<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
You are correct, although getting your payload to be executed or even <span style="font-size: 12pt;">opened could be difficult, since AFAIK none of the apps that can read .docx (et al.) files will blindly read everything inside the ZIP container.</span></div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
Every anti-malware engine I know of also knows how to detect zip files and scan inside them.</div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
So it's still useful vector in certain ways, but it's not the open door it once was.</div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
-Adam</div>
<div id="ms-outlook-mobile-signature" dir="auto">
<div><br>
</div>
Get <a href="https://aka.ms/AAb9ysg">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Roundtable <roundtable-bounces@muug.ca> on behalf of Bitters <bittercake2329@gmail.com><br>
<b>Sent:</b> Wednesday, January 19, 2022 9:50:38 AM<br>
<b>To:</b> Continuation of Round Table discussion <roundtable@muug.ca><br>
<b>Subject:</b> Re: [RndTbl] Fwd: Can a pdf file itself be maleware Fwd: FW: remittance Message Payment Status Notification</font>
<div> </div>
</div>
<div>
<div dir="ltr">Aren't most Word/PDF files just straight up a ZIP file? So you could easily unzip a word file. Upload your malware or whatever you have. Rezip the file and send it to your target or am I not remembering it correctly?
<br>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Tue, Jan 18, 2022 at 9:17 PM Adam Thompson <<a href="mailto:athompso@athompso.net">athompso@athompso.net</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div>
<div dir="auto" style="color:rgb(33,33,33); background-color:rgb(255,255,255)">Actually, I will make one comment about an obvious red flag: From: Accounting Clerk, but the email address is some random Gmail address? That's a giant nope for me. Instant delete.</div>
<div dir="auto" style="color:rgb(33,33,33); background-color:rgb(255,255,255)">-Adam</div>
<div id="x_gmail-m_1444980894474052830ms-outlook-mobile-signature" dir="auto">
<div><br>
</div>
Get <a href="https://aka.ms/AAb9ysg" target="_blank">Outlook for Android</a></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_1444980894474052830divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Roundtable <<a href="mailto:roundtable-bounces@muug.ca" target="_blank">roundtable-bounces@muug.ca</a>> on behalf
of <a href="mailto:eh@eduardhiebert.com" target="_blank">eh@eduardhiebert.com</a> <<a href="mailto:eh@eduardhiebert.com" target="_blank">eh@eduardhiebert.com</a>><br>
<b>Sent:</b> Tuesday, January 18, 2022 9:00:08 PM<br>
<b>To:</b> <a href="mailto:roundtable@muug.ca" target="_blank">roundtable@muug.ca</a> <<a href="mailto:roundtable@muug.ca" target="_blank">roundtable@muug.ca</a>><br>
<b>Subject:</b> [RndTbl] Fwd: Can a pdf file itself be maleware Fwd: FW: remittance Message Payment Status Notification</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div><br>
Hi,<br>
<br>
This is likely phishing spam and passing around for further information.<br>
<br>
Just opening an email without clicking on anything I understand can be <br>
safe.<br>
<br>
I would rather ask than be sorry. Is this also true of pdf files?<br>
<br>
If someone can open safely I would like to have a sense who is behind <br>
this one.<br>
<br>
Thanks,<br>
<br>
Eduard<br>
<br>
<br>
-------- Forwarded Message --------<br>
<br>
SUBJECT:<br>
FW: remittance Message Payment Status Notification<br>
<br>
DATE:<br>
Wed, 19 Jan 2022 06:15:45 +0800<br>
<br>
FROM:<br>
Accounting Clerk <<a href="mailto:michaelgarnett1233@gmail.com" target="_blank">michaelgarnett1233@gmail.com</a>><br>
<br>
Hello,<br>
<br>
Open Attached PDF to confirm remittance info.<br>
<br>
TRYR GROUP ACCOUNT<br>
<br>
Account clerk<br>
<br>
11524 Scenic Hills Blvd<br>
<br>
-------------------------<br>
</div>
</span></font></div>
</div>
_______________________________________________<br>
Roundtable mailing list<br>
<a href="mailto:Roundtable@muug.ca" target="_blank">Roundtable@muug.ca</a><br>
<a href="https://muug.ca/mailman/listinfo/roundtable" rel="noreferrer" target="_blank">https://muug.ca/mailman/listinfo/roundtable</a><br>
</blockquote>
</div>
</div>
</body>
</html>