VERY IMPORTANT

A URL can be completely valid, yet still misleading. In this blog, we will present another technique with URLs that we observed in a recent malicious spam campaign. This is the continuation of an earlier blog that discussed how valid URL formats can be used in evading detection. The spams in this campaign have a PowerPoint Add-in attachment which contains a malicious macro. When the PowerPoint file is closed, it accesses a URL via the Windows binary mshta.exe, and this leads to different malware being installed into the system.