In reality the file “statement.pdf” isn’t a pdf file but an executable, while the ZIP archive includes a collection of. lnk files and a copy of the executable “statement.pdf”.

Let’s give a close look to the link to understand the tactic adopted by criminals, analyzing the properties of the link file it is possible to discover much more. When the victim clicks on the .lnk file in reality he runs the cmd.exe which allow the execution of statement.pdf file, regardless its extension, using the “/c” option.

 

“The target runs cmd.exe in the current directory and executes “statement.pdf” with a /c option, which simply means “Carry out the command specified by string and then terminate”.” states the blog post.

As explained by Microsoft in this post, you can run files using the command prompt (cmd.exe), the console uses the Kernel32 API function CreateProcess to examine the content of the file and execute it regardless of its extension.

Clicking on “Statement.pdf” file user will observe that nothing happens, this can induce user to extract the content of the zip archive, seeing a series of “parts”. Clicking on them victim will infect his machine.

“These parts do not show a .lnk extension because these are hidden on Windows (think of your desktop shortcuts). But when clicked, the malware is executed, and the user’s machine is now infected.  In this case, the malware was an Upatre downloader, VirusTotal report here for those interested.” reports the post.

An attack compose in this way allows criminals to bypass any email gateways that seek to block executable file simply analyzing the extension instead to examine the file contents. Another element to consider is that also to a visual inspection of the unsolicited mail, its attachment appears to be a “harmless” because it is a PDF file.

Resuming the .lnk files provide a way to invoke cmd.exe to run the renamed executable to infect the victim’s machine.

Be aware … cybercrime is always lurking!

Pierluigi Paganini

(Security Affairs –  lnk files, phishing)