A forum for reverse engineering, OS internals and malware analysis 

Malware Abusing Unicode

Forum for analysis and discussion about malware.

Malware Abusing Unicode

 #3508  by a_d_13
 Mon Nov 15, 2010 9:04 pm
Hello,

This is old news, but I found out that TrendMicro has blogged about malware using the Unicode right-to-left override character to make a file appear to be legitimate. Attached to this post is a RAR that contains two files. Firstly, an EXE that has been renamed to appear to be a JPG file, with the icon set to the default Windows image icon. The EXE is not malware - it simply shows a messagebox and then exits. I have added a TXT file that contains the name of the file, saved in Unicode. Open it in a hex editor to see what the raw encoding is.

If anyone has samples of malware that use this trick, please post them here.

Thanks,
--AD
Attachments
Pass: infected
(20.76 KiB) Downloaded 92 times

Re: Malware Abusing Unicode

 #3550  by Meriadoc
 Wed Nov 17, 2010 11:50 pm
Sorry about bumping up older thread but I'm still playing catchup from time away.

Is this technique of reverting text,..as Trend said, 'commonly associated with spamming in the past' as was a way to get a file through spam filters by looking legitimate?

AD is that what you have done here? Just wanted to make sure I was thinking of the same thing.

edit: its okay, downloaded thanks, must be samples handy as this is straight forward and was popular.
 Return to “Malware”