In the past 10 years, attackers have liked to package some malware distributed through emails into Microsoft Office file formats, especially Word and Excel files. Among other reasons, users are more familiar with these file types, and their protection is lax. Moreover, the applications used to open these files are ubiquitous, so they are very suitable for use as bait. Now it has a new form, with the same purpose of invading your world.
Unscrupulous people include Word files in PDF attachments to trick you into downloading them and secretly record your keyboard usage.
After long-term reporting and education, users are now more aware of the files contained in letters, so malicious people have begun to use another way to trick you into downloading harmful software.HP Wolf Security In a new report, researchers detail how unscrupulous individuals are using PDF files as delivery vehicles for files containing macros that download and install information-stealing malware on victims’ computers.
These unclean PDF files are usually with file names that everyone pays special attention to, such as “remittance invoice”, and are included in letters containing simulated promises to recipients. When you open the PDF, Adobe Reader will prompt the user to open the DOCX file contained in it. This is a very rare situation and may confuse the victim. Since the name of the threat actor naming the embedded file is directly called “Verified”, “File Verified” will be named in the subsequent “Open File” reminder. This prompt may trick the recipient into believing that Adobe has verified that the file is clean and safe to open.
While malware analysts can use parsers and scripts to examine embedded files in PDFs, it can be difficult for the average user who receives such a letter to tell or even know where to start. Therefore, many people may open DOCX directly in Microsoft Word, but when you activate the macro, the RTF file will be automatically downloaded from the remote resource and opened. The RTF file, named “f_document_shp.doc”, contains an OLE object with incorrect formatting that may allow it to evade analysis. After a targeted rebuild, HP analysts discovered that it was trying to abuse an older version of Microsoft Equation Editor to run arbitrary code.
Without running it further, HP security analysts saw the malware download an unauthorized file called “fresh.exe” and use ShellExecuteExW to run it in a public user directory. This executable file can be the notorious modular .NET keylogger and key credential stealer “Snake Keylogger”, which can record various activities entered by users on the keyboard, thereby causing damage to the victim’s personal privacy and property.
While Office formats remain popular with bad actors, this campaign shows how attackers can use PDF files to circumvent systems. Embedding files, loading remotely hosted attacks, and encrypted shellcode are just three of the techniques attackers use to run malware under the radar. The vulnerability exploited in this campaign (CVE-2017-11882) is more than four years old but continues to be exploited, indicating that it is still available to attackers and has not yet been patched.
Source: KOCPC Chinese