.. /.Wim

Phishing
Executable
File Archiver

Contributors:

Adithya - @ravooriadithya

Description:

The Windows Imaging Format (WIM) is a file-based disk image format. It was developed by Microsoft to help deploy Windows Vista and subsequent versions of the Windows operating system family, as well as Windows Fundamentals for Legacy PCs. WIM file may includes several images. With PowerISO, you can open an WIM file, and extract files from the WIM file. These image file types can contain malicious executables.

OS:

Windows

Recommendation:

Common email providers do not block wim attachments but there is little legitimate need for them to be delivered through mail. Block the attachments via email gateway. Also, open any of these file types with care as they can contain malicious executable files.

Resources:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/another-archive-format-smuggling-malware/

File Samples:

https://www.virustotal.com/gui/file/3a1c7d46f9311ccc1222fb1a7309bdeabdd8a337bdf165a83cd03311a16d4389/detection