XLoader delivered in purchase-order Word files via CVE-2017-11882
Original title: Hackers Disguise XLoader Malware as Purchase Order Confirmations to Infect Windows Computers
AhnLab says a DOCX embeds RTF that drops VBScript and runs XLoader in memory to steal browser data.
Attackers are sending phishing emails posed as purchase-order confirmations with malicious Word attachments aimed at Windows systems. The DOCX uses Word's altChunk feature to load an embedded RTF; an OLE object writes a VBScript, and CVE-2017-11882 in Equation Editor runs it without a macro prompt. PowerShell then persists via registry Run keys, XOR-decrypts a payload, and executes XLoader in memory. ASEC links the chain to similar purchase-confirmation lures from April 2025 but does not tie both campaigns to one operator.
Unconfirmed: ASEC does not establish that the same operator ran the April 2025 and current campaigns.
- The VBScript path cited is %TMP%\724812.vbs and the staged file is %TMP%\Quisque.Dal.
- Persistence uses HKCU values named TORO, Laboris, and Cupidatat.
- The loader XOR key reported is 0x6B506102.
- Reported command-and-control is hxxp://www.dumbsplash[.]com/ilto/.
Impact: Steals system and browser data and can fetch more malware
| Product | Affected |
|---|---|
| Microsoft Office Equation Editor | — |
- 1.Install Office security updates and remove vulnerable Equation Editor installations.
- 2.Hunt for the reported temp files, registry values, and defanged command-and-control host.
- 3.Verify unexpected purchase-order emails before opening attachments.
- CVEs
- CVE-2017-11882
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1059.001 PowerShellT1547.001 Registry Run Keys / Startup Folder
- Vendors
- Microsoft
- Products
- Microsoft Office
- Malware
- XLoader
- Organizations
- AhnLab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dumbsplash.com | are. The reported command-and-control address is hxxp://www.dumbsplash[.]com/ilto/ . These capabilities make the infection a potential |
| domain | www.dumbsplash.com | 8d0158996 MD5 e0d7a34bc9f4590bc073d08b50c854d1 URL http[:]//www[.]dumbsplash[.]com/ilto/ Note: IP addresses and domains are intentionally |
| md5 | 5bd3c5f273ba5ae4c4ae745c6943a4f7 | or asks for urgent document review. IOCs Type Indicator MD5 5bd3c5f273ba5ae4c4ae745c6943a4f7 MD5 8b3542531d98a47524c0f468d0158996 MD5 e0d7a34bc9f4590bc0 |
| md5 | 8b3542531d98a47524c0f468d0158996 | OCs Type Indicator MD5 5bd3c5f273ba5ae4c4ae745c6943a4f7 MD5 8b3542531d98a47524c0f468d0158996 MD5 e0d7a34bc9f4590bc073d08b50c854d1 URL http[:]//www[.]dum |
| md5 | e0d7a34bc9f4590bc073d08b50c854d1 | e4c4ae745c6943a4f7 MD5 8b3542531d98a47524c0f468d0158996 MD5 e0d7a34bc9f4590bc073d08b50c854d1 URL http[:]//www[.]dumbsplash[.]com/ilto/ Note: IP addresse |
| url | http://www.dumbsplash.com/ilto/ | tional malware. The reported command-and-control address is hxxp://www.dumbsplash[.]com/ilto/ . These capabilities make the infection a potential start |
From the original article
3 min read at gbhackers.com
Hackers are distributing XLoader malware through phishing emails disguised as purchase order confirmation requests, using malicious Word attachments to compromise Windows computers. The emails ask recipients to review an attached DOCX file and verify an order. Instead of containing only purchasing information, the document embeds a malicious RTF file that starts a multistage execution sequence […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.