Trusted Design

20160204: CVE-2014-4114 Sandworm is not a WORM

概要

Cyphort labs team found that the exploit payload involved in this case is a PowerPoint Open XML Slide Show file named spiski_deputatov_done.ppsx. Translated from Russian this name means “complete list of Members of Parliament”. This seems related to the upcoming Ukrainian Parliamentary Elections that are scheduled for October 26, 2014. The PPS file contains an embedded OLE object that allows it to download and execute a remote file. Once the PPS file is opened, it will download the two files then executes slides.inf. Slides.inf then renames slide1.gif to slide1.gif.exe and creates a RunOnce entry to execute it at the next system startup. Slide1.gif.exe is a variant of BlackEnergy Trojan, a known backdoor, which has been seen in the wild at least since 2010.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• TrojanSpy:MSIL/Majikpos (score: 0.56)
• Targeted Attacks against Tibetan and Hong Kong Groups (score: 0.55)
• Angler EK leads to fileless Gootkit (score: 0.55)
• FIREEYE: Office Encapsulated PostScript & Priv Escalation 0days (score: 0.55)
• Angler EK installs bedep, vawtrak and POS malware (score: 0.55)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る