Hackers Attempt to Hide Malware in Microsoft Help Files

Samples of the Vidar stealer malware have been found in a place that seems highly unlikely. The malware was discovered by researchers inside Microsoft HTML-based help files, of all places.

A security researcher with Trustwave published a blog post detailing the campaign that was spreading Vidar. This latest campaign was described as pretty rudimentary, save for the twist of sticking malware inside help files.

Boring lure, clever obfuscation

The phishing emails used to spread the Vidar infostealer look like they are the product of a minimum-effort campaign. The lure is extremely basic, with the email claiming to have "important information" for the potential victim. As is the case with almost every phishing campaign, the email also contains a malicious attachment. In this case, the hackers opted for an .iso disk image file, renamed to look like an MS Word .doc file.

Inside the image file are just two files - a Microsoft help file called "pss10r.chm" and a file called "app.exe", which is the Vidar initial payload. CHM files are Microsoft help files that are used in various legitimate applications and contain compressed HTML and potentially images.

The reason hackers resorted to using CHM files is that it allows them to force-load the MS Help Viewer application in the process of opening the CHM file. When a malware-laced CHM file is opened in this way, the Help Viewer executable is called up silently and is used to load the app.exe initial payload for Vidar.

Once the executable is launched, the malware grabs its dependencies and settings from its C&C server. Once this is done, the malware gets to scraping any available information from the system and then transfers it back to the command and control server. Researchers noted that they have observed similar nesting of malicious payloads and even the use of help files before. All this is just another way for hackers to try and avoid automated detection on the victim's system for as long as possible.