Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: ZIP With Comment - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
ZIP With Comment

I got hold of a malicious document e-mailed inside a password protected ZIP file.

This time I'm not going to write about the maldoc, but about the ZIP file. The password for the ZIP file was mentioned with instructions in the e-mail spammed to many recipients. Obviously this is done in an attempt to bypass detection by e-mail scanners, but with the hope that the recipients would follow the instructions and provide the password when the ZIP application asks for it.

Now I'm coming to the point: this ZIP file also contained a comment that mentioned the password:

And I hope you can help me with my question: what Windows application does display the ZIP comment by default when a ZIP file is opened?

I tried Windows Explorer, WinZip and 7-Zip, but without success.

If you have an idea, please post a comment.

Update: WinRAR displays comments by default.

Didier Stevens
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com
NVISO

DidierStevens

162 Posts
ISC Handler
7-zip displays the column by default...just have to scroll to the right in order to see it.
James

27 Posts Posts
Thanks for the quick response. Unfortunately 7-Zip doesn't display the comment for this ZIP file.
I think it's because you are referring to a comment associated with the embedded file, while in this sample it is a comment associated with the ZIP archive, not with a particular file inside the ZIP file.
DidierStevens

162 Posts Posts
ISC Handler
It does appear to be viewable in 7zip, but you have to access the "info" option at the top.
JasonKillam

1 Posts Posts
WinZIP and WinRAR have user-configurable settings for whether to display archive-level comments at file opening.

In WinZip 21.0, Settings -> WinZip Options -> Advanced -> File Handling -> Show comments when opening Zip files

In WinRAR 5.31, Settings -> General -> Show archive comment
Anonymous

Posts
Thanks, but what application does this *by default*?
DidierStevens

162 Posts Posts
ISC Handler
By default Winrar shows archive comments in a window on the right hand side.
One Time User

1 Posts Posts
Quoting DidierStevens:Thanks, but what application does this *by default*?


winrar does.
dante

1 Posts Posts
I think peazip will show this information by default.
http://www.peazip.org
Anonymous

Posts
Maybe none.
Could it just be an artefact from the malware generation process?
psophos

6 Posts Posts
Thanks for the suggestions all. I'll test them with the sample.
DidierStevens

162 Posts Posts
ISC Handler
Update: WinRAR will indeed display the comment by default.
peazip does not.
DidierStevens

162 Posts Posts
ISC Handler
This is a historic feature for Windows which utilized elements of WinZip and PKzip for its implementation for Zip files. The content remark element is enbedded in the code from Windows 98 and onward is my memory. It is an automated call to reveal remarks and such.
Anonymous

Posts
If you want to see zip comments directly in Windows Explorer you can install shell extension TC4Shell. Screenshot: http://www.tc4shell.com/img/ZipPassword.jpg
Dec

1 Posts Posts
IZArc can be set to show comments as well
(I don't know how. I just opened a zip-file I downloaded from a GIT-repo; shows comment, possibly with a hash-value).
Anonymous

Posts

Sign Up for Free or Log In to start participating in the conversation!