Hello and welcome to the Monday, June 8, 2006 edition of the Sands Inlet Storm Centers, Stormcast.

My name is Johannes Ulrich, recorded from Jacksonville, Florida.

And this episode is brought you by the Sands.edu graduate certificate program in cyber security engineering.

Xavier this weekend rode up another interesting piece of malware.

This one originally starts out with a phishing email claiming to come from WeTransfer.

Well, actually, the interesting part here is, we transfer being the legitimate free file transfer service.

The link in the email is actually a legitimate we transfer link,

only that it goes to the next stage of the downloader,

which happens to be JavaScript, and then this JavaScript is being used to execute

PowerShell commands, and that'll end you up with an image that looks just like an MSI

wallpaper. So they're trying to hide in this generic, relatively well-known brand, so that way someone may not notice the B64 encoded script being appended to the end of the image.

It's B64 encoded, but slightly obfuscated, so it's not easily recognizable, at least by automated scripts, as basically more encoded.

So that's another layer of obfuscation here, which then in the end gets you the ultimate

malware downloader. Xavi promised a second diary with a more detailed analysis of just that

downloader.

But the lesson here, well, you know,

these free services are heavily abused,

being abused like we transfer.

They're also taking advantage of some of the Cloudflare resources here,

like their dot-deaf links in order to link to additional files.

All of these are legitimate services that you can't outright block

because they're often used in applications.

...