Attachment: Archive with embedded EXE file

calendar Aug 21, 2023  ·
Share on: linkedin copy

Recursively scans files and archives to detect embedded EXE files (with an MZ header).

According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an attack that used this technique to the "special services of the Russian Federation".

The spear-phishing operation urged recipients to download a RAR archive included in the email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe) that tried to pass as a PDF file.

Sublime rule (View on GitHub)

 1name: "Attachment: Archive with embedded EXE file"
 2description: |
 3  Recursively scans files and archives to detect embedded EXE files (with an MZ header).
 4
 5  According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an 
 6  attack that used this technique to the "special services of the Russian Federation".
 7
 8  The spear-phishing operation urged recipients to download a RAR archive included in the 
 9  email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe)
10  that tried to pass as a PDF file.  
11references:
12  - "https://therecord.media/ukraine-warns-of-massive-russian-spear-phishing-campaign/"
13type: "rule"
14severity: "high"
15source: |
16  type.inbound
17  and any(attachments,
18          .file_extension in~ $file_extensions_common_archives
19          and any(file.explode(.), any(.flavors.yara, . == "mz_file"))
20  )  
21attack_types:
22  - "Malware/Ransomware"
23tactics_and_techniques:
24  - "Evasion"
25detection_methods:
26  - "Archive analysis"
27  - "File analysis"
28  - "YARA"
29id: "e2b0ad86-1264-567e-b7c4-78d7ddbe7722"
to-top