I wonder if this is the right place to ask about the specific functioning of viruses / worms. We all receive fishy mails all the time. And generally I never click on anything, especially not attachments purporting to be quotes, letters, sipping bills, etc.
But I wonder how this ZIP file attachments exploit works? Does it depend on a particular bad version of ZIP, my guess is the built-in ZIP handler of Windows that opens a ZIP file like a folder, and then perhaps tries to create and show thumbnails and things like that? Or does the old PKZIP have vulnerabilities? I generally use 7-zip or just manually UNIX/cygwin unzip or java's jar to open ZIP files (and the command lines generally when I am suspicious).
Do any command line ZIP tools have known vulnerability targeted by these exploits?
Finally, the latest experience with these "Claim Letter" attachment was an HTML attachment, which has a lot of stuff inside, but ultimately another Claim Letter ZIP file.
Adding some details here. Email came with an .html attachment and inside was a bunch of stuff but mostly a ZIP file encoded in base64.
$ base64 -d Claim_Letter#842844\(13Sep2022\).threat-zip.b64 > Claim_Letter#842844\(13Sep2022\).threat-zip
$ unzip -v Claim_Letter#842844\(13Sep2022\).threat-zip
Archive: Claim_Letter#842844(13Sep2022).threat-zip
Length Method Size Cmpr Date Time CRC-32 Name
-------- ------ ------- ---- ---------- ----- -------- ----
440320 Defl:N 237712 46% 09-13-2022 15:45 405a0e37 Claim_Letter#295370.iso
-------- ------- --- -------
440320 237712 46% 1 file
$ unzip -p Claim_Letter#842844\(13Sep2022\).threat-zip Claim_Letter#295370.iso |hexdump -c |less
As you can see, I felt secure enough to try to extract this .iso file with cygwin unzip, and then that asks for a password. So what would be the point of that?
