The following screenshot shows a victim running the chm help file. As their use is so common, we wouldn’t normally be suspicious of using the online help:

chm help files are often used for software documentation and help guide tutorial. As a result, it is still being used by attackers who can remain FUD (Fully Undetected) by current Anti-Virus engines. Microsoft has not yet developed a patch to block this exploit method. chm files can be used to execute code on a victim computer running Microsoft Windows Vista, and higher.Ĭheck Point has discovered cyber criminals that are using this technique to spread malware and carry out attack campaigns using social media and spam mail. CHM (compiled HTML).Ĭheck Point researcher Liad Mizrachi has conducted research showing that. These files are compressed and deployed in a binary format with an extension of. “Microsoft Compiled HTML Help” is a Microsoft proprietary online help format that consists of a collection of HTML pages, indexing and other navigation tools.

Chm document