.. /.Chm

Executable
Native
Double Click

Author:

mr.d0x

Description:

CHM or Compiled HTML Help is a deprecated file format used to hold compiled and compressed HTML help documentation.

OS:

Windows

Recommendation:

Block the download and execution of CHM files.

Resources:

https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/

File Samples:

Contributions: