New, unusual targeted attack against MS Office in the wild

Symantec Corporation warns users about a new targeted attack against Office, potentially capable of exploiting an already patched vulnerability found in the most recent editions of the popular productivity suite published by Microsoft.

The trojan detected by the security enterprise (Trojan.Activehijack) comes as an archive attached to a malicious (likely spam) e-mail, and is crafted to exploit one of the vulnerabilities described in the MS11-073 Security Bulletin published on September 2011. The affected software suites include MS Office 2003 (SP3), Office 2007 (SP2) and Office 2010.

The already patched flaw is exploited in a way that is unusual among targeted attacks, Symantec explains: while previously identified attacks come as a single document file containing the exploit, this new one arrives as a pair of files – a Word document and a .dll library file.

Once a user opens the infected document with an unprotected version of Word, an ActiveX control embedded in the document runs and calls the external library which has the same name of the legitimate Microsoft Office FrontPage Client Utility Library (“fputlsat.dll”).

If the exploit is successful, the infected document drops the malware onto the system and deletes the fputlsat.dll library. In its place, Trojan.Activehijack creates a “Thumbs.db” file – a perfect disguise with the same name of the (normally “hidden”) file used by Windows XP to store thumbnails for image files contained in a folder.

Symantec recommends to install all the available patches for productivity software and warns users against opening unwanted or unrequested attachments coming through the mailbox – especially those contained in zipped archives and escorted by a mysterious .dll file.