Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID

Summary: Unit 42 observed a polyglot Microsoft Compiled HTML Help (CHM) file used in an IcedID infection chain discovered in early August 2022, starting with a phishing email carrying erosstrucking-file-08.08.2022.zip, which decompresses to an ISO image containing pss10r.chm. The CHM displays a harmless help window on first launch, but concealed HTML calls Mshta.exe to execute the same file a second time, running a hidden HTA that launches a 64-bit IcedID DLL (app.dll) concealed in the ISO.

Key Takeaway: The same file is benign on first execution and malicious on the second, so file-format identification and single-pass sandboxing can clear it while the IcedID payload, in use since 2019, still lands; the C2 URL abegelkunic[.]com and the listed SHA256 hashes are the concrete artifacts to hunt for.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related