Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1085701" data-attributes="member: 32260">Example 2.[URL unfurl=&quot;true&quot;]https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html[/URL]Scenario 1 Phishing email ( Thread-Jacking ) ----&gt; PDF with embedded URL ----&gt; ZIP archive downloaded from URL ---&gt; JavaScript (JScript) downloader/launcher in ZIP archive ---&gt; LOLBins (cmd[.]exe, curl.exe, rundll32.exe) used to download and execute a DLL payloadScenario 2Phishing email ( Thread-Jacking ) ----&gt; IMG (disk image file) in ZIP attachment ----&gt; Shortcut (LNK file) + malicious DLL ----&gt; Shortcut executes DLL by using LOLBin (rundll32.exe)ZIP archives must be unpacked from the Explorer.</blockquote>

[QUOTE="Andy Ful, post: 1085701, member: 32260"] [B]Example 2.[/B] [URL unfurl="true"]https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html[/URL] [B]Scenario 1 [/B] Phishing email ( Thread-Jacking ) ----> PDF with embedded URL ----> ZIP archive downloaded from URL ---> [B][COLOR=rgb(184, 49, 47)]JavaScript (JScript)[/COLOR][/B] downloader/launcher in ZIP archive ---> LOLBins (cmd[.]exe, curl.exe, rundll32.exe) used to download and execute a DLL payload [B]Scenario 2[/B] Phishing email ( Thread-Jacking ) ---->[B][COLOR=rgb(184, 49, 47)] IMG (disk image file) [/COLOR][/B]in ZIP attachment ----> [COLOR=rgb(184, 49, 47)][B]Shortcut (LNK file) [/B][/COLOR]+ malicious DLL ----> Shortcut executes DLL by using LOLBin (rundll32.exe) [B]ZIP archives must be unpacked from the Explorer.[/B] [/QUOTE]

Verification