Windows Malware with VHD Extension

Published: 2022-11-05
Last Updated: 2022-11-05 22:02:59 UTC
by Guy Bruneau (Version: 1)
1 comment(s)

Windows 10 supports various virtual drives natively and can recognize and use ISO, VHD and VHDX files. The file included as an attachment with this email, when extracted appears in the email as a PDF but is is in fact a VHD file.



This email received this week with a zip file attachment, after extraction, contained a file with a VHD extension. Using Linux file command, identified the file as a Microsoft Disk Image.



Windows 10 File Browser Listing



File was submitted to Virustotal [1] for analysis with very little detection and was identified as a Trojan by two scan engines. Sandbox analysis also indicated it may try to detect the virtual machine to hinder analysis, analysis by sandbox was minimal. Sandbox indicated the original filename was 7zS.sfx.exe0 vs 938374740_pdf.vhd

Attempt to copy the file to Windows 10 Sandbox [2] crashed the system. A second attempt to copy the file resulted with the same outcome.





filename: 938374740_pdf.vhd, 7zS.sfx.exe0
SHA256: ea9aca145f23464a7739c7b3b6a8f8c7ce65bdd6f868e0a87a65a9a1291ee960


Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

1 comment(s)


BitRat Trojan - C2: bitone9090[.]duckdns[.]org; 154[.]16[.]67[.]29:9090 - as of this post.

Diary Archives