The document Xavier spotted uses this technique.
It was delivered via a phishing campaign and called “Order Confirmation 22839.docx” (SHA256:2382d4957569aed12896aa8ca2cc9d2698217e53c9ab5d52799e4ea0920aa9b9).
A frameset was found that is referenced by id ‘rId1’.
References are defined in “.rels”
Note that the payload will be automatically downloaded with interaction with the user.
Just a popup will be displayed
The payload (“92.doc”) is a classic malicious RTF document (SHA256:dd1a1537774ef9680ff376a4baed81c90b11a521ef4c69ffd23edfa59eaa1300).
It downloads the real malware from the following URL: hxxp://107[.]172[.]44[.]187/92/vbc.exe
The malware is a Redline stealer (SHA256:7d2b174c017d61fcd94673c55f730821fbc30d7cf03fb493563a122d73466aab) talking to the following C2 server: 171[.]22[.]30[.]129:54686