[clamav-users] Quick question...

[Eric Tykwinski]

Ran it through LibreOffice to extract anything, but I’m not an expert.
Only thing I saw was a suspicious macro:
https://pastebin.com/5Mdfjy3m <https://pastebin.com/5Mdfjy3m>

Submitted to Talos, so if they find something more, I hope it helps.

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

> On Nov 9, 2017, at 7:26 PM, Al Varnell <alvarnell at mac.com> wrote:
> 
> On Nov 9, 2017, at 3:23 PM, Eric Tykwinski  wrote:
>> Does anyone know if the DDE payloads in Word documents are getting caught?
>> 
>> I had a customer with a very strange virus, basically it downloaded his inbox and was responding to recipients with an attached Word document.
>> This was coming from a botnet with the "EHLO localhost” signature.  Spam filters are catching them from SPF, and I haven’t yet analyzed the attachment, so it might just be junk.
>> 
>> Sincerely,
>> 
>> Eric Tykwinski
> 
> For those who have not seen the warning:
> https://technet.microsoft.com/en-us/library/security/4053440.aspx
> 
> 
> Sent from my iPhone
> 
> -Al-
> -- 
> Al Varnell
> Mountain View, CA_______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml