13 Nov 2025
Biztonsági szemle
Formbook Delivered Through Multiple Scripts, (Thu, Nov 13th)
When I'm teachning FOR610[ 1], I always say to my students that reverse engineering does not only apply to âexecutable filesâ (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: âPayment_confirmation_copy_30K__202512110937495663904650431.vbsâ (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f) identified by 17/65 antiviruses on VT[ 2]. Let's have a look at the infection path.
Read more