From: Thanks Michael L. Doyle with an attached file But for fun let’s investigate what’s going on. First, save the attachment to a temporary folder. The part of the filename before the extension in Notice there’s a reversed message from the unzip program here. The name of the one file in the zip archive very likely has some special character codes in it that changes text display into right-to-left mode (for languages such as Hebrew), and they spill over into the display of the message, making it hard to read and importantly<\/em>, obscuring the order of the letters in the file’s name. If you copy and paste only the word “gnihctamsim” above and paste it somewhere else the letters appear the right way round, because you probably didn’t copy the character code that flips the order of the visible letters; and if you click at the start of the message and drag to the right to select it you’ll see the selection highlight jump around as the selection feedback tries to show you selecting the end<\/em> of the text and then less and less of the backwards text. (The details of how this blog post appears depend on how your browser handles special characters \u2013 download Firefox!) The warning message is mismatching “local” filename :exe..xlxs<\/strong> , warning that the file extension doesn’t match what it appears to be, and I think that triggers the final “At least one warning-error was detected…” message. In Windows, a file with a Let’s actually use the That looks OK, because it looks like it ends in “.xlsx”. But with all the right-to-left and mirror writing crap going on, does it really?<\/p>\n\n\n\n Let’s try to get a listing of the one file we uncompressed:<\/p>\n\n\n\n Here’s where it gets extra weird. The one file in the archive uncompressed into a 2,396 kilobyte (2 Megabytes or so) file. What I see in the terminal is ‘PURCHASE QUOTATION LISTsxlx..exe<\/strong>, which is BAD<\/strong>, it’s an executable. But when I copy-pasted it into the paragraph above, it appears backwards with .xlxs<\/strong> on the end. It’s only when I expand the filename on the command line by pressing [Tab] or when I view the directory contents in my editor (vim) that I see the escape codes messing this up. And I’m now in a mess of what’s actually in the file name versus the terminal escape codes that tell the terminal to display things in bold and go into reverse mode and such. I wasted time trying to find a set of arguments to utilities I even asked ChatGPT to write a program to get the filename in the directory and print it out using Unicode escapes for the code points. After some coaxing it politely and helpfully wrote a 30-line Python program that when run prints:<\/p>\n\n\n\n How come none of these agree? Is it really that complicated? (Yes, it is.)<\/p>\n\n\n\n What is the U+202E RIGHT-TO-LEFT OVERRIDE – Unicode Explorer<\/strong> So that’s the explanation for the start of the problem and why part of the filename and text nearby appear reversed. I’ll leave the decoding of the rest of the weird characters to actual security and Unicode professionals.<\/p>\n\n\n\n What’s extreme nerd humor is many of the search results are from useless web sites that try to appear high in search results with computer-generated web pages for every possible Unicode character, like “Unicode Character Let’s not run it!<\/em>, even under Linux.Instead use the Any utility that displays the file’s name without extreme care is going to have reversed output, and So there is some kind of program in there announcing that it wants to run with my privileges, which when I boot into Windows is an administrator with lots of rights.<\/p>\n\n\n\n scary stuff!<\/p>\n","protected":false},"excerpt":{"rendered":" I got an e-mail asking for my bank details. From: Michael Doyle <ventas@farbiq.com.ar>To: undisclosed recipients:;Reply to: logistica.industrialparts@gmail.comSubject: Re: URGENT PROFORMA INVOICE Hello Dear, Greetings Our company has approved the attached purchase order. Please review the purchase order list, and return … Continue reading Michael Doyle <ventas@farbiq.com.ar><\/code>
To: undisclosed recipients:;
Reply to: logistica.industrialparts@gmail.com<\/code>
Subject: Re: URGENT PROFORMA INVOICE<\/strong>
Hello Dear, Greetings
Our company has approved the attached purchase order. Please review the purchase order list, and return to us proforma invoice with your receiving bank account for payment.
I wait for your reply.<\/p>\n\n\n\n
<\/p>\n\n\n\n
President
Direct: +1 978.834.0505 x12
Email: md@ppsystems.com<\/p>\n<\/div>\n\n\n\nPURCHASE QUOTATION LIST sxlx..zip<\/code> , a compressed “zip” archive file that suggests it’s a Microsoft Office Excel spreadsheet. This is a scam!<\/em><\/strong> Bad writing, it’s not specifically addressed to me, the three e-mail addresses don’t match, I’ve never heard of the company, and there’s no reason to compress a real Office.xlsx<\/code> (or .docx<\/code>, etc.) file, which is already compressed. If you get something like this, mark it as junk\/spam, and if it claims to be from a legit company do a web search for “company name<\/em> report phishing e-mail” and forward it to the e-mail address any good company should provide.<\/p>\n\n\n\nExcel? XL SX? sxlx?<\/h2>\n\n\n\n
P<\/code>URCHASE QUOTATION LIST sxlx..zip<\/code> implies it contains an Excel spreadsheet (the Excel file extension is .xlsx<\/code>), but in reality it is meaningless; the zip file could contain any set of files with any names. I’m on Linux, so start a terminal and type some commands to examine the zip file. (There might be Windows or Mac equivalents to these commands; on Windows you can install the Windows Subsystem for Linux for maximum geekery.) To start let’s test and list (using -tv<\/code><\/strong> options) its contents.<\/p>\n\n\n\n% unzip -tv \/tmp\/PURCHASE\\ QUOTATION\\ LIST\\ sxlx..zip<\/strong> \nArchive: \/tmp\/PURCHASE QUOTATION LIST sxlx..zip\nPURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe: mismatching \"local\" filename (PURCHASE QUOTATION LIST\u0442\u0410\u043es\u2550\u041fx\u2550\u041fl\u2550\u041fx\u2550\u041f..exe),\n continuing with \"central\" filename version\n testing: PURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe OK\nAt least one warning-error was detected in \/tmp\/PURCHASE QUOTATION LIST sxlx..zip.<\/code><\/pre>\n\n\n\n.exe<\/code> extension can be an exe<\/strong>cutable file, a binary program of computer instructions that can literally do anything: show a fun game, forward your sensitive documents to a foreign computer, encrypt all your files and demand a ransom, install malware that will forever mine Bitcoins or spy on you, and worse! Here the exe<\/code> part seems to come before the ending ..xlxs<\/code> and it’s the “final” dot-whatever that influences how the operating system treats the file. But because the text has gone into right-to-left mode, it looks like blab blah exe blah<\/em>.xlxs<\/code>, which almost looks like the file extension for a spreadsheet so maybe people will ignore the warning, assuming it even shows up on Windows built-in zip file handling. (I don’t know what the point of the weird characters T\u0442\u0410\u043es\u2550\u041fx\u2550\u041fl\u2550\u041fx\u2550\u041f<\/strong> in the file are before\/after the right-to-left “TSIL”\/LIST.)<\/p>\n\n\n\nunzip<\/code><\/strong> utility to uncompress the zip file it into a temporary subfolder. This would be risky on Windows, but I’m on Linux and I don’t think I have any Windows emulators or WINE (“Wine Is Not an Emulator”) that can actually run the file, and I’ll be careful not to accidentally run or “double-click” it.<\/p>\n\n\n\n% mkdir \/tmp\/PURCHASE_QUOTATION_quarantine<\/strong>\n% cd \/tmp\/PURCHASE_QUOTATION_quarantine<\/strong>\n% unzip ..\/PURCHASE\\ QUOTATION\\ LIST\\ sxlx..zip<\/strong> \nArchive: ..\/PURCHASE QUOTATION LIST sxlx..zip\nPURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe: mismatching \"local\" filename (PURCHASE QUOTATION LIST\u0442\u0410\u043es\u2550\u041fx\u2550\u041fl\u2550\u041fx\u2550\u041f..exe),\n continuing with \"central\" filename version\n inflating: PURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe <\/code><\/pre>\n\n\n\nWhat’s really at the end? What is the end in the middle?<\/h2>\n\n\n\n
% ls --size<\/strong>\nappears to my eyes as<\/em> 2396 'PURCHASE QUOTATIONLISTsxlx..exe'\npastes here as <\/em>2396 'PURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe'\n% type<\/em> *.exe<\/strong>[Tab]\nexpands to<\/em> % PURCHASE\\ QUOTATION\\ LIST<202e>s<034f>x<034f>l<034f>x<034f>..exe<\/code><\/pre>\n\n\n\nhexdump<\/code><\/strong>, od<\/code><\/strong>, and strings<\/code><\/strong> that would print the regular letters and reveal the Unicode code points (or terminal escape characters?), e.g.<\/p>\n\n\n\n% ls *.exe | strings --unicode=x<\/strong> \nPURCHASE QUOTATION LIST<0xe280ae>s<0xcd8f>x<0xcd8f>l<0xcd8f>x<0xcd8f>..exe<\/code><\/pre>\n\n\n\n% python3 ~\/bin\/dirlist_codepoints.py<\/strong> \nOriginal: PURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe\nCode Points: PURCHASE\u00a0QUOTATION\\u0020<\/em>LIST\\u00e2\\u0080\\u00ae<\/em>s\\u00cd\\u008f<\/em>x\\u00cd\\u008f<\/em>l\\u00cd\\u008f<\/em>x\\u00cd\\u008f<\/em>..exe<\/code><\/pre>\n\n\n\nCareful with that tfeL-ot-thgiR<\/h2>\n\n\n\n
202e<\/code> when the file name first starts to display weird? Most sequences of text these days use Unicode to represent regular “typewriter” characters, accented characters, symbols, hieroglyphs, Asian logographs, emoji, and the thousands of other “characters” we now put in text. A DuckDuckGo web search for “unicode \\202e” reveals<\/p>\n\n\n\n\n
The Right-To-Left Override character can be used to force a right-to-left direction withing a text. This is often abused by hackers to disguise file extensions: when using it in the file name my-text.’U+202E’cod.exe, the file name is actually displayed as my-text.exe.doc – so it seems to be a .doc<\/code> file while in reality it is an .exe<\/code> file. There’s even an xkcd comic<\/a> for this character!<\/p>\n<\/blockquote>\n\n\n\nDanger nerd humor alert<\/h3>\n\n\n\n
![\"\ud83d\udc8c\"](\"https:\/\/static.xx.fbcdn.net\/images\/emoji.php\/v9\/tf7\/1\/16\/1f48c.png\")
(U+1F48C) is ‘LOVE LETTER’…” (together with a bunch of ads and privacy-sucking JavaScript tracking). But when the page “shows” the Right-to-Left Override “character,” the snippet in search results (and the web site’s page, but don’t go there) appears in reverse.<\/p>\n\n\n\n![\"screenshot](\"\/images\/web\/unicode_rtl_garbled_search_results.png\")
![\"\ud83e\udd16\"](\"https:\/\/static.xx.fbcdn.net\/images\/emoji.php\/v9\/t36\/1\/16\/1f916.png\")
ha. ha. ha. ![\"\ud83d\ude06\"](\"https:\/\/static.xx.fbcdn.net\/images\/emoji.php\/v9\/td4\/1\/16\/1f606.png\")
<\/p>\n\n\n\nWhat is the executable?<\/h2>\n\n\n\n
file<\/code><\/strong> utility to see what kind of file it is.<\/p>\n\n\n\n% file PURCHASE\\ QUOTATION\\ LIST<202e>s<034f>x<034f>l<034f>x<034f>..exe<\/strong>\nPURCHASE QUOTATION LIST\u202es\u034fx\u034fl\u034fx\u034f..exe: PE32+ executable (GUI) x86-64 Mono\/.Net assembly, for MS Windows, 2 sections<\/code><\/pre>\n\n\n\nfile<\/code><\/strong> does too. The right-to-left text is telling us it’s an assembly, for MS Windows, 2 sections sxlx..exe: PE32+ executable (GUI) x86-64 Mono\/.Net<\/strong>. You can write a 2 MB standalone program that does a hell of a lot of bad stuff, but who knows what the executable section would do. I wonder if there’s actually a spreadsheet in there as well as computer code. For fun let’s see what strings of characters are in it.<\/p>\n\n\n\n% strings *.exe | less<\/strong>\n!This program cannot be run in DOS mode.\n.text\n...\noT8=\n<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">\n <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"\/>\n <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">\n <security>\n <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">\n <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\/>\n <\/requestedPrivileges>\n <\/security>\n <\/trustInfo>\n<\/assembly>\nxkcva2wfKaiDsaDdws,\n...\n%xkcva2wfKaiDsaDdwsPAPADDINGXXPAPADDINGXXPAPADDINGXX...PADDINGXX repeated thousands of times sover and over and over<\/em>...PADDINGXXPAPADDIN\n(END)<\/code><\/pre>\n\n\n\n