Worm Charming: Harvesting Malware Lures for Fun and Profit

## Overview

In the presentation *"Worm Charming: Harvesting Malware Lures for Fun and Profit,"* Pedram Amini (from InQuest) discusses the methodology of collecting and sifting through vast amounts of daily malware uploads to isolate high-value, interesting attack lures and potential zero-day exploits. Drawing an analogy to the East Texas sport of "worm charming"—in which competitors vibrate or thump the ground to drive worms to the surface—Amini demonstrates how defenders can use targeted filtering rules and syntactic anomalies to coax stealthy or experimental malware lures out of massive data streams.

## Attack Lures and Collection Sources

Amini notes that while writing chained software exploits is costly and time-intensive, attackers frequently achieve initial compromise by attacking endpoints and end users via malicious document attachments (e.g., Office documents, PDFs, Java, Flash) or drive-by downloads. Notable threat vectors include: - **Encapsulated/Matryoshka Lures:** Layering payloads inside documents (such as Flash embedded in documents delivered via email) to evade sandbox detonation while requiring user interaction. - **Abuse of Features:** Exploiting Microsoft Dynamic Data Exchange (DDE) for command execution, or relying on uninformed user consent (e.g., enabling malicious macros). - **Metadata Payloads:** Embedding base64-encoded executables directly inside file metadata that macros pivot to and launch.

Researchers can harvest samples from sources such as open sandboxes (Hybrid Analysis, Any.Run), enterprise email spools, attacker infrastructure tracking (monitoring domain registrations, reverse DNS, shared SSL certificate IDs, Google Analytics tracking IDs, and Shodan/Censys searches), or VirusTotal Intelligence (VTI).

## Sifting the Corpus: Filtering Rules & Metrics

Addressing the daily volume on VirusTotal—approximately 1.2 to 1.3 million uploads per day (around 1 million distinct, ~409,000 newly seen, and ~400,000 malicious)—Amini highlights the challenge of manual analysis across the roughly 470,000 daily documents and lures (e.g., 400,000 PDFs, 40,000 Office docs, 15,000 Java files).

To reduce this dataset to a manageable volume, defenders deploy specialized YARA hunting rules against incoming feeds: - **Macro-bearing Documents:** Matches documents with macros regardless of classification (~1,000 samples/day). - **ActiveX or AV Detections:** Identifies Office documents embedding ActiveX or having at least one positive antivirus detection (~500 samples/day). - **Active Content in PDFs, RTFs, and Java:** Captures Java files of interest (~500/day), RTFs (~20–50/day), PDFs containing JavaScript/active content, and documents embedding Flash.

Applying these heuristics narrows the daily intake from over 1.2 million samples down to roughly 2,500 lures per day (less than 1% of the original volume).

## Surface Vibrations: Exploiting Parser Tolerance and Evasion Anomaly

To isolate high-fidelity targets within the filtered subset, defenders search for structural anomalies that indicate manual file crafting or deliberate evasion: - **Parser Robustness vs. Strict Signatures:** Attackers exploit the leniency of Microsoft parsers. For example, standard RTF files begin with `{\rtf1`, but the Microsoft parser will successfully open files beginning simply with `{\rt`. Security tools relying on strict MIME typing or full-header magic signatures fail to recognize these as RTF, allowing them to slip past standard detections. - **Anomalous Features as Detection Signals:** When malware authors modify headers (comparable to concepts from the "Tiny PE" project) or deploy unconventional obfuscation to evade static checks, they inadvertently create distinct signatures. These structural deviations stand out against benign software, providing defenders with high-signal indicators to catch experimental malware campaigns and early zero-days before full production rollout.