Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.









  























!

(U)!The!whitelist!and!blacklist!functionality!was!not!implemented!(though,!it!would!be!trivial!to!
do!so)!and!efforts!focused!on!handling!IHTMLDocument2!events!within!the!frames.!
Unfortunately,!we!were!unable!to!find!any!reference!to!the!IID_IHTMLDocument2!interface!of!
the!page!by!calling!the!QueryInterface()!method!of!the!IDispatch!pointer.!Because!of!this,!we!
were!unable!to!link!our!HTMLDocument2!Sink!implementation!using!the!IConnectionPoint!
interface.!
(U)!Research!suggests!that!the!IWebBrowser2!interface!is!able!to!enumerate!the!fields!in!a!
similar!manner,!but!would!require!refactoring!the!alreadyNworking!code!detailed!above.!
Unfortunately,!the!Web!Form!Scraping!portion!of!Sinowal!appears!to!hinge!on!creating!a!
DIID_HTMLDocumentEvents2!Sink!which!is!derived!from!the!IID_IHTMLDocument2!interface!
that!we!cannot!obtain.!!








!

(U)!An!excerpt!from!the!Virus!Bulletin!report,!shown!in!Figure'4,!describes!the!middle!portion!of!
the!technique!that!we!are!unable!to!get!functioning.!Although!two!further!IDispatch!interfaces!
are!enumerated!(i.e.,!IHTMLElement2,!DIID_HTMLInputTextElementEvents),!the!remaining!
functionality!(assuming!we!encounter!no!further!problems!finding!a!reference)!is!trivial!to!
implement.!

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh