Analysis of a WhatsApp 'reconciliation statement' ZIP: a VHD with DLL side-loading

How the attack works, in one picture

Read the picture from left to right (or top to bottom on a phone). Each step hands over to the next one, and only the last step does the real harm.

In plain English: The attacker wraps the harmful file in several layers. Each layer looks ordinary on its own. The victim only has to double-click one harmless-looking program, and that program quietly loads the harmful file next to it.

Key terms

• ZIP: a common file type that holds other files inside it.
• VHD (virtual hard disk): a file that acts like a small disk drive. When you open it on Windows, it appears as a new drive letter.
• exFAT: a file system, which is the way a disk organises its files. Windows can read it without extra tools.
• EXE: a program you can run. A signed EXE carries a digital signature that says who made it.
• DLL: a library of code that a program loads when it starts.
• DLL side-loading: tricking a trusted program into loading the attacker's DLL instead of the real one, by placing the fake DLL in the same folder.
• Mark-of-the-Web: a hidden tag Windows adds to files that came from the internet, so that it can show a warning before you open them.
• IOC (indicator of compromise): a clue, such as a file hash, that helps defenders spot the same attack.
• Hash: a short fingerprint of a file. If two files have the same SHA-256 hash, they are the same file.

1. How it arrived

The message looked like a routine finance request. It asked me to forward a "reconciliation statement" to my company's finance team and said the file could only be opened on a computer. Both details are deliberate:

• Asking the recipient to forward the file to finance turns every victim into a delivery channel, and it targets the people who can approve payments.
• Saying it only opens on a computer pushes the victim to a desktop, where the payload can run, and away from a phone, where it cannot.

Because the file came from someone I know, the sender's WhatsApp account or phone may be compromised. I did not open the file.

Red flags in the message: a file you did not ask for, an urgent finance task, a request to forward it to other people, and a claim that it only works on a computer.

2. The sample

VirusTotal report: https://www.virustotal.com/gui/file/6db8d311995ca2e1e23e7e100cc4a4ae181b427a9585ccdcbc73d45b7877f44c

3. Method

I unpacked the ZIP and the disk image in an isolated cloud sandbox, listed the files, and examined them statically: headers, sections, entropy, imports, exports, certificates and strings. I did not run any file. I did not decrypt the payload or recover its command-and-control server. I used an AI assistant to help parse the file formats and draft the notes, and I reviewed the results.

4. Structure of the sample

ZIP
 ├─ 11061105332026_8AE20C3D.vhd   (32,506,368 bytes; fixed VHD, one exFAT partition)
 │   ├─ BJH1106110533.exe          launcher (signed, old)
 │   ├─ iS.dLl                     payload DLL (hidden + system attributes)
 │   ├─ ~55 hidden folders with random punctuation names
 │   └─ 1 folder with ~48 decoy files (fake Windows resource DLLs and config files)
 └─ "..."                          0-byte entry

What the victim sees is very different from what is really on the disk:

Why a VHD inside a ZIP?

On Windows, opening a .vhd mounts it as a new drive. Files on that drive may not carry the "downloaded from the internet" marker (Mark-of-the-Web), so the usual warnings can be skipped. The ZIP also hides the VHD from scanners that do not unpack disk images.

Hidden payload

The DLL and the decoy folders have the hidden and system attributes. With default Explorer settings, the victim sees only the launcher EXE on the mounted drive, which looks harmless.

5. The launcher: BJH1106110533.exe

• 32-bit Windows program, compiled 30 November 2017. Internal and original name: SETTINGM.exe, version 1.0.0.1.
• Contains a digital signature chained to GlobalSign, with a certificate that expired in 2018. I did not validate the signature.
• It imports three functions from a library named Is.dll: is_get_default_setting_info, is_get_setting_info, is_set_setting_info.
• Its file name is the build timestamp (1106110533 means 6 November, 11:05:33), so names change with every build.

The launcher looks like a normal, signed application whose only job is to load a DLL named Is.dll from its own folder. The attacker supplies a malicious iS.dLl in that folder.

In plain English: The launcher is like a trusted delivery driver who always picks up a parcel from the same shelf. The attacker leaves their own parcel on that shelf, so the driver carries it in without asking.

6. The payload DLL: iS.dLl

• 32-bit DLL, 5.6 MB, unsigned, compiled 5 November 2026 at 16:44 UTC, the day before delivery.
• It exports exactly the three functions the launcher expects, so the launcher runs without errors. It also exports decoy names (NVIDIASans, NvDriverDiagnostics) and carries the internal name MSEdgeWebView.dll, which is a spoofed identity.
• It contains two high-entropy regions: a 1.6 MB section with a non-ASCII name (.项目M) and a 727 KB resource section. Both look encrypted or compressed. I found no readable embedded executable.

What its imports suggest

These are indicators of capability, not proof of use:

• Networking: Winsock, WinINet (HTTP and FTP), and URLDownloadToFileW, which can download and save files.
• Services: functions to create, start, control and delete Windows services.
• Privileges: token and privilege adjustment functions.
• Execution: ShellExecuteExW, and strings for cmd.exe /c and rundll32.exe (possible injection or hollowing target).

Strings of interest

• EdgeWebView/156.0.0.0 (a browser-like User-Agent in a non-browser file)
• https://browser.events.data.microsoft.com/OneCollector/1.0/... and https://www.microsoft.com/edge/launch/api/i18n/.../zh-cn/messages.json (Microsoft addresses that may be used as cover traffic)
• \SysWOW64\rundll32.exe, \System32\rundll32.exe, \PROGRAMDATA\

I found no plaintext server address, IP address or cryptocurrency wallet in the files.

7. The decoys

About 48 small files (2 to 5 KB) sit in one folder. They have names like advapi32res.dll, imageres.dll and wmi.dll, and claim a Microsoft copyright. They are unsigned, have no entry point, and carry forged compile dates (for example in the year 2095). Their purpose looks like filler: to make the disk resemble a real Windows component folder and to dilute signature scanning.

8. Why antivirus may miss it

• Names, hashes and build times are different for every build.
• The harmful logic lives in an encrypted blob inside a DLL that only runs when a signed, legitimate-looking program loads it.
• Detection has to look through three layers: ZIP, then VHD, then exFAT.

9. Indicators of compromise

File hashes (SHA-256)

ZIP        6db8d311995ca2e1e23e7e100cc4a4ae181b427a9585ccdcbc73d45b7877f44c
VHD        2164616c2114cc471cbc9f1abab66d53f1b313cfa9a3ab7f41b1c4962c5a6c55
Launcher   019d3ee00b5bdd92618659e6ee0ab8388930be361a5ba30fcb150b1b4f8b0351
DLL        e0d45fa4964bbaa7c00c6ce51bc46c5a31b6ab4e9b2be500dcc0d4510c642923

Behavioural and file indicators

• A mounted VHD with an exFAT volume labelled 11061105332, containing an .exe, a hidden iS.dLl and many hidden folders whose names start with an underscore, a digit and random punctuation.
• A program whose original name is SETTINGM.exe loading an unsigned Is.dll from its own folder.
• A DLL that exports NVIDIASans and NvDriverDiagnostics and is internally named MSEdgeWebView.dll.
• A PE section named .项目M.
• cmd.exe /c or rundll32.exe started after the launcher runs.
• The User-Agent EdgeWebView/156.0.0.0 from a process that is not Edge.

I make no attribution to a threat actor. The Chinese-language section name and the zh-cn Microsoft address are weak hints only and could be deliberate misdirection.

10. Detection status

Antivirus detection changes quickly as vendors add signatures. For the latest results on this file, open the VirusTotal report linked in section 2.

11. What to do

For everyone

1. Do not open files or links you did not expect, even from people you know. Confirm by phone or in person first.
2. Do not forward unexpected files to colleagues or finance teams.
3. If you opened it, disconnect the device from the network, change passwords from a clean device, and contact your IT or security team.
4. If a contact sent you something like this, tell them. Their account may be compromised.

For defenders

1. Block the four hashes above.
2. Alert on VHD files mounted from download or chat folders.
3. Alert on a signed executable loading an unsigned library from its own folder, especially from a removable or newly mounted drive.
4. Consider blocking or warning on .vhd and .vhdx attachments in ZIP files at email and web gateways.
5. Run the sample only in an isolated lab if you need to recover the server address and the decrypted payload.

12. Limitations

• Static analysis only. I did not run the sample, decrypt the payload or recover the command-and-control server.
• I did not validate the launcher's signature, so I do not name its publisher.
• Capabilities in section 6 are inferred from imports and strings.

13. Timeline

• 5 Nov 2026, 16:44 UTC: payload DLL compiled (from its header).
• 6 Nov 2026, about 11:05: ZIP and VHD built (from file timestamps and names).
• 6 Nov 2026: file received over WhatsApp and analysed.

14. Learn more

If this made you curious about malware analysis and defence, Code Labs Academy runs bootcamps in cybersecurity, data, design and web development. More of my picks are on referral.czt.sh.

Disclosure: These are referral links. If you sign up through them, I may earn a commission or credit at no extra cost to you.