Malware Leverages Curiosity About Mayan Apocalypse

By Ken Presti, CRN 2:38 PM EST Fri. Dec. 21, 2012

Today is the day of the Mayan-predicted apocalypse. Since you have clicked on the link to read this story, we will go out on a limb and say that the end of the world has not yet come.

But other links are apparently not so benign.

Sophos Labs has uncovered "a booby-trapped" Powerpoint presentation entitled, "Will the World End in 2012."

[Related: The 10 Biggest Security Stories Of 2012]

According to Sophos Lab researchers, this attack is similar to another malware atstack that purports to be an Excel-based Sudoku puzzle.

"Like the Excel spreadsheet, this file contained Visual Basic macro code that drops an executable file called VBA[X].exe, where [X] is a random capital letter," blogged Chester Wisniewski, senior security advisor at Sophos. "Also like the Sudoku generator, this sample required the user to enable macros, but didn't include the helpful tip on how to do it or really any good reason you might need a macro to learn about the end times."

Wisniewski explained that the macros are designed to construct a valid Windows portable executable file that functions as a dropper which extracts a second file that downloads a picture of an owl and contacts the command and control server.

"It is designed to download another payload it will rename as Wmupdate.exe, but during our testing no instructions were sent from the command-and-control server to retrieve this payload," he wrote.