Deep Analysis of a Weaponized HTML Phishing Attachment
Dissection of an obfuscated SVG/HTML attachment designed to steal Microsoft 365 credentials through credential harvesting and iframe cloaking.
Environment: Training Lab — This investigation was performed in an isolated training environment. Indicators, systems, accounts, and other data shown here are simulated or sanitized unless otherwise stated.
Executive Summary
An inbound email bypassed automated spam filters by embedding a weaponized SVG attachment named "Encrypted_Remittance_Advice.svg". Analysis revealed embedded JavaScript utilizing HTML smuggling to reconstruct a Base64-encoded login form impersonating a Microsoft 365 login screen. Exfiltration was directed to an adversary-controlled webhook endpoint.
Scenario & Trigger
An internal employee reported a suspicious email appearing to originate from accounts-payable@supplier-partner.com. The message urged immediate review of an overdue payment notice.
ReportedBy="analyst_test@corp.local" Subject="Payment Overdue #77102" Attachment="Encrypted_Remittance_Advice.svg" SPF="Pass" DKIM="Fail"Initial Evidence
- Email Subject: "Payment Overdue #77102"
- Sender: accounts-payable@supplier-partner.com (Display name: Partner Billing)
- Return-Path: bounce@adversary-infra-test.org
- Attachment: Encrypted_Remittance_Advice.svg (File size: 34.2 KB)
- SPF: Pass (domain matched sender), DKIM: Fail (signature mismatch)
Investigation Methodology & Narrative
Step 1: Extracted raw RFC 822 email headers. Identified header discrepancies: the "From" header was spoofed to mimic a known vendor, but the Received hop originated from a known bulletproof hosting provider in Bulgaria.
Step 2: Isolated the SVG attachment on REMnux. Inspected raw XML. Located a <script> tag containing heavily obfuscated JavaScript using variable substitution and String.fromCharCode arrays.
Step 3: De-obfuscated script logic in CyberChef. Found the code dynamically constructs a Blob object of type "text/html" and invokes window.URL.createObjectURL() to trigger a fake login page inside the browser memory (HTML smuggling).
Step 4: Identified the credential submission POST endpoint: "hxxps://auth-office365-verify[.]com/gate.php".
Step 5: Checked proxy telemetry to ensure no corporate users submitted credentials to this gate URL.
Incident Timeline
| Time (UTC) | Event | Telemetry Source | Analyst Note |
|---|---|---|---|
| 09:05:18 UTC | Email received by mail gateway | Mail Gateway Log | Passed heuristic scanner because SVG was categorized as graphic asset |
| 09:14:02 UTC | User flagged email via phishing report button | M365 Phish Alert | User exhibited high security awareness and avoided opening attachment |
| 09:20:00 UTC | Analyst retrieved attachment into isolated REMnux sandbox | SOC Triage | Static code dissection begun |
| 09:42:15 UTC | Gate URL and adversary host identified | CyberChef Output | Domain auth-office365-verify[.]com registered 48 hours prior |
| 09:55:00 UTC | Perimeter firewall block rule pushed | DNS / Proxy Filter | Global domain block established |
Indicators of Compromise (IOCs)
| Type | Observed Value | Context | Reputation |
|---|---|---|---|
| Domain | auth-office365-verify.com | Adversary credential harvesting portal | Malicious |
| URL | hxxps://auth-office365-verify[.]com/gate.php | Credential drop endpoint | Malicious |
| SHA-256 | 4a6b29d1088d8b94f1c93a0b1f81d11f6c77bb28e23547f2dbab82199b0c7931 | Hash of Encrypted_Remittance_Advice.svg | Malicious |
Log Analysis & Telemetry Dissection
function buildPayload() {
var b64Data = "PGh0bWw+PGhlYWQ+PHRpdGxlPlNpZ24gaW4gdG8geW91ciBhY2NvdW50PC90aXRsZT48L2hlYWQ+PGJvZHk+...";
var byteCharacters = atob(b64Data);
var byteNumbers = new Array(byteCharacters.length);
for (var i = 0; i < byteCharacters.length; i++) {
byteNumbers[i] = byteCharacters.charCodeAt(i);
}
var byteArray = new Uint8Array(byteNumbers);
var blob = new Blob([byteArray], {type: "text/html"});
var link = document.createElement("a");
link.href = window.URL.createObjectURL(blob);
link.download = "Document_Viewer.html";
link.click();
}Analysis Note: Demonstrates HTML smuggling: the script builds an HTML file in client memory from Base64, bypassing perimeter file inspection.
MITRE ATT&CK Mapping
Findings & Final Classification
Recommended SOC Response & Hardening
- •Block domain auth-office365-verify.com at recursive DNS resolvers and web proxies.
- •Configure email gateway to restrict or disarm active content (<script>) inside SVG attachments.
- •Purge identical messages by Message-ID and Subject across corporate mailboxes.
- •Send positive recognition note to reporting user to encourage vigilant reporting.
Analyst Reflection: What I Learned
• SVG files are XML documents capable of executing arbitrary JavaScript when rendered directly in modern browsers.
• DKIM header failures combined with differing Return-Path addresses provide high-confidence early signals of domain spoofing.