Detecting Coercive Lures with OCR

By: Josiah Smith

May 12, 2020

Machine Vision and OCR Matryoshka doll graphic

InQuest Deep File Inspection® (DFI) utilizes machine vision and optical character recognition (OCR) to identify the social engineering component of a variety of malware lures. This is one of the myriads of techniques that we employ to detect novel malware that may leverage previous unseen and undetectable tactics.

Acknowledging that phishing is still the predominant access vector for threat actors to carry out their attacks, it is irresponsible to think that it is possible to “Squish the Phish” or get that “click rate” down to zero. In respect to the colloquial security proverb, “Prevention is ideal, but detection is a must”, InQuest has been following a variety of different techniques used in malicious documents.

On a consistent basis, threat actors are trying to convince the unbeknownst user into “enabling macros” or “enabling content” in order to progress down the attack chain.

Typically, these documents contain a macro called “Auto_Open” or “Document_Open”, but it could really be any one of a dozen or so canonical names that cause Microsoft Office to automatically execute the macro once the document is opened.

Fig 1. Coercion Lure. 4bda1925f9a18e879eec373263b37ae20581403777bbdf899ca8ba1ae3cefbc9

Over the last two years, we have published technical blogs covering in-depth analysis on some techniques used within these maldocs. Generally, they had low AV detection rates and were vehemently obfuscated to cause frustration to analysts and security products.

One successful InQuest signature, “Document Containing Macro Execution Coercion”, is described as Microsoft Office document malware carriers that attempt to coerce the user into activating malicious content through on-screen instruction. In some environments, macros are disabled within Microsoft Office, and therefore malicious macros will not be executed by default. Threat actors use different types of lure messages in an attempt to convince users to enable macros so malicious code can be executed. The severity of this event will increase in the presence of other alerts, for example, those pertaining to automatic macro execution, obfuscation, and other suspicious attributes.

Value of OCR

There is appreciable value returned when combining OCR with the DFI process. After the OCR strips the text from the images, de-facto or user-defined threat detection signatures can alert on the text from within the image. For example, deduced text strings in the form of “enable content ” or “office version isn’t compatible” are frequently used in these documents. Of note, another use case in this scenario could be data-loss detection identifying PII, PHI, PCI, or other sensitive information
InQuest Labs consistently sources the strings found in these lures to keep our signatures up to date. Our user base and in-house security engineers have been commenting on the consistent success with this detection technique.

Fig 2. OCR Derived Text.

Tracking Graphical Assets Based on XMP IDs

InQuest has been tracking the graphical assets used in the malicious documents using Adobe Extensible Metadata Platform (XMP) identifiers (IDs). As described in Adobe XMP: Tales of an Overlooked Anchor, the hashes / GUIDs are used as a standard for mapping graphical asset relationships, XMP allows for tracking of both parent-child relationships and individual revisions. There are three categories of identifiers: original document, document, and instance. Generally, XMP data is stored in XML format, updated on save/copy, and embedded within the graphical asset. The following list of XMP IDs was harvested from the most common graphical lure templates:


    037efa89-9f85-d141-bdcb-7fc208a9471f
    25720195-077c-684a-b376-ddb0eec9490d
    4da1efc4-3be3-db47-ad6a-94bef19999d7
    5a11ba92-5aa2-dd4c-9428-76c6845a42e9
    7d130047-163d-7c4b-ad85-c450be72e18e
    8044e5c8-00df-004b-a352-8ad4178136bf
    9cb60a7b-deba-d647-b8f5-5940685d2ab5
    baebffad-e645-e048-95f1-302ea6696408
    ce1f5951-83ee-0949-a431-1a7ed96b5005
    cf388654-c5b4-264f-b9bf-723c838a6b4d
    e48fd268-0a9f-cb49-b560-b2b7bd429157
    faf5bdd5-ba3d-11da-ad31-d33d75182f1b

Note that the above happen to be all in GUID format, but hash format is plausible as well.

Gallery of Common Graphical Lure Templates

The following gallery of lures was harvested from a variety of malware samples collected over the past 30 days. Common among these lures is that they all capable of evading common detection stacks.

Fig 3. 6bd1f68f097c7ad45edbc1038b7ecdbaab7755c1f5dcd314f9d0c72905daf1da

Fig 4. 3ca2e33efbca17cd1ef1aa5152e7d84bb0bb2d597e70c7265f473fc2089d40ef

Fig 5. 0cea6df5c4d704c6ed962864ea64f453dd13b582f22033e0e1487bd104763cf0

Fig 6. 3a8228f70497cc4d49992ef3fd29ffafd9da7dd9832464fa44b98793d0b19d5e

Fig 7. 8b9eeb92cc9a37e862c59a0fa8afeb54a7be15de3a897c71f7f3f0c871662759e

Fig 8. 8e8da1dd35fcb845d2beb3fcae2ad92520b9c7fcbfab05a1eed919f7a6b08fc0

Fig 9. 130439d9b8a66117b05587c50710be9d35e765139086c73f9d2190a8602bfec5

Fig 10. 482a0d6e274186c70435c4b3c198797c25b2b6657a0bf400090c7989bb87142f

Fig 11. bd97cd47caf2c1d33964b38a8113fd9fc35f5ac557b69c7abe27da7bfd04c77f

Fig 12. c5ec102aa7fe27ca05d4fe532c79fbb1e623fed6273eb00f46e792a4e267a3ef

Fig 13. 820832fd5c46c67d1913f023ec8dbe21e3e69d753af5e56b6c3088fd1c56ac6a

Fig 14. bcb00b6f67396126e1c2f0edd745e3589d10aeae0f744161d6c576312affdd96