It has a VBA function called Document_Open(). The malicious Macro is executed once the button Enable Content is clicked. To see this content, click on 'enable editing' from the yellow bar and then click 'Enable content' In either case, I translated it into English using Google translate:ĭocument created in an earlier version of Microsoft Office Word Our best guesses are that this campaign is targeting multiple regions and the wrong document was attached, or this is being done deliberately to disguise the warning. Interestingly, the content of this document is written in Spanish. It asks the recipient to review the materials in the attached Word document and then reply to the email as soon as possible. The spam email looks like an urgent order reminder from a purchase manager. The Email Captured by FortiGuard Labs and the Word Document In this analysis I reveal my findings on this new malware, including how it is launched by the Word document, how the executable deploys itself on the victim’s device, what kind of sensitive information it searches for, and how stolen data is sent to the attacker via SMTP protocol.

This malware doesn’t seem to belong to any known malware family, so we named it 'dmechant', which is a constant string compiled in the malware sample. However, after I performed some deep research on this phishing campaign, I realized that a fresh malware was being delivered by the Word document designed to steal crypto wallet information and credentials from the victims’ infected devices. The FortiGuard Labs team was recently monitoring a new phishing campaign that uses the classic strategy of attaching a malicious Microsoft Word document to an unsolicited email that recipients were then asked to open. Impact: Collects sensitive information from victims’ computers

Filezilla malware