XLoader (v8.9) infostealer delivered via purchase-order phishing DOCX exploiting CVE-2017-11882

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5919 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XLoader TL-2026-5919 — Office/Equation Editor Spawns cmd/cscript VBS Dropper (CVE-2017-11882)

Detects the exploitation stage of the XLoader 8.9 purchase-order campaign: the RTF embedded via DOCX altChunk exploits CVE-2017-11882 and EQNEDT32.EXE or WINWORD.EXE spawns 'CmD.exe /C cscript %tmp%\724812.vbs'. Alerts on any EQNEDT32.EXE child shell/script host, on the known 724812.vbs / Quisque.Dal artifacts, and on Word launching a VBS from the Temp directory.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1204.002, T1059.003, T1059.005
• Data sources: sysmon, microsoft_defender_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
EventCode=1 earliest=-24h
(ParentImage="*\\EQNEDT32.EXE" OR ParentImage="*\\WINWORD.EXE")
(Image="*\\cmd.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\powershell.exe")
```comment
Equation Editor (EQNEDT32.EXE) should never spawn shells; Word only matters when the child runs the campaign VBS
```
| eval cmd=lower(coalesce(CommandLine,""))
| eval eqnedt_parent=if(like(lower(ParentImage),"%eqnedt32.exe"),1,0)
| eval known_ioc=if(match(cmd,"724812\\.vbs|quisque\\.dal"),1,0)
| eval vbs_from_tmp=if(match(cmd,"(cscript|wscript).*(%tmp%|%temp%|\\\\temp\\\\).*\\.vbs"),1,0)
| where eqnedt_parent=1 OR known_ioc=1 OR vbs_from_tmp=1
| fillnull value="unknown" User ParentCommandLine
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_cmd by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("eqnedt32.exe", "winword.exe")
| where FileName in~ ("cmd.exe", "cscript.exe", "wscript.exe", "powershell.exe")
| where InitiatingProcessFileName =~ "eqnedt32.exe"
    or ProcessCommandLine matches regex @"(?i)724812\.vbs|Quisque\.Dal"
    or (ProcessCommandLine matches regex @"(?i)(cscript|wscript)" and ProcessCommandLine contains ".vbs" and ProcessCommandLine matches regex @"(?i)(%tmp%|%temp%|\\temp\\)")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: Office or Equation Editor Spawning cmd or cscript VBS Dropper - XLoader TL-2026-5919
id: 3b8f2a64-7c1d-4e59-9a0b-5d2c8e71f401
status: experimental
description: 'Detects EQNEDT32.EXE (CVE-2017-11882) or WINWORD.EXE spawning cmd/cscript/wscript/powershell, including the XLoader 8.9 dropper command cscript %tmp%\724812.vbs.'
references:
    - https://asec.ahnlab.com/en/96513/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-11882
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.execution
    - attack.t1566.001
    - attack.t1203
    - attack.t1204.002
    - attack.t1059.003
    - attack.t1059.005
    - cve.2017-11882
logsource:
    category: process_creation
    product: windows
detection:
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\powershell.exe'
    selection_eqn:
        ParentImage|endswith: '\EQNEDT32.EXE'
    selection_word:
        ParentImage|endswith: '\WINWORD.EXE'
    selection_ioc:
        CommandLine|contains:
            - '724812.vbs'
            - 'Quisque.Dal'
    selection_vbs:
        CommandLine|contains|all:
            - 'cscript'
            - '.vbs'
    selection_tmp:
        CommandLine|contains:
            - '%tmp%'
            - '%temp%'
            - '\AppData\Local\Temp\'
    condition: selection_child and (selection_eqn or (selection_word and (selection_ioc or (selection_vbs and selection_tmp))))
falsepositives:
    - 'Legacy documents using Equation 3.0 objects on unpatched Office builds'
    - 'Word macros or add-ins legitimately launching cmd for document automation'
level: high

Known false positives:

• Legacy documents with Equation 3.0 objects opened on very old Office builds (EQNEDT32.EXE was removed by KB4011730 in January 2018)
• Word add-ins or document-automation macros that legitimately start cmd.exe or cscript against Temp

Tuning notes: Restrict the WINWORD.EXE branch to child command lines running .vbs from Temp if your environment has benign Word-to-cmd automation. Any EQNEDT32.EXE child is high fidelity and should not be suppressed. Add EXCEL.EXE and POWERPNT.EXE as parents if Office-wide coverage is wanted.

• 🔒 XLoader TL-2026-5919 — Dropper Staging of 724812.vbs and Quisque.Dal in Temp · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — Hidden PowerShell Re-executing Script Stored in AppDataLow · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — Script Host or Equation Editor Outbound Web Connection · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — Equation Editor (EQNEDT32.EXE) Launch, CVE-2017-11882 · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — PowerShell Script Block Decoding Quisque.Dal / XOR Loader Staging · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — Proxy or Gateway Traffic to dumbsplash.com C2 URL · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — HKCU Registry Persistence TORO / Laboris / Cupidatat · unlock with TL Creds
• 🔒 XLoader TL-2026-5919 — C2 Domain [indicator] DNS and Connection · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5919.

Sample indicators (3 of 21)

• Domain: www[.]dumbsplash[.]com
• File hash: 5bd3c5f273ba5ae4c4ae745c6943a4f7
• File hash: 8b3542531d98a47524c0f468d0158996

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

Technical analysis

AhnLab ASEC (published 2026-11-12) reported an in-the-wild phishing campaign that lures recipients with a request to confirm a purchase order. The attachment is a DOCX that uses Word's 'Import Content from Another Document' (altChunk) feature to pull in an embedded malicious RTF. The RTF contains an OLE object that exploits CVE-2017-11882, the long-patched Microsoft Equation Editor memory-corruption flaw (CWE-119). While Word processes the RTF, a VBS file is dropped to %TMP%\724812.vbs and executed through 'CmD.exe /C cscript %tmp%\724812.vbs'.

The VBS dropper Base64-decodes embedded data into %TMP%\Quisque.Dal and runs the first-stage PowerShell script contained in it. The decoded Quisque.Dal is a composite file: a 0x285-byte loader at offset 0x0, an encrypted payload (0x577F8 bytes) at 0x285, and a secondary PowerShell script (0x4F1B bytes) at 0x57A7D. Stage 1 PowerShell establishes persistence, decrypts Quisque.Dal and launches the second-stage PowerShell, which invokes the loader and passes the encrypted payload as an argument. The loader XOR-decrypts the payload using key 0x6B506102 and executes it in memory without writing it to disk.

Persistence is implemented entirely in the current-user registry: HKCU\Environment value 'TORO' holds the PowerShell.exe path, HKCU\SOFTWARE\AppDataLow value 'Laboris' stores the primary PowerShell script, and the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value 'Cupidatat' runs '%TORO% -w 1 $inwindi=(Get-ItemProperty -Path ''HKCU:\SOFTWARE\AppDataLow\'').Laboris;%TORO% ($inwindi)' at each logon, giving a hidden-window, file-light re-execution of the stored script.

The final payload is identified by ASEC as XLoader version 8.9, an infostealer that collects PC details and browser data and can also download additional malware. The only network indicator published is the C2 URL http://www.dumbsplash.com/ilto/. The source states no attribution and no CVSS for the campaign; the CVSS shown is the NVD v3.1 score for CVE-2017-11882. A comparable earlier ASEC report (2025-04-25) described a similar purchase-order DOCX/RTF chain using a Client.vbe dropper, HorusProtector packing and RegAsm.exe injection; the 2026 chain differs in using altChunk, a VBS dropper and the Quisque.Dal/XOR loader. Defenders should treat Word documents containing altChunk references, embedded RTF/OLE objects, cmd.exe spawning cscript against %TMP%, and Run-key entries invoking PowerShell with '-w 1' as high risk.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1203 Exploitation for Client Execution; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery

defense-impairment

T1112 Modify Registry

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Password Stores

Initial Access

T1566.001 Spearphishing Attachment

Remediation

Patches

• Apply Microsoft's November 2017 security update for CVE-2017-11882 (Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016)

Immediate actions

• Block www.dumbsplash.com and the URL http://www.dumbsplash.com/ilto/ at proxy/DNS
• Hunt for %TMP%\724812.vbs, %TMP%\Quisque.Dal and the HKCU registry values TORO, Laboris and Cupidatat; isolate and reimage matching hosts
• Quarantine inbound DOCX attachments containing altChunk references or embedded RTF/OLE objects; verify sender domains before opening purchase-order attachments
• Reset browser-saved and session credentials on any host where the chain executed

Workarounds

• Disable the Equation Editor component (EQNEDT32.EXE) via compatibility/registry kill bit where it cannot be patched
• Use Protected View and block RTF content from untrusted sources

Longer-term hardening

• Alert on cmd.exe spawning cscript/wscript against files in %TMP% and on winword.exe child processes
• Alert on HKCU Run entries invoking PowerShell with -w 1 and on new HKCU\Environment values or large AppDataLow values
• Deploy EDR with in-memory/behavioral detection for PowerShell-driven loaders
• Enable Attack Surface Reduction rules blocking Office from creating child processes

Affected and fixed versions

• Microsoft — Office (Equation Editor EQNEDT32.EXE)
  Vulnerable versions: Office 2007 SP3; Office 2010 SP2; Office 2013 SP1; Office 2016 (unpatched)
  Fixed in: Microsoft November 2017 security update

Timeline

Last updated 2026-11-13 · revalidated 1× · latest source

• 2017-11-14 Microsoft addresses the Equation Editor memory-corruption flaw CVE-2017-11882 in its November 2017 security updates.
• 2017-11-15 CVE-2017-11882 published in NVD (CVSS v3.1 7.8, CWE-119) affecting Office 2007 SP3, 2010 SP2, 2013 SP1 and 2016.
• 2018-01-09 Microsoft's January 2018 update (KB4011730) removes EQNEDT32.EXE from Office entirely after the related CVE-2018-0802 flaw was found, rather than patching the component further.
• 2020-02-06 Check Point reports XLoader, the successor to the Formbook infostealer, was first advertised for sale on an underground forum on 2020-02-06.
• 2021-11-03 CVE-2017-11882 is listed in the CISA Known Exploited Vulnerabilities catalog.
• 2025-04-25 AhnLab ASEC reports an earlier XLoader campaign using purchase-order DOCX with embedded RTF exploiting CVE-2017-11882, a Client.vbe dropper and HorusProtector packing.
• 2026-11-12 AhnLab ASEC publishes analysis of the altChunk DOCX -> RTF -> CVE-2017-11882 -> VBS -> PowerShell -> in-memory XLoader 8.9 chain with C2 locked-ioc-12.
• 2026-11-13 Cyber Security News reports the campaign, naming the lure attachment locked-ioc-17, the embedded locked-ioc-18, the C2 URL and file/registry artifacts.

Update history

• 2026-11-13 — XLoader 8.9 Delivered via Fake Purchase Order Emails and Malicious Word Documents Exploiting CVE-2017-11882: What changed No severity, exploitability or status change; existing HIGH / ACTIVE values already match the newer report. New indicators (5) Indicator values are withheld at this access level.

Sources cited

• NVD - CVE-2017-11882 NVD (NIST) · Advisory · 2017-11-15
• CISA Known Exploited Vulnerabilities Catalog - CVE-2017-11882 CISA · Government advisory · 2021-11-03
• CERT/CC Vulnerability Note VU#421280 CERT/CC · Advisory · 2017-11-15
• Beware of phishing emails disguised as purchase order confirmation requests (Xloader) asec.ahnlab.com · Research · 2026-11-12
• XLoader Info-stealer Distributed Using MS Equation Editor Vulnerability (CVE-2017-11882) asec.ahnlab.com · Research · 2025-04-25
• Microsoft MSRC advisory CVE-2017-11882 Microsoft Security Response Center · Vendor report · 2017-11-14
• Unit 42: Analysis of CVE-2017-11882 exploit in the wild Palo Alto Networks · Research · 2017-12-01
• Check Point Research: Stealth is never enough - revealing Formbook successor XLoader's C&C infrastructure Check Point Research · Research · 2021-08-01
• 0patch: The Bug That Killed Equation Editor (CVE-2018-0802) 0patch.com · Research · 2018-01-16
• Threatpost: Microsoft Patches 17-Year-Old Office Bug threatpost.com · News · 2017-11-14
• Rewterz: Hackers use MS Equation Editor flaw to deploy XLoader rewterz.com · News · 2025-04-28

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Other reports on CVE-2017-11882

• Common default passwords used to protect malware-sample archives and encrypted malicious documents (Hexacorn research, incl. Excel VelvetSweatshop)
• Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag)
• Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
• CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against Ukraine

Other reports on CVE-2018-0802

• Cloud Atlas APT — termsrv.dll Byte-Patch for Multi-Session RDP, PowerCloud/PowerShower/VBCloud Chain, RevSocks + Reverse SSH Tunnels Targeting Russian and Belarusian Government

Previous and next in malware

• SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT via HTA and DLL side-loading Previous report
• Macfinger ClickFix campaign delivers DownTheDRAIN crypto-draining infostealer for macOS Next report