# XLoader (v8.9) infostealer delivered via purchase-order phishing DOCX exploiting CVE-2017-11882

> Phishing emails disguised as purchase order confirmation requests carry a DOCX that uses Word's altChunk feature to load an embedded RTF exploiting CVE-2017-11882 (Equation Editor). The exploit drops and runs a VBS that launches two PowerShell stages and a loader, which XOR-decrypts and executes XLoader 8.9 in memory to steal system and browser data.

- **Published:** 2026-11-13T03:00:07Z
- **Last reviewed:** 2026-11-13T19:43:59.649Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5919
- **ID:** TL-2026-5919
- **Severity:** HIGH (CVSS 7.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)
- **CVEs:** CVE-2017-11882, CVE-2018-0802

## Description

AhnLab ASEC (published 2026-11-12) reported an in-the-wild phishing campaign that lures recipients with a request to confirm a purchase order. The attachment is a DOCX that uses Word's 'Import Content from Another Document' (altChunk) feature to pull in an embedded malicious RTF. The RTF contains an OLE object that exploits CVE-2017-11882, the long-patched Microsoft Equation Editor memory-corruption flaw (CWE-119). While Word processes the RTF, a VBS file is dropped to %TMP%\724812.vbs and executed through 'CmD.exe /C cscript %tmp%\724812.vbs'.

The VBS dropper Base64-decodes embedded data into %TMP%\Quisque.Dal and runs the first-stage PowerShell script contained in it. The decoded Quisque.Dal is a composite file: a 0x285-byte loader at offset 0x0, an encrypted payload (0x577F8 bytes) at 0x285, and a secondary PowerShell script (0x4F1B bytes) at 0x57A7D. Stage 1 PowerShell establishes persistence, decrypts Quisque.Dal and launches the second-stage PowerShell, which invokes the loader and passes the encrypted payload as an argument. The loader XOR-decrypts the payload using key 0x6B506102 and executes it in memory without writing it to disk.

Persistence is implemented entirely in the current-user registry: HKCU\Environment value 'TORO' holds the PowerShell.exe path, HKCU\SOFTWARE\AppDataLow value 'Laboris' stores the primary PowerShell script, and the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value 'Cupidatat' runs '%TORO% -w 1 $inwindi=(Get-ItemProperty -Path ''HKCU:\SOFTWARE\AppDataLow\'').Laboris;%TORO% ($inwindi)' at each logon, giving a hidden-window, file-light re-execution of the stored script.

The final payload is identified by ASEC as XLoader version 8.9, an infostealer that collects PC details and browser data and can also download additional malware. The only network indicator published is the C2 URL http://www.dumbsplash.com/ilto/. The source states no attribution and no CVSS for the campaign; the CVSS shown is the NVD v3.1 score for CVE-2017-11882. A comparable earlier ASEC report (2025-04-25) described a similar purchase-order DOCX/RTF chain using a Client.vbe dropper, HorusProtector packing and RegAsm.exe injection; the 2026 chain differs in using altChunk, a VBS dropper and the Quisque.Dal/XOR loader. Defenders should treat Word documents containing altChunk references, embedded RTF/OLE objects, cmd.exe spawning cscript against %TMP%, and Run-key entries invoking PowerShell with '-w 1' as high risk.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1112 Modify Registry
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1555.003 Credentials from Password Stores
- T1105 Ingress Tool Transfer
- T1027.013 Obfuscated Files or Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**XLoader TL-2026-5919 — Office/Equation Editor Spawns cmd/cscript VBS Dropper (CVE-2017-11882)** (`TL-2026-5919-SPL-001`)

Detects the exploitation stage of the XLoader 8.9 purchase-order campaign: the RTF embedded via DOCX altChunk exploits CVE-2017-11882 and EQNEDT32.EXE or WINWORD.EXE spawns 'CmD.exe /C cscript %tmp%\724812.vbs'. Alerts on any EQNEDT32.EXE child shell/script host, on the known 724812.vbs / Quisque.Dal artifacts, and on Word launching a VBS from the Temp directory.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204.002, T1059.003, T1059.005
- **Data sources:** sysmon, microsoft_defender_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
EventCode=1 earliest=-24h
(ParentImage="*\\EQNEDT32.EXE" OR ParentImage="*\\WINWORD.EXE")
(Image="*\\cmd.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\powershell.exe")
```comment
Equation Editor (EQNEDT32.EXE) should never spawn shells; Word only matters when the child runs the campaign VBS
```
| eval cmd=lower(coalesce(CommandLine,""))
| eval eqnedt_parent=if(like(lower(ParentImage),"%eqnedt32.exe"),1,0)
| eval known_ioc=if(match(cmd,"724812\\.vbs|quisque\\.dal"),1,0)
| eval vbs_from_tmp=if(match(cmd,"(cscript|wscript).*(%tmp%|%temp%|\\\\temp\\\\).*\\.vbs"),1,0)
| where eqnedt_parent=1 OR known_ioc=1 OR vbs_from_tmp=1
| fillnull value="unknown" User ParentCommandLine
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_cmd by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("eqnedt32.exe", "winword.exe")
| where FileName in~ ("cmd.exe", "cscript.exe", "wscript.exe", "powershell.exe")
| where InitiatingProcessFileName =~ "eqnedt32.exe"
    or ProcessCommandLine matches regex @"(?i)724812\.vbs|Quisque\.Dal"
    or (ProcessCommandLine matches regex @"(?i)(cscript|wscript)" and ProcessCommandLine contains ".vbs" and ProcessCommandLine matches regex @"(?i)(%tmp%|%temp%|\\temp\\)")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Office or Equation Editor Spawning cmd or cscript VBS Dropper - XLoader TL-2026-5919
id: 3b8f2a64-7c1d-4e59-9a0b-5d2c8e71f401
status: experimental
description: 'Detects EQNEDT32.EXE (CVE-2017-11882) or WINWORD.EXE spawning cmd/cscript/wscript/powershell, including the XLoader 8.9 dropper command cscript %tmp%\724812.vbs.'
references:
    - https://asec.ahnlab.com/en/96513/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-11882
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.execution
    - attack.t1566.001
    - attack.t1203
    - attack.t1204.002
    - attack.t1059.003
    - attack.t1059.005
    - cve.2017-11882
logsource:
    category: process_creation
    product: windows
detection:
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\powershell.exe'
    selection_eqn:
        ParentImage|endswith: '\EQNEDT32.EXE'
    selection_word:
        ParentImage|endswith: '\WINWORD.EXE'
    selection_ioc:
        CommandLine|contains:
            - '724812.vbs'
            - 'Quisque.Dal'
    selection_vbs:
        CommandLine|contains|all:
            - 'cscript'
            - '.vbs'
    selection_tmp:
        CommandLine|contains:
            - '%tmp%'
            - '%temp%'
            - '\AppData\Local\Temp\'
    condition: selection_child and (selection_eqn or (selection_word and (selection_ioc or (selection_vbs and selection_tmp))))
falsepositives:
    - 'Legacy documents using Equation 3.0 objects on unpatched Office builds'
    - 'Word macros or add-ins legitimately launching cmd for document automation'
level: high

```

**Known false positives:**

- Legacy documents with Equation 3.0 objects opened on very old Office builds (EQNEDT32.EXE was removed by KB4011730 in January 2018)
- Word add-ins or document-automation macros that legitimately start cmd.exe or cscript against Temp

**Tuning notes:** Restrict the WINWORD.EXE branch to child command lines running .vbs from Temp if your environment has benign Word-to-cmd automation. Any EQNEDT32.EXE child is high fidelity and should not be suppressed. Add EXCEL.EXE and POWERPNT.EXE as parents if Office-wide coverage is wanted.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- XLoader TL-2026-5919 — Dropper Staging of 724812.vbs and Quisque.Dal in Temp (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — Hidden PowerShell Re-executing Script Stored in AppDataLow (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — Script Host or Equation Editor Outbound Web Connection (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — Equation Editor (EQNEDT32.EXE) Launch, CVE-2017-11882 (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — PowerShell Script Block Decoding Quisque.Dal / XOR Loader Staging (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — Proxy or Gateway Traffic to dumbsplash.com C2 URL (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — HKCU Registry Persistence TORO / Laboris / Cupidatat (locked: unlock with TL Creds)
- XLoader TL-2026-5919 — C2 Domain [indicator] DNS and Connection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `www[.]dumbsplash[.]com`
- File hash: `5bd3c5f273ba5ae4c4ae745c6943a4f7`
- File hash: `8b3542531d98a47524c0f468d0158996`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Beware of phishing emails disguised as purchase order confirmation requests (Xloader)](https://asec.ahnlab.com/en/96513/)
- [XLoader Info-stealer Distributed Using MS Equation Editor Vulnerability (CVE-2017-11882)](https://asec.ahnlab.com/en/87724/)
- [NVD - CVE-2017-11882](https://nvd.nist.gov/vuln/detail/CVE-2017-11882)
- [Microsoft MSRC advisory CVE-2017-11882](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2017-11882](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882)
- [CERT/CC Vulnerability Note VU#421280](https://www.kb.cert.org/vuls/id/421280)
- [Unit 42: Analysis of CVE-2017-11882 exploit in the wild](https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/)
- [Check Point Research: Stealth is never enough - revealing Formbook successor XLoader's C&C infrastructure](https://research.checkpoint.com/2021/stealth-is-never-enough-or-revealing-formbook-successors-cc-infrastructure/)
- [Threatpost: Microsoft Patches 17-Year-Old Office Bug](https://threatpost.com/microsoft-patches-17-year-old-office-bug/128904)
- [0patch: The Bug That Killed Equation Editor (CVE-2018-0802)](https://0patch.com/blog/the-bug-that-killed-equation-editor-how)
- [Rewterz: Hackers use MS Equation Editor flaw to deploy XLoader](https://rewterz.com/threat-advisory/hackers-use-ms-equation-editor-flaw-to-deploy-xloader)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5919