Today I had one of those typical spam malware in my mailbox, showing that Microsoft Outlook is one of the most widely used mail programs, being attacked all the time:
Microsoft Outlook Notification for the xxxx@xxxx.xx
Support [xxxx@xxxx.xx]
Sent :Thu 15/10/2009 06:38
To xxxx@xxxx.xx
Attachment install.zip (12kb)
You have (6) New Message from Outlook Microsoft
– Please re-configure your Microsoft Outlook Again.
– Download attached setup file and install.
True, this mail usually is a bad one, but nevertheless it made me grin due to the fact that I was using Thunderbird and KMail for managing my personal mail flood. So I checked the mail headers and found out that it came from a spamhost somewhere in the net.
Just as I decided to ignore that message and train my spamfilter, I noticed the ZIP file attached. Sadly it came without a brief description of what it really does – so that part of work is left to me. But I am sure it is definitively not the new software for photo books by CeWe. Unpacking the ZIP File was an easy thing:
Listing archive: install.zip Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2009-10-15 11:38:42 ....A 28672 21167 install.exe ------------------- ----- ------------ ------------ ------------------------ 28672 21167 1 files, 0 folders
The contents is just a plain EXE file, which is getting a little more interesting as you can scan it for malware, but for now, ClamAV doesn’t report a positive match. So I have to take a closer look if I want to know.
Digging in that binary, I noticed, that it is just another container that does SFX – and as I got my Swiss Army Archive tool 7-Zip with me, it is an easy thing to unpack it:
Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2006-01-21 22:17:57 2606 3072 .text 2006-01-21 22:17:57 5293 5632 .rdata 2006-01-21 22:17:57 53248 0 .data 2006-01-21 22:17:57 592 512 .tls 2006-01-21 22:17:57 18138 18432 .edata ------------------- ----- ------------ ------------ ------------------------ 79877 27648 5 files, 0 folders
And here we go – but who is who? I am using the magic numbers of the files to get an idea of what’s their purpose.
data: empty
edata: data
rdata: data
text: VISX image file
tls: data
Skimming through the files with a HEX Editor, the string “FuC1.FuC1.FuC1” showed up quite often, which clearly indicates that the file is made from a script kiddie and won’t do anything good on our system…
So the best thing is just ignoring those messages and deleting them immediately.