{"id":3478,"date":"2010-10-19T11:43:00","date_gmt":"2010-10-19T18:43:00","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=3478"},"modified":"2024-01-24T14:00:07","modified_gmt":"2024-01-24T21:00:07","slug":"just-what-the-heck-am-i-supposed-to-do-with-this","status":"publish","type":"post","link":"https://www.webroot.com/blog/2010\/10\/19\/just-what-the-heck-am-i-supposed-to-do-with-this\/","title":{"rendered":"Hey Malware Guy: Just What the Heck Am I Supposed to Do With This?"},"content":{"rendered":"

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>The Tacticlol<\/strong> downloader, responsible for a lot of infections over the past year<\/a>, propagates in two ways: via drive-by downloads, and as a .zip archive attached to messages. Maybe the spam filtering companies finally caught on to the trick, or maybe the Tacticlol distributors are just trying to mix it up, but the latest sample to come over the transom has me scratching my head.<\/p>\n

Like most others, this sample came attached to an email made to look like a message that UPS would never send. Once again, the message tries to convince the recipient that the attached file is a shipping label the recipient needs to open and print before he or she can “receive the parcel.” And, as always, the attachment contains an executable installer for the Trojan.<\/p>\n

\n
Dear customer\n\nYour parcel has arrived at the post office on October 9. Our\nDriver was unable to deliver the parcel to your address.\nTo receive a parcel you must go to the nearest UPS office and\nshow your mailing label.\nMailing label is attached to this letter.\n\nYou need to print mailing label, and show it in UPS office to\nreceive the parcel.\n\nThank you for your attention.\nUPS International Services.<\/pre>\n<\/blockquote>\n
But this time, instead of sending a .zip archive with a .zip extension<\/em>, they sent a message with a .zip archive that has a .jpg extension<\/em>. And, yeah, that just doesn’t work.<\/p>\n
The file isn’t a JPEG image file. If you try to open it in a browser or an image editor, the editor simply errors out and tells you it isn’t an image file, and the story ends right there. I’m sure some Russian malware distributor has been double-facepalming<\/a> over the waste of a perfectly good scam. Social engineering: You’re doing it wrong.<\/p>\n
\"\"<\/a><\/p>\n
However, if you’re a curious malware researcher, you just open the file in an editor and see the PK in the file header, and realize you’re dealing with an archive. (“PK” — as in PK-Zip<\/a> — is always the first two characters in a .zip archive.)<\/p>\n
\"\"<\/a><\/p>\n
Confirming this using a tool like GT2, I could see the file name of the real payload inside the archive looks achingly familiar: Label_UPS_Nr343.exe<\/strong><\/p>\n
They’re still using “Nr<\/strong>,”<\/a> the abbreviation (\u043d\u0440) for the word “number” (\u043d\u043e\u043c\u0435\u0440, phonetically nomer<\/em>) in Russian. Come on, guys, could you at least pretend you’re trying? Make that a triple facepalm for this social engineering dropout’s demonstration of willful ignorance. Demonstration no. 1,<\/strong> even.<\/p>\n
I’m not sure exactly how a non-researcher would end up infected. Most smart people would realize that, even if UPS was sending them a letter, the freight shipper would never refer to their own depot as “the post office” as this message does. And even if the user didn’t simply delete the message, and tried in vain to open an archive dressed up as an image file, the computer would only warn you about the file being the wrong type, and quit trying to open it.<\/p>\n
Fortunately, I’m not so easily dissuaded, and I like to break stuff. In my next post, I’ll describe some of the awesomely annoying malwarey goodness that came from this one downloader.
\n\"wordpress<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
The Tacticlol downloader, responsible for a lot of infections over the past year, propagates in two ways: via drive-by downloads, and as a .zip archive attached to messages. Maybe the spam filtering companies finally caught on to the trick, or maybe the Tacticlol distributors are just trying to mix it up, but the latest sample […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[8063,8053,8061,6597,4421,3855,3619,7107,8057,3477,4431,6593,7391,4157,3875,22441,3491,8571,8209],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3478"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=3478"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3478\/revisions"}],"predecessor-version":[{"id":32605,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3478\/revisions\/32605"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=3478"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=3478"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=3478"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=3478"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}