CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Image File Trickery Part II: Fake Icon Delivers NanoCore

The .zipx file extension is used to denote that the ZIP archive format is compressed using advanced methods of the WinZip archiver. In 2019, we published a blog about this file extension being abused to deliver Lokibot malware. In this blog, we outline another .zipx attachment we recently encountered with spam messages, and we will show the result of our investigation in comparison to the previous .zipx sample we observed.

Figure 1
Figure 1: The email sample containing a .zipx attachment


The emails, claiming to be from the Purchase Manager of certain organizations that the cybercriminals are spoofing, look like usual malspams except for their attachment. The attachments, which have a filename format “NEW PURCHASE ORDER.pdf*.zipx”, are actually image (Icon) binary files, with attached extra data, which happens to be RAR. This file format abuse is similar to what we have seen previously.

Figure 2
Figure 2: The attachment’s contents viewed in the Hiew tool


If the attachment successfully evades any scanning email gateways, the next hurdle is the victim’s machine, which needs to have an unzip tool that can extract the executable file inside the attachment. We tried using the same tools from the previous blog to extract the EXE file and here is the result:



The archive utility WinZip and WinRAR yield similar results when extracting the EXE file from the previous and current .zipx files. WinZip does not support unzipping either of samples whereas WinRAR managed to extract the EXE file contained in both samples.

Figure 3
Figure 3: The executable contained in the attachment NEW PURCHASE ORDER.pdf.zipx is recognized by WinRAR


Interestingly, 7Zip can also extract the content of the latest .zipx sample. 7Zip initially tries to open the files as a ZIP archive and fails, but afterward, 7Zip recognizes the .zipx files as Rar5 archives and can get their contents unpacked. Unlike in the previous blog, there is no need for the extension of the recent attachments to be renamed to something else other than .zipx or .zip just for their executables to be extracted using 7Zip.

Figure 4
Figure 4: Opening the attachment NEW PURCHASE ORDER.pdf.zipx using the 7Zip tool


The executables we gathered have a similar name to that of the .zipx attachment, “NEW PURCHASE ORDER*.exe”. Also, the icon at the start of the .zipx files is actually the icon used on the EXE files within the archive.

Analyzing the EXE files indicates that they are samples of NanoCore RAT version This RAT create copies of itself at the AppData folder and inject its malicious code at RegSvcs.exe process. The data stolen by this RAT is sent to the command and control servers listed below:

  • shtf[.]pw
  • uyeco[.]pw
Figure 5
Figure 5: Memory dump of RegSvcs processes where NanoCore malware is injected



The recent malspams have the same goal like the ones we investigated almost two years ago and that is to effectively hide the malicious executable from anti-malware and email scanners by abusing the file format of the “.zipx” attachment, which in this case is an Icon file with added surprises. In a slight twist, enclosing the executable into a RAR archive instead of a ZIP file, the content of the .zipx attachment can be extracted by another popular archiving tool, 7Zip. If the end-user uses 7Zip or WinRAR, the NanoCore malware could be installed onto the system, if the user decides to run and extract it. It all works because various archive utilities try their darndest to find something to unzip within files. You might even argue they try too hard!

The Trustwave Secure Email Gateway flagged the messages as malicious and detected this threat.



NEW PURCHASE ORDER.pdf.zipx (480092 bytes) SHA1: DF46A893B51D8ADE0CCDEF7E375FB387E2560720
New Purchase Order.pdf (2).zipx (403050 bytes) SHA1: C93FBA54357E90235202F58DA1FEFF7AB1142F65

NanoCore RAT:

NEW PURCHASE ORDER.exe (635904 bytes) SHA1: E99F6B9BD787679666F8C54B9A834D6ACECFA622
New purchase order (3).exe (431104 bytes) SHA1: FD958C365B6BFA5EF34779831773EC92C041A5D5

Latest SpiderLabs Blogs

The Secret Cipher: Modern Data Loss Prevention Solutions

This is Part 7 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here. Far too many organizations place Data Loss Prevention (DLP) and Data...

Read More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway

Overview A command injection vulnerability has been discovered in the GlobalProtect feature within Palo Alto Networks PAN-OS software for specific versions that have distinct feature configurations...

Read More


We all know the cybersecurity industry loves its acronyms, but just because this fact is widely known doesn’t mean everyone knows the story behind the alphabet soup groups of letters, we must deal...

Read More