The following code later executes the file ( putty.exe) using the ShellExecute command.Ĭheck Point recently found a malicious.

This function requires two values, the URL for the malware file and the Directory Path, to save the malicious file. After theĮxecution occurs, the powershell command processor calls the DownloadFile function. The following screenshot shows a victim running the chm help file. As their use is so common, we wouldn’t normally be suspicious of using the online help: chm help files are often used for software documentation and help guide tutorial. As a result, it is still being used by attackers who can remain FUD (Fully Undetected) by current Anti-Virus engines. Microsoft has not yet developed a patch to block this exploit method. chm files can be used to execute code on a victim computer running Microsoft Windows Vista, and higher.Ĭheck Point has discovered cyber criminals that are using this technique to spread malware and carry out attack campaigns using social media and spam mail. CHM (compiled HTML).Ĭheck Point researcher Liad Mizrachi has conducted research showing that. These files are compressed and deployed in a binary format with an extension of. “Microsoft Compiled HTML Help” is a Microsoft proprietary online help format that consists of a collection of HTML pages, indexing and other navigation tools.

Chm help