Dissecting Suspicious PDF files using REMnux.

Latrodectus

Disclaimer:

The analysis of malware must only be conducted in a properly configured, isolated sandbox environment. Under no circumstances should malware or suspicious files be handled outside of a controlled and secure environment. Always rigorously verify the authenticity of any document, especially PDFs or email attachments, before interacting with them to prevent unintentional system compromise. This blog is provided for educational purposes only.

Introduction :

For this blog, I will be using the Malware Bazaar database by Abuse.ch. Numerous samples are uploaded to the site every hour. Depending on the file you’re looking for, you can search for them using the appropriate syntax.

Although if you are looking for a quick search for pdf files, refer below:

  filetype:pdf

As a sample file, we used the below file for our analysis:

Here is the SHA256 hash from Virustotal : VirusTotal — File — 9692613a9bae252b259625f7949f697a50f3bb9a3692f53a6cbb91ca069e29b5

Preview of the PDF looks like below:

Using Peepdf we can examine the Contents of the PDF, which gives you the hashes and the elements/breakdown of the PDF structure:

• We are interested in the objects, streams and suspicious elements.

Other tool which we used was Pdfid which gives us a good structured information as shown below:

We are interested in two key elements: /URIand /OpenAction, which signifies that the PDF is configured to perform a specific action upon opening.

Get Nived Sawant’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Information on /Open action can be found here : PDF Analysis Intro and OpenActions Entries — SANS Internet Storm Center

Keeping these two key points in mind, we can also analyze each object individually and the simplest approach is to open an interactive session using Peepdf.

This can be done using the below command within the tool— peepdf

In order to examine each object in the PDF, just input the below command :

  object [Number of the object]

While examining object 3, we had an interesting find which was an URL and then a possible redirect, although the later part was encoded.

In order to decode, we used Cyber Chef and the Recipe used was URL decode.

The decoded URL redirects to a domain,hosting another PDF file named sample-invoice.pdf. Interestingly, this PDF neither contains additional redirects nor requires user interaction, and it does not include any JavaScript or embedded URLs. It appears to be the final element in the puzzle, as no further activity was observed during our investigation beyond this point.

Redirect chain looks like below:

Although looking into the domains associated which are:

hxxp://einkcn[.]com which is hosted on 47[.]93[.]180[.]191 is associated with Brute Ratel C4 and Latrodectus malware and is currently listed as offline.

hxxp://bof[.]mekall[.]com which is hosted on 150[.]241[.]68[.]144 also appears suspicious as it redirects to : —

hxxps://www[.]wmaccess[.]com[/]downloads[/]sample-invoice[.]pdf