metasploit | evil[.]pdf

Sharing

Copy URL Twitter E-mail

General

Target
evil.pdf
Size 45KB
Sample230807-3j77wsbc7z
SHA256 5f707055872ed68921326903567cafbdf8070d43df6ea4cf98990eab05e9925b
MD5 e9133edb59d269e584a9de7c9d99293d
SHA1 28e221a0b4a2bb32a25ef5b453ba6ed7c812e1fd
SHA512 999277b7ccac728228f5fc7a348762401ab28d3f962e60be982869182c90fe5bb6fae165333008d2fc8630f5ae6c88e8924366823d2319bf50dbc94bd9155bea
SSDEEP 768:c02JHTymMYE+pDlYO0snYDHpOq4rPbjvD9Vf6Swwf2egB9O+f7epL3Dzicnjdw:cvJmU/pD2OMDHsRrPhILweegC+TepL3s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pdf javascript metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

10.20.0.15:4444

Signatures

Metasploit family
metasploit
PDF contains JavaScript
Detects presence of JavaScript in PDF files.
pdf javascript
PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
pdf

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/template.pdf

File Explorer

evil.pdf

.pdf 45KB
template.pdf

.exe 72KB

evil.pdf

SHA256 5f707055872ed68921326903567cafbdf8070d43df6ea4cf98990eab05e9925b
MD5 e9133edb59d269e584a9de7c9d99293d
SHA1 28e221a0b4a2bb32a25ef5b453ba6ed7c812e1fd
SHA512 999277b7ccac728228f5fc7a348762401ab28d3f962e60be982869182c90fe5bb6fae165333008d2fc8630f5ae6c88e8924366823d2319bf50dbc94bd9155bea
SSDEEP 768:c02JHTymMYE+pDlYO0snYDHpOq4rPbjvD9Vf6Swwf2egB9O+f7epL3Dzicnjdw:cvJmU/pD2OMDHsRrPhILweegC+TepL3s
MD5 SHA1 SHA512 SSDEEP

Password

infected

template.pdf

IMPHASH 481f47bbb2c9c21e108d65f52b04c448
SHA256 01ccceca3e103f49dbbb6f4a5545186715a4e30179984ad3510ef19afd3d636a
MD5 a3b79d857c1fe59a1e975ae4a0b0939f
SHA1 72ccf958905a4f5e0c512f1a9220f7fd487cb489
SHA512 ff6cf7d86b2d73d8b800b6f1e1448568f98f37c4395f1230a9f11786c4a66740df7447bdeb10d39bef7c4562b6877e8e6c04fd47cab7abb59fd78b427ed520a4
SSDEEP 1536:IBPPSNY4T+s44tNO1rPsncowCCLpfRj6/GMb+KR0Nc8QsJq39:UPMlT+s4FVscoUFNe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

18418

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_iob _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __p___initenv _XcptFilter _exit _onexit __dllonexit strrchr wcsncmp _close wcslen wcscpy strerror modf strspn realloc __p__environ __p__wenviron _errno free strncmp strstr strncpy _ftol qsort fopen perror fclose fflush calloc malloc signal printf _isctype atoi exit __mb_cur_max _pctype strchr fprintf _controlfp _strdup _strnicmp

kernel32

PeekNamedPipe ReadFile WriteFile LoadLibraryA GetProcAddress GetVersionExA GetExitCodeProcess TerminateProcess LeaveCriticalSection SetEvent ReleaseMutex EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateMutexA GetFileType SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GlobalFree GetCommandLineW TlsAlloc TlsFree DuplicateHandle GetCurrentProcess SetHandleInformation CloseHandle GetSystemTimeAsFileTime FileTimeToSystemTime GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime Sleep FormatMessageA GetLastError WaitForSingleObject CreateEventA SetStdHandle SetFilePointer CreateFileA CreateFileW GetOverlappedResult DeviceIoControl GetFileInformationByHandle LocalFree

advapi32

FreeSid AllocateAndInitializeSid

wsock32

getsockopt connect htons gethostbyname ntohl inet_ntoa setsockopt socket closesocket select ioctlsocket __WSAFDIsSet WSAStartup WSACleanup WSAGetLastError

ws2_32

WSARecv WSASend