Password-Protected Attachment Evasion

Timeline: The Cat and Mouse

2015 ← Attack emerges → 2019 ← Defenses improve → 2022 ← Still effective → Present

The Evolution

Key Events with Sources

Overview

Email security tools scan attachments for malware, but they can’t scan what they can’t open. Password-protected ZIP files, encrypted PDFs, and other protected archives hide their contents from inspection. Attackers include the password in the email body, giving victims access while blinding security tools.

The Attack

How It Works

┌─────────────────────────────────────────────────────────┐
│  EMAIL                                                  │
│                                                         │
│  Subject: Invoice #12345                                │
│                                                         │
│  Please find attached invoice.                          │
│  Password: invoice2024                                  │
│                                                         │
│  Attachment: invoice.zip (encrypted)                    │
│  └── invoice.exe (malware, hidden by encryption)        │
└─────────────────────────────────────────────────────────┘

EMAIL SECURITY:
  Scanning: invoice.zip
  Status: ENCRYPTED - CANNOT SCAN
  Malware: UNKNOWN
  Action: DELIVER (can't prove it's bad)

Common Patterns

ZIP with Password:

Attachment: document.zip
Body: "Password: 12345" or "Use code: secure"
Contents: malware.exe, malware.dll, malware.js

RAR Archives:

Attachment: files.rar
Body: "Archive password: confidential"
Contents: payload.exe

Encrypted PDF:

Attachment: invoice.pdf (encrypted)
Body: "PDF Password: 2024"
Contents: Malicious JavaScript or links

7z Archives:

Attachment: data.7z
Body: "Extraction password in subject line"
Contents: iso/img file containing malware

Why It Works

Encryption is Legitimate:

• Businesses send encrypted files for security
• Can’t block all encrypted attachments
• False positive risk is high

Scanning Limitations:

• Can’t decrypt without password
• Brute force is slow/impractical
• Encryption algorithms are strong

Social Engineering:

• Password in email feels like “security”
• Users follow instructions
• Creates sense of legitimacy

Real Campaigns

QakBot:

• ZIP + XLS with macros
• Password often in subject or body
• Thread hijacking + password protection

Emotet:

• Password-protected DOC files
• Simple passwords: “123”, “1234”, “docx”
• High volume, low sophistication passwords

IcedID:

• Password-protected ZIP with ISO
• More complex passwords
• Targeted distribution

Defenses

Password Extraction and Scanning

Advanced SEGs:

1. Parse email body for password patterns
2. Extract potential passwords
3. Attempt to decrypt attachment
4. Scan decrypted contents

Patterns searched:

• “Password: X”
• “Pass: X”
• “Code: X”
• “Use X to open”
• Password in image (OCR)

Common Password Attempts

SEGs try common passwords:

• 1234, 12345, 123456
• password, infected, malware
• Current year: 2024, 2025
• File-related: invoice, document

Policy-Based Blocking

Organizations may:

• Block all password-protected ZIPs
• Quarantine for manual review
• Require sender verification
• Whitelist specific senders

Sandboxing with Passwords

Advanced analysis:

• Extract password from email
• Pass to sandbox environment
• Sandbox opens and analyzes
• Full behavioral analysis possible

Attacker Adaptation

Complex Passwords

Move beyond simple passwords:

Password: xK9#mL2$nP5
Password: Invoice-2024-Confidential

Defeats dictionary attacks and common password lists.

Password in Image

┌─────────────────────┐
│  [IMAGE]            │
│  Password: abc123   │
└─────────────────────┘

Defeats text extraction; requires OCR.

Password in Separate Email

Email 1: "Attachment coming in next email"
Email 2: Attachment without password
Email 3: "Password for previous file: X"

Correlation required across messages.

Password via Different Channel

Email: "Password will be sent via SMS"
SMS: "Your document password: X"

Requires compromised phone or SIM swap.

Nested Encryption

outer.zip (password: "first")
└── inner.zip (password: "second")
    └── malware.exe

Multiple layers of protection.

Current State

Status: Active

Password protection remains effective:

Detection Guidance

Email Indicators

Flag emails with:

• Encrypted attachment + password in body
• Known malicious archive types (.zip, .rar, .7z)
• Password patterns in text or images
• Urgency combined with encryption

User Behavior

Train users to:

• Question why file needs to be encrypted
• Verify sender via known contact method
• Report suspicious password-protected files
• Not open unexpected encrypted attachments

SIEM Queries

email.attachment.encrypted = true
AND email.body MATCHES (password|pass|code|pwd)
AND email.sender.domain NOT IN (trusted_domains)

Endpoint Monitoring

Watch for:

• Archive extraction tools spawning executables
• Recently extracted files being executed
• Extraction to temp directories followed by execution