Security Affairs

MARCH 15, 2019

The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive. The issue affects a third-party library, called UNACEV2.DLL DLL that is used by WINRAR, it resides in the way an old third-party library, called UNACEV2.DLL,

Archiving 275

Archiving Libraries File names Security 275

Security Affairs

NOVEMBER 5, 2020

The name KilllSomeOne comes from the phrase ‘KilllSomeOne’ used in the DLL side-loading attacks, the group is using poorly-written English messages relating to political subjects. . Dynamic-link library (DLL) side-loading takes advantage of how Microsoft Windows applications handle DLL files.

File names 302

File names Encryption Libraries IT 302

Security Affairs

OCTOBER 18, 2022

Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library. To prevent analysis, the malware also cleans up created artifacts, overwriting the content of the dropped wlbsctrl.dll file before deleting it. . ” continues the report.

File names 328

File names Encryption Manufacturing Libraries 328

Security Affairs

OCTOBER 13, 2022

The attackers continue to use the HyperBro backdoor which is often loaded using the dynamic-link library (DLL) side-loading technique. The binary, which has the default name vf_host.exe, is usually renamed by the attackers in order to masquerade as a more innocuous file. ” reads the report published by the experts.

File names 363

File names Financial Services Manufacturing Libraries 363

Security Affairs

FEBRUARY 23, 2019

Once the malware has infected a system drops two plain text files, one is a ransom note called “_FILES_ENCRYPTED_README.txt,” which gives information to the victim on what has happened and instruction to pay the ransom. Like other ransomware, the operators allow victims to unlock a file for free.

Ransomware 277

Ransomware Encryption File names Libraries 277

Security Affairs

JUNE 8, 2022

.” “The vulnerability lies in the Microsoft Diagnostic Tool’s sdiageng.dll library, which takes the attacker-supplied folder path from the package configuration XML file inside the diagcab archive, and copies all files from that folder to a local temporary folder.”

Security 246

Security File names Libraries Archiving 246

Security Affairs

FEBRUARY 5, 2019

By exploiting the vulnerability it is possible to trigger the automatic execution of a specific python library included in the suite using a hidden onmouseover event. The expert pointed out that the python file, named “pydoc.py,” is already included in the LibreOffice software.

File names 279

File names Libraries Security IT 279

Security Affairs

OCTOBER 10, 2018

“These lure documents use titles with government , military, and diplomatic themes, and the file names are written in English or Cyrillic languages. These documents are not very sophisticated, but evidence of infections shows that they’re effective.” ” continues Symantec.

Military 270

Military File names Government Libraries 270

Security Affairs

JULY 26, 2022

Dynamic-link library (DLL) side-loading is an attack method that takes advantage of how Microsoft Windows applications handle DLL files. In such attacks, malware places a spoofed malicious DLL file in a Windows’ WinSxS directory so that the operating system loads it instead of the legitimate file.

Passwords 261

Passwords File names Libraries Security 261

Security Affairs

JULY 14, 2021

“The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files. We found multiple archives like this with file names of government entities in Myanmar, for example “COVID-19 Case 12-11-2020(MOTC).rar” ” reads the analysis published by Kaspersky.

Archiving 246

Archiving File names Government Libraries 246

Security Affairs

OCTOBER 20, 2018

The plugin is widely adopted by numerous server-side platforms that support standard HTML form file uploads: PHP, Python, Ruby on Rails, Java, Node.js, Go, and others. Cashdollar discovered two PHP files named upload.php and UploadHandler.php in the package’s source, which contained the file upload code.

File names 277

File names Libraries Security Access 277

Security Affairs

MARCH 30, 2023

“Unfortunately this happened because of an upstream library we use became infected.” ” The trojanized 3CXDesktopApp is the first stage in a multi-stage attack chain, the installers retrieve ICO files appended with base64 data from Github and ultimately leading to the deployment of 3rd stage information stealer.

File names 246

File names Manufacturing Libraries Cybersecurity 246

Security Affairs

FEBRUARY 13, 2023

This approach allows the attacker to continuously update and eliminates reliance on fixed file names.” The second-stage malware, UpdatTask.dll , is a dynamic-link library (DLL) written in C++ that includes two export functions, DllEntryPoint and Entry. ” continues the report.

Archiving 246

Archiving File names Libraries Phishing 246

Security Affairs

FEBRUARY 16, 2021

dll: Windows legitimate DLL for runtime dependencies – MICROSOFT® C RUNTIME LIBRARY. dll: Windows legitimate DLL for runtime dependencies – MICROSOFT® C RUNTIME LIBRARY. Usually, executables using the side-by-side feature will have these resources located in the embedded manifest file. exe8CBB75FEBFB4B0B7C3B6D3613386220C.

Libraries 336

Libraries Communications Phishing Encryption 336

Security Affairs

FEBRUARY 19, 2019

The phishing email contains a.zip file named “slavneft.zakaz.zip”, which means something like “slavneft order” in English, showing a direct reference to “Slavneft”. It contains a russian speaking JavaScript file named “«??? «??? «?????????» ??????????? ??????”,

Ransomware 250

Ransomware Mining File names Encryption 250

Security Affairs

JULY 20, 2023

These commands include instructing the malware to upload log files, photos stored on the device, and acquire device location using the Baidu Location library.” ” reads the report published by Lookout. ” continues the report. ” The report also includes Indicators of Compromise (IoCs) for both spyware.

File names 246

File names Libraries Cybersecurity IT 246

Security Affairs

MAY 7, 2019

The executable sample is a PE32 x86 file named “tester.exe”. This library provides access to the E X tension for F inancial S ervice (XFS) API, the communication interface needed to interact with AMT components such as PIN pad and cash dispenser. Technical Analysis. Figure 6: Discovering of PinPad and Dispenser components.

Libraries 237

Libraries e-Discovery Communications File names 237

Security Affairs

MARCH 2, 2019

File name: patent-2019-02-20T093A283A05-1.xls However, as already mentioned at the beginning of the technical analysis, SI-LAB team obtained two types of files, namely xls and doc archives. File name : 68131_46_20190219.doc Analyzing the MSI file – The installer/dropper of infamous FlawedAmmyy.

File names 274

File names Phishing Libraries IT 274

Security Affairs

JUNE 5, 2019

“This malware, which we named BlackSquid after the registries created and main component file names, is particularly dangerous for several reasons.” According to the experts, BlackSquid has worm-like propagation capabilities and it can be used to launch brute-force attacks. ” states Trend Micro.

Mining 234

Mining File names Libraries IT 234

Security Affairs

JULY 8, 2023

At the provided URL, a password-encrypted.rar file named “Abraham Accords & MENA.rar” was hosted. The.rar archive contained a dropper named “Abraham Accords & MENA.pdf.lnk.” It generates a system identifier by combining the operating system name, hostname, and a random number.

Archiving 246

Archiving Cloud File names Metadata 246

Security Affairs

SEPTEMBER 5, 2018

“Two exploit documents with Vietnamese-language file names were observed with file metadata unique to the GOBLIN PANDA adversary.” As part of this campaign, new exploit documents were identified with Vietnamese-language lures and themes, as well as Vietnam-themed, adversary-controlled infrastructure.”

Metadata 177

Metadata File names Libraries Government 177

Security Affairs

DECEMBER 4, 2018

The second stage of the infection chain is the “ ppc.cab ” file downloaded by the dropper to the “ %APPDATA%Roaming ” location: it actually is a Microsoft Cabinet archive embedding an executable file named “ puk.exe ”. Figure 11: Commands of the third row of “ddraxpps” key.

Archiving 264

Archiving File names Libraries Communications 264

AIIM

APRIL 8, 2021

Check-in and check-out are very similar to how a library works – when a book is checked out, nobody else has access to it until it is checked back in. This feature also reduces the need to store multiple copies and versions, and their associated naming conventions, in order to retain a document’s history. Security and access controls.

ECM 243

ECM Cloud Access File names 243

Security Affairs

JUNE 5, 2020

The macro contained inside the document is quite minimal and does not contain dead code or other anti-analysis technique, a part of the random looking variable naming. If the download is successful, the malware reads raw bytes from the downloaded file and transforms them into ready to execute powershell code. Figure 3: Extracted Macro.

Manufacturing 324

Manufacturing File names IT Libraries 324

Security Affairs

SEPTEMBER 4, 2019

The malware encrypts all the files whose extension is not present in the list. Figure 4: Content of “key” file contained in “C:ProgramData”. During the encryption phase, JSWorm writes a suspicious file named “key.Infection_ID.JSWRM” in “C:ProgramData”.It It contains the AES key used to encrypt the files.

Ransomware 266

Ransomware Encryption File names Libraries 266

Security Affairs

JULY 7, 2020

However, in this new release, two DLL files are distributed. VBS file leverages the Windows rundll32 library to inject the first DLL into memory (P-14-7.dll), Figure 6: Deofuscated VBS file – Lampion trojan July 2020. LNK files from the Windows startup folder. VBS files from the Windows startup folder.

Communications 333

Communications Cloud Phishing Encryption 333

Security Affairs

MAY 2, 2019

The command and control is implemented by a standalone.NET application working through files. The backend, a nodeJS server, runs and offers Public API and and saves, requests to agents, and results from agents, directly into files named with “UID-IP” convention acting as agent ID.

Computer and Electronics 278

Computer and Electronics Communications Government Security 278

Gimmal

NOVEMBER 21, 2024

Limited Sorting and Filtering : Users can only sort and filter files based on basic attributes like name and date within a folder, restricting efficient data retrieval. Ineffective Search Capabilities : Without additional metadata, searches are limited to file names or basic content, making it difficult to perform targeted searches.

Metadata 52

Metadata Information governance Government Records Management 52

Security Affairs

DECEMBER 29, 2019

As observed, the output shows us two AWS-hosted addresses that contain two malicious files, namely: hxxps[:]//fucktheworld.s3.us-east-2.amazonaws[.]com/0.zip zip file is a DLL with additional code loaded by PE File P-19-2.dll At the moment, the file 0.zip To get details about the library inside the 0.zip

Passwords 246

Passwords e-Discovery IT Cleanup 246

The Texas Record

JANUARY 25, 2019

The departmental structure of the ARIS division at the Texas State Library and Archives Commission (TSLAC). In addition, we encouraged the practice of creating README files, which have a description of their respective folder with information regarding its retention and other information (e.g. Creation of README Files (PDF).

Cleanup 78

Cleanup Records Management File names Archiving 78

The Schedule

AUGUST 10, 2018

The SAA Records Management Section steering committee has been working hard over the past several years to improve upon the records management bibliography that was disseminated in 2008 (and, in case you’re interested in historical RM documentation, is available on our microsite at [link] — file name RMRTBibliography2012.pdf

Records Management 40

Records Management Libraries File names Access 40

Info Source

JUNE 24, 2019

. · OCR title naming (all models) : The optical character recognition (OCR) function recognizes title bar (microfiche) or title image (microfilm) text. has been designed to be fully supported in Windows 10 Professional (64-bit) and is adaptable for future Windows generations.

Archiving 40

Archiving File names Marketing Manufacturing 40

Archives Blogs

MARCH 25, 2020

Being a tethered system, all images are automatically and instantly transferred from the camera to the computer where the Capture One software handles basic editing of the images including color correction, cropping, file naming, and exporting the final images to our internal server before being loaded into the FSU Digital Library.

Libraries 20

Libraries File names 20

Unwritten Record

OCTOBER 5, 2021

Accessing File Metadata on a PC. Select the file you would like to review in “File Explorer.”. Right click the file name and select “Properties.”. A box will pop up that includes various information about the file, and you should select the tab labeled “Details.”.

Metadata 53

Metadata Archiving Access File names 53

Security Affairs

SEPTEMBER 12, 2019

This operation is similar to the threat group’s August 2018 campaign , using compromised university resources to send library-themed phishing emails.” The hackers registered at least 20 new domain names through the Freenom domain provider that offers free top-level domain names.

Phishing 259

Phishing Libraries File names Metadata 259

eSecurity Planet

FEBRUARY 3, 2021

Presenting itself as a JPG file named “gracious_truth.jpg,” Teardrop is a memory-only dropper built to enter a network seamlessly and replace the embedded payload. The problem: software can be mighty complex, made up of components, development frameworks, operating system features, libraries, and more.

Cybersecurity 63

Cybersecurity Access Authentication Cloud 63

Security Affairs

APRIL 14, 2020

“The emails all contained a malicious Rich Text Format (RTF) phishing lure with the file name 20200323- sitrep -63- covid -19. ” The messages use a weaponized rich text format (RTF) attachment that exploits the CVE-2012-0158 buffer overflow in Microsoft’s ListView / TreeView ActiveX controls in MSCOMCTL.OCX library.

Ransomware 361

Ransomware Phishing File names Government 361