSG file attachments. It represents yet another technique used by cybercriminals to bypass email gateways. While extracting the malicious JavaScript object, we encountered layers of compression that would perhaps be difficult for some antivirus product to detect. As you can see in the screenshot below, only handful of security product detects the .MSG file.

VT

For end-users, be wary of opening .MSG file attachments that arrive via email. By default, Outlook will prompt users with a warning, so always verify with your sender if what they send is trustworthy.

WarningSign

 

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.