The message urged the recipient to forward a report for verification and open an attached ZIP file on a computer. Its disk image carried a signed executable and an unsigned DLL that worked together to run hidden code.
The supplied evidence does not show the “smart filtering” or researcher-specific blocking described in the headline.
It also does not establish that this WhatsApp attachment came from a fake software-download site. Those claims should not be treated as findings of this investigation.
SilverFox Hides Fake Downloads
The WhatsApp attachment was named PDF_C2841_20260911100446.zip. Inside its IMG disk image, researchers found PDF_C2089_20260911100446.exe beside active_desktop_render_x64.dll.
Windows reported a valid signature for the executable from Guangzhou Kugou Technology Co., Ltd. Its metadata identified it as a KuGou launcher. The unsigned DLL instead used metadata resembling a Microsoft Desktop Window Manager component.
Reverse engineering showed that the launcher directly calls the DLL’s SetDesktopMonitorHook() and ClearDesktopMonitorHook() exports.
PDF_C2841_20260911100446.zip. The finance-themed message instructs the recipient to forward the report for verification and open the attachment on a computer (Source: pelagos)The first call enters an obfuscated initialization routine. That routine resolves Windows functions using hash-like identifiers, decodes data with XOR, transforms a 0x2bc0-byte region and copies the result into executable memory.
Dynamic analysis added a matching clue: a successful BCryptDecrypt operation produced an 11,200-byte buffer, equal to 0x2bc0 bytes.
The decrypted data contained @@RAPID_CFG_START@@, the address 134.122.155.135, port 443 and a Chinese string meaning “Default group.”
Other fields remain unresolved. The matching sizes link the static and runtime observations, but do not by themselves prove every step of the unpacking process.
During execution, both files were copied to %APPDATA%\Microsoft\Update\. A registry write created the MicrosoftUpdate value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, giving the staged executable a way to start again when the user signs in.
Pelagosx also recorded 96 outbound connection attempts to 134.122.155.135:443, roughly three seconds apart. These are observed callback attempts, not proof that an operator connected successfully or issued commands.
Defenders can look for the two files together in the roaming-profile update directory, the Run-key value pointing there, and repeated connections to that IP and port.
Useful sample hashes are F712C2A8B4ABF2E299A2B480020333DEB0F43364E9686CDA78B1243C62E4830D for the executable and C1E184615241FE69DB3BF4093A22C7C0BF5D6072D2F51E558142B844E871084F for the DLL.
The signed-program-and-DLL pattern resembles tradecraft in a separate Silver Fox campaign documented by CloudSEK.
That case used a signed Thunder executable and a malicious libexpat.dll to deliver ValleyRAT, but it was a different delivery chain, pelagos said.
Similar behavior is a hunting lead, not firm attribution of this Malaysian WhatsApp case to Silver Fox.
Microsoft has separately reported fake software-download sites in activity it assessed as consistent with Silver Fox; its report does not establish that the sites were part of this WhatsApp delivery.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
