This ‘Broken’ File Hides Malware Designed to Break Its Targets

guest · Apr 2, 2019

This ‘Broken’ File Hides Malware Designed to Break Its Targets
April 2, 2019
https://cofense.com/broken-file-hides-malware-designed-break-targets/

Cofense IntelligenceTM has identified a phishing campaign with a malicious attachment containing a “broken” file that actually works, in all the wrong ways. Under certain conditions, the file weaponizes in the target environment after evading both automated and manual analysis.

The “break” is the lack of a file header, engineered to fool analysts into thinking the attachment is harmless [...]
In this campaign, the file downloads a script to fix the missing header and then run the full file, if the target environment permits it.

[...] the malicious document drops an embedded object as a partial executable [...] it is only detected by 2/58* antivirus engines on VirusTotal. [...]
When the object is completed by adding the “MZ header,” this detection ratio jumps to 40/71*, demonstrating that the lack of an MZ header confuses automated systems and analysts alike.
Click to expand...

Log in or Sign up

This ‘Broken’ File Hides Malware Designed to Break Its Targets

guest Guest

Log in or Sign up

This ‘Broken’ File Hides Malware Designed to Break Its Targets

guest Guest

Useful Searches