Microsoft Exploit ** OWC10.Spreadsheet ActiveX

Another Microsoft Office Web Components (OWX10.Spreadsheet) (owc10.dll) 0Day ActiveX revealed in wild and spread fast especially in China. The vulnerability named as OWX10.Spreadsheet msDataSourceObject Stack Overflow Exploit.

Malicious link: hxxp://www.fdsdffdfsf.cn/of.htm

After lookup, fdsdffdfsf.cn domain (59.34.198.57) and another few domains were blacklisted.

Other domains:

www.dgfdffdfs.cn

www.fdasfadf.cn

www.eweerwerre.cn

www.45sf8.com

www.520458.com

Content for "a.js"

After decode - malicious link (Trojan) hxxp:///new.exe

According to Virustotal, only 70.74% (29/41) of various scanners able to detect this malware file.

Reference: safelab.spaces.live.com