{"id":2547,"date":"2016-08-21T14:43:55","date_gmt":"2016-08-21T07:43:55","guid":{"rendered":"https:\/\/humanit.asia\/?p=2547"},"modified":"2019-07-22T14:38:07","modified_gmt":"2019-07-22T07:38:07","slug":"donoff-macro-dropping-ransomware","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/donoff-macro-dropping-ransomware\/","title":{"rendered":"Donoff Macro Dropping Ransomware"},"content":{"rendered":"<div>\n<p>Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff, which downloads the Zepto executable that encrypts all your files and will later ask for payment of the decryption key.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png\"><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-15897 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png\" sizes=\"(max-width: 624px) 100vw, 624px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png 624w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email-300x113.png 300w\" alt=\"donoff malicious macro sample\" width=\"624\" height=\"234\" \/><\/a><\/p>\n<p>We decided to\u00a0take a closer look on the Donoff macro used in downloading the Zepto ransomware. Here\u2019s what we found:<\/p>\n<p><strong>The VBA Macro\u00a0code<\/strong><\/p>\n<p>At first glance, the code is fully commented\u00a0in Spanish and uses some\u00a0random generated\u00a0variable names.<\/p>\n<p>Here\u00a0a look at the\u00a0code:<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1.jpg\"><img decoding=\"async\" class=\"aligncenter wp-image-15903 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1.jpg\" sizes=\"(max-width: 740px) 100vw, 740px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1.jpg 740w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1-300x143.jpg 300w\" alt=\"donoff macro code\" width=\"740\" height=\"353\" \/><\/a><\/p>\n<p><strong>Retrieving Zepto<\/strong><\/p>\n<p>The Word document contains\u00a0two macro functions, <em>autoopen<\/em> and <em>ActualizarEntrada<\/em>.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/macro.png\"><img decoding=\"async\" class=\"aligncenter wp-image-15898 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/macro.png\" sizes=\"(max-width: 334px) 100vw, 334px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/macro.png 334w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/macro-300x242.png 300w\" alt=\"donoff spanish code\" width=\"334\" height=\"269\" \/><\/a><\/p>\n<p>Here are more snips of code showing the processing of obfuscated text.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15904 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2.jpg\" sizes=\"(max-width: 733px) 100vw, 733px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2.jpg 733w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2-300x92.jpg 300w\" alt=\"donoff macro code\" width=\"733\" height=\"226\" \/><\/a><\/p>\n<p>These are the strings revealed after deobfuscation.<\/p>\n<ul>\n<li>XMLHTTP<\/li>\n<li>streaM<\/li>\n<li>Application<\/li>\n<li>shell<\/li>\n<li>Process<\/li>\n<li>GeT<\/li>\n<li>TeMP<\/li>\n<li>Type<\/li>\n<li>open<\/li>\n<li>write<\/li>\n<li>responseBody<\/li>\n<li>savetofile<\/li>\n<li>sysdrubpas.exe<\/li>\n<\/ul>\n<p>This VBScript uses Microsoft.XMLHTTP and Adodb.Stream Objects to download Zepto.<\/p>\n<p>The Microsoft.XMLHTTP object is one of Microsoft\u2019s XML DOM (Document Object Model) modules that is intended to deliver client-side access to XML documents on remote servers through the HTTP protocol. \u00a0This object is used to request or send any type of document.<\/p>\n<p>The ADODB.Stream Object is used to read, write and manage a stream of binary data or text.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-15905\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3.jpg\" sizes=\"(max-width: 721px) 100vw, 721px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3.jpg 721w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3-300x30.jpg 300w\" alt=\"3\" width=\"721\" height=\"73\" \/><\/a><\/p>\n<p>The following code decrypts to<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/x.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15907 alignnone\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/x.png\" sizes=\"(max-width: 332px) 100vw, 332px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/x.png 332w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/x-300x23.png 300w\" alt=\"x\" width=\"332\" height=\"26\" \/><\/a><\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/4.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-15908\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/4.jpg\" sizes=\"(max-width: 753px) 100vw, 753px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/4.jpg 753w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/4-300x84.jpg 300w\" alt=\"4\" width=\"753\" height=\"210\" \/><\/a><\/p>\n<p>Here\u2019s the code that downloads the\u00a0encrypted Zepto executable file.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/5.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-15909\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/5.jpg\" sizes=\"(max-width: 738px) 100vw, 738px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/5.jpg 738w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/5-300x25.jpg 300w\" alt=\"5\" width=\"738\" height=\"61\" \/><\/a><\/p>\n<p>The encrypted file is stored to the file system\u00a0as <em>TempWFDSAdrweg<\/em>. \u00a0It then uses this\u00a0key <em>Aw3WSr7dB3RlPpLVmGVTtXcQ3WG8kQym<\/em>\u00a0to decrypt\u00a0and stores the\u00a0decrypted binary\u00a0to the file\u00a0<em>sysdrubpas.exe<\/em> in the <em>%temp%<\/em> folder. \u00a0%temp% folder is usually the <em>C:UsersAppDataLocalTemp<\/em> folder.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/6.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-15910\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/6.jpg\" sizes=\"(max-width: 710px) 100vw, 710px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/6.jpg 710w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/6-300x58.jpg 300w\" alt=\"6\" width=\"710\" height=\"137\" \/><\/a><\/p>\n<p><strong>Decryption code<\/strong><\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/7.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-15911\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/7.jpg\" sizes=\"(max-width: 745px) 100vw, 745px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/7.jpg 745w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/7-300x99.jpg 300w\" alt=\"7\" width=\"745\" height=\"247\" \/><\/a><\/p>\n<p><strong>Encrypted Zepto (Displayed here in Hexadecimals):<\/strong><\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/encryptedzepto-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15912 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/encryptedzepto-1.png\" sizes=\"(max-width: 554px) 100vw, 554px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/encryptedzepto-1.png 554w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/encryptedzepto-1-300x145.png 300w\" alt=\"encrypted zepto\" width=\"554\" height=\"268\" \/><\/a><\/p>\n<p><strong>Decrypted Zepto (now in Executable form):<\/strong><\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/decryptedzepto-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15913 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/decryptedzepto-1.png\" sizes=\"(max-width: 560px) 100vw, 560px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/decryptedzepto-1.png 560w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/decryptedzepto-1-300x152.png 300w\" alt=\"decrypted zepto\" width=\"560\" height=\"283\" \/><\/a><\/p>\n<p>The script then executes\u00a0<em>sysdrubpas.exe<\/em> infecting the system of the user.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/HELP.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15901 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/HELP.png\" sizes=\"(max-width: 482px) 100vw, 482px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/HELP.png 482w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/HELP-300x265.png 300w\" alt=\"sysdrubpas.exe\" width=\"482\" height=\"425\" \/><\/a><\/p>\n<p><strong>ThreatAnalyzer \u2013 Malware Sandbox Analysis<\/strong><\/p>\n<p>When executed in our malware analysis sandbox ThreatAnalyzer, here\u2019s the process tree caused by the malicious Word document<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15914 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1.png\" sizes=\"(max-width: 1023px) 100vw, 1023px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1.png 1023w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1-300x43.png 300w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/1-768x111.png 768w\" alt=\"donoff analysis\" width=\"1023\" height=\"148\" \/><\/a><\/p>\n<p>The ThreatAnalyzer Behavioral Determination Engine flags this as 100% malicious file and was able to find dozens of\u00a0suspicious behaviors.<a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15915 size-full\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2.png\" sizes=\"(max-width: 454px) 100vw, 454px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2.png 454w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/2-189x300.png 189w\" alt=\"donoff processes\" width=\"454\" height=\"720\" \/><\/a><\/p>\n<p>One notable common behavior of ransomware is how it deletes shadow copies to prevent easy restoration from Windows backup.<\/p>\n<p><a href=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-15916\" src=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3.png\" sizes=\"(max-width: 452px) 100vw, 452px\" srcset=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3.png 452w, https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/3-300x77.png 300w\" alt=\"3\" width=\"452\" height=\"116\" \/><\/a><\/p>\n<p>Other behaviors are very similar to our previous post about Zepto ransomware: \u00a0<a href=\"https:\/\/blog.threattrack.com\/ransomware-packed-into-wsf-spam\/\">https:\/\/blog.threattrack.com\/ransomware-packed-into-wsf-spam\/<\/a>.<\/p>\n<p><strong>Prevent Ransomware Infections?<\/strong><\/p>\n<p>To prevent ransomware, we recommended you block it early from the root of its infection chain. Here are some tips:<\/p>\n<ul>\n<li>Always keep your operating system, applications and security products patched and up to date<\/li>\n<li>Take precaution when opening attachments, especially when sent by an unknown sender<\/li>\n<li>Never enable VBA macros by default for any Microsoft Office application. Some macro malwares even tell you how to enable macros or may mislead you in doing so.<\/li>\n<li>Deploy solutions that protect you from sophisticated and pervasive threats like ransomware, including <a class=\"external\" href=\"https:\/\/www.vipreantivirus.com\/business\/endpoint-security.aspx\" target=\"_blank;do_not_match_current_window_name;_ga=GA1.2.1518663524.1461084063;__roit=0;_ga=GA1.2.1518663524.1461084063;__roiNonDirect=true;\" rel=\"noopener noreferrer\">advanced endpoint protection<\/a> like VIPRE Endpoint Security, a <a href=\"https:\/\/www.threattrack.com\/malware-analysis.aspx\">malware behavior analysis tool<\/a> like ThreatAnalyzer, and solutions to detect and disrupt active cyber attacks like\u00a0<a href=\"https:\/\/www.threattrack.com\/network-security-threats.aspx\">ThreatSecure<\/a><\/li>\n<li>Regularly back up your data<\/li>\n<\/ul>\n<p><strong>HASHES<\/strong><\/p>\n<p>e98aee56175daaa96f259d04077d820f \u2013 malicious DOC attachment (Trojan-Downloader.O97M.Donoff.by (v))<\/p>\n<p>837a5b0dbd5850634bfecadadc751cdd \u2013 Zepto executable (Trojan.Win32.Generic!BT)<\/p>\n<p>Analysis by Wilmina Elizon<\/p>\n<p>The post <a href=\"https:\/\/blog.threattrack.com\/donoff-malicious-macro-zepto\/\" rel=\"nofollow\">Donoff Macro Dropping Ransomware<\/a> appeared first on <a href=\"https:\/\/blog.threattrack.com\/\" rel=\"nofollow\">ThreatTrack Security Labs Blog<\/a>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~r\/threattracksecurity\/~4\/wPNawh8Er7c\" alt=\"\" width=\"1\" height=\"1\" \/><\/p>\n<\/div>\n<p class=\"wpematico_credit\"><small>Powered by <a href=\"http:\/\/www.wpematico.com\" target=\"_blank\" rel=\"noopener noreferrer\">WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently, we\u2019ve spotted Zepto ransomware spreading thro [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[110],"tags":[],"class_list":["post-2547","post","type-post","status-publish","format-standard","hentry","category-security-th"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Donoff Macro Dropping Ransomware - humanit managed services<\/title>\n<meta name=\"description\" content=\"Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/old.humanit.asia\/wpnawh8er7c\/\" \/>\n<meta property=\"og:locale\" content=\"th_TH\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Donoff Macro Dropping Ransomware - humanit managed services\" \/>\n<meta property=\"og:description\" content=\"Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff\" \/>\n<meta property=\"og:url\" content=\"https:\/\/old.humanit.asia\/wpnawh8er7c\/\" \/>\n<meta property=\"og:site_name\" content=\"humanit managed services\" \/>\n<meta property=\"article:published_time\" content=\"2016-08-21T07:43:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-07-22T07:38:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png\" \/>\n<meta name=\"author\" content=\"Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u0e19\u0e32\u0e17\u0e35\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/th\\\/donoff-macro-dropping-ransomware\\\/\"},\"author\":{\"name\":\"Admin\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\"},\"headline\":\"Donoff Macro Dropping Ransomware\",\"datePublished\":\"2016-08-21T07:43:55+00:00\",\"dateModified\":\"2019-07-22T07:38:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/th\\\/donoff-macro-dropping-ransomware\\\/\"},\"wordCount\":553,\"image\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.threattrack.com\\\/wp-content\\\/uploads\\\/2016\\\/08\\\/email.png\",\"articleSection\":[\"Security\"],\"inLanguage\":\"th\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/th\\\/donoff-macro-dropping-ransomware\\\/\",\"url\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/\",\"name\":\"Donoff Macro Dropping Ransomware - humanit managed services\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.threattrack.com\\\/wp-content\\\/uploads\\\/2016\\\/08\\\/email.png\",\"datePublished\":\"2016-08-21T07:43:55+00:00\",\"dateModified\":\"2019-07-22T07:38:07+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\"},\"description\":\"Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#breadcrumb\"},\"inLanguage\":\"th\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"th\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#primaryimage\",\"url\":\"https:\\\/\\\/blog.threattrack.com\\\/wp-content\\\/uploads\\\/2016\\\/08\\\/email.png\",\"contentUrl\":\"https:\\\/\\\/blog.threattrack.com\\\/wp-content\\\/uploads\\\/2016\\\/08\\\/email.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/wpnawh8er7c\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/old.humanit.asia\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Donoff Macro Dropping Ransomware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#website\",\"url\":\"https:\\\/\\\/old.old.humanit.asia\\\/\",\"name\":\"humanit managed services\",\"description\":\"making technology easy\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/old.old.humanit.asia\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"th\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\",\"name\":\"Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"th\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"caption\":\"Admin\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Donoff Macro Dropping Ransomware - humanit managed services","description":"Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/old.humanit.asia\/wpnawh8er7c\/","og_locale":"th_TH","og_type":"article","og_title":"Donoff Macro Dropping Ransomware - humanit managed services","og_description":"Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff","og_url":"https:\/\/old.humanit.asia\/wpnawh8er7c\/","og_site_name":"humanit managed services","article_published_time":"2016-08-21T07:43:55+00:00","article_modified_time":"2019-07-22T07:38:07+00:00","og_image":[{"url":"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png","type":"","width":"","height":""}],"author":"Admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Admin","Est. reading time":"3 \u0e19\u0e32\u0e17\u0e35"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#article","isPartOf":{"@id":"https:\/\/old.humanit.asia\/th\/donoff-macro-dropping-ransomware\/"},"author":{"name":"Admin","@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c"},"headline":"Donoff Macro Dropping Ransomware","datePublished":"2016-08-21T07:43:55+00:00","dateModified":"2019-07-22T07:38:07+00:00","mainEntityOfPage":{"@id":"https:\/\/old.humanit.asia\/th\/donoff-macro-dropping-ransomware\/"},"wordCount":553,"image":{"@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png","articleSection":["Security"],"inLanguage":"th"},{"@type":"WebPage","@id":"https:\/\/old.humanit.asia\/th\/donoff-macro-dropping-ransomware\/","url":"https:\/\/old.humanit.asia\/wpnawh8er7c\/","name":"Donoff Macro Dropping Ransomware - humanit managed services","isPartOf":{"@id":"https:\/\/old.old.humanit.asia\/#website"},"primaryImageOfPage":{"@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#primaryimage"},"image":{"@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png","datePublished":"2016-08-21T07:43:55+00:00","dateModified":"2019-07-22T07:38:07+00:00","author":{"@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c"},"description":"Recently, we\u2019ve spotted Zepto ransomware spreading through spam email containing fake invoices (see image below). These attachments contain a Macro-Enabled word document file known as Donoff","breadcrumb":{"@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#breadcrumb"},"inLanguage":"th","potentialAction":[{"@type":"ReadAction","target":["https:\/\/old.humanit.asia\/wpnawh8er7c\/"]}]},{"@type":"ImageObject","inLanguage":"th","@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#primaryimage","url":"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png","contentUrl":"https:\/\/blog.threattrack.com\/wp-content\/uploads\/2016\/08\/email.png"},{"@type":"BreadcrumbList","@id":"https:\/\/old.humanit.asia\/wpnawh8er7c\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/old.humanit.asia\/"},{"@type":"ListItem","position":2,"name":"Donoff Macro Dropping Ransomware"}]},{"@type":"WebSite","@id":"https:\/\/old.old.humanit.asia\/#website","url":"https:\/\/old.old.humanit.asia\/","name":"humanit managed services","description":"making technology easy","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/old.old.humanit.asia\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"th"},{"@type":"Person","@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c","name":"Admin","image":{"@type":"ImageObject","inLanguage":"th","@id":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","caption":"Admin"}}]}},"_links":{"self":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/comments?post=2547"}],"version-history":[{"count":2,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2547\/revisions"}],"predecessor-version":[{"id":2857,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2547\/revisions\/2857"}],"wp:attachment":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/media?parent=2547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/categories?post=2547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/tags?post=2547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}