On: An onion of obfuscation

[mcantor]

I'm a little confused. He says that it's a phishing attack and not a virus, but isn't the eventual payload an executable that does lots of dark win32 magic? I kept expecting him to describe how it launches your browser to a fake bank login site. Just curious... did I miss something?

[bigmac → mcantor]

You're correct, the analysis is incomplete without analyzing the payload.

[angelbob → mcantor]

He thinks it's for replacing a bit of your browser and doing phishing that way, based entirely on the symbols the executable imports. So it's a guess, but a semi-educated one.

[mcantor → angelbob]

I'll capitulate, but only if we get to subsequently call it a "phirus". (Though I suppose the lack of self-replication precludes calling it a virus.)

[inshallah → mcantor]

by chance it appeared to come from someone who has previously written to me

To me, this suggests a viral nature of the attack.

[tetha → mcantor]

I think the correct term would be 'malicious agent', which is a program which does something bad, but we don't know what for now.