#WINRAR PLATFORM ARCHIVE#
Two examples of software that allow the creation of an SFX archive are 7-Zip and WinRAR - each has a specific version of a decompressor stub, and both have features that can be used or abused.įigure 5. Many of these tools are widely available and are user-friendly to operate. Not All SFX Archives Are EqualĪ wide variety of SFX decompressor stubs are in use, depending on the product used to create an SFX archive, and not all products have the same functionality. Although many software installers may also use an SFX archive for ease of installation, use of these archives is gaining traction among adversaries as a way of bypassing security tools and running malicious code. PE File Headerĭecompressor/Method Stub (the executable code)Īrchive File Overlay (the content to be shared)īecause of the ubiquitous nature of unarchiving software, SFX archives are far less common in corporate settings than their standard compressed archive counterparts. This stub seamlessly decompresses and displays the file contents, saving the recipient from requiring specialized software. SFX archives are executable files that function by appending the content to be archived to a decompressor stub, which is what is executed upon running the file. Watch this short video to see how Falcon OverWatch proactively hunts for threats in your environment. Deeper investigation uncovered that this file - which could easily be overlooked by defenders - had the potential to provide the adversary with a persistent backdoor to the victim environment when paired with a specific registry key.
The CrowdStrike ® Falcon OverWatch ™ team recently observed the use of a seemingly empty SFX archive as part of an interactive intrusion. However, SFX archive files can also contain hidden malicious functionality that may not be immediately visible to the file’s recipient, and could be missed by technology-based detections alone. Self-extracting (SFX) archive files have long served the legitimate purpose of easily sharing compressed files with someone who lacks the software to decompress and view the contents of a regular archive file.
0 kommentar(er)
