Windows Malware with VHD Extension
Last Updated: 2022-11-05 22:02:59 UTC
by Guy Bruneau (Version: 1)
Windows 10 supports various virtual drives natively and can recognize and use ISO, VHD and VHDX files. The file included as an attachment with this email, when extracted appears in the email as a PDF but is is in fact a VHD file.
This email received this week with a zip file attachment, after extraction, contained a file with a VHD extension. Using Linux file command, identified the file as a Microsoft Disk Image.
Windows 10 File Browser Listing
File was submitted to Virustotal  for analysis with very little detection and was identified as a Trojan by two scan engines. Sandbox analysis also indicated it may try to detect the virtual machine to hinder analysis, analysis by sandbox was minimal. Sandbox indicated the original filename was 7zS.sfx.exe0 vs 938374740_pdf.vhd
Attempt to copy the file to Windows 10 Sandbox  crashed the system. A second attempt to copy the file resulted with the same outcome.
filename: 938374740_pdf.vhd, 7zS.sfx.exe0
Guy Bruneau IPSS Inc.
My Handler Page
gbruneau at isc dot sans dot edu
Nov 6th 2022
4 months ago