Compiled HTML File

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such as VBA, Jscript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe).

A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe

Example

In this Demo a simple CHM file created and being executed, I have added references to manually and automatically create these payloads

Will use the Out-CHM to create the payload, by adding the payload parameter where it is located and the hh.exe utility for it to compile it in a format capable for hh.exe in understanding

Once this is done, execution is simple.

References:

https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7

https://github.com/samratashok/nishang/blob/master/Client/Out-CHM.ps1