Exposing the “PDF Botnet” – An OSINT Analysis

Dear blog readers,

I’ve recently stumbled upon a pretty interesting and worth mentioning malicious software and botnet spam and malicious software serving campaign that can be best described as a “PDF botnet” where the ultimate idea for both propagation and infection is the active utilization of PDF files which are exclusively hosted on compromised or on purposely malicious and fraudulent rogue and bogus infrastructure.

Sample screenshots include:

Sample URLs known to have been involved in the campaign include:

hxxp:[/][/]ragaz[.]co[.]za[/]XSRYdR1H?utm_term=picsart+background+image++hd

hxxp:[/][/]www[.]lbtfilm[.]com[/]uploads[/]files[/]koxuwegemagobuwidewas[.]pdf

hxxp:[/][/]teputire[.]weebly[.]com[/]uploads[/]1[/]3[/]0[/]8[/]130813428[/]tixok[.]pdf

hxxp:[/][/]www[.]hypnotiseur[.]com[/]wp-content[/]plugins[/]formcraft[/]file-upload[/]server[/]content[/]files[/]16210e2f2aed0f—favagujegelivos[.]pdf

hxxp:[/][/]applecentervn[.]com[/]uploads[/]image[/]files[/]81922078809[.]pdf

hxxp:[/][/]villamishkan[.]com[/]310renonew[/]front[/]images[/]files[/]womosutilonotolil[.]pdf

hxxp:[/][/]jackinthegymtpe[.]com[/]uploads[/]files[/]202204101711569256[.]pdf

hxxp:[/][/]jigupipugefelo[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]3[/]134387822[/]kexowanegakuxiku[.]pdf

hxxp:[/][/]ulicetwojegomiasta[.]pl[/]kcfinder[/]upload[/]files[/]vadanetezukamiludi[.]pdf

hxxp:[/][/]toys4boysleather[.]com[/]userfiles[/]file[/]7982175874[.]pdf

hxxp:[/][/]93564497[.]com[/]userfiles[/]texanefimewakatovatoz[.]pdf

hxxp:[/][/]ceb[.]lk[/]assets[/]js[/]kcfinder[/]upload[/]files[/]58252873057[.]pdf

hxxp:[/][/]glassinter[.]de[/]kcfinder[/]upload[/]upload[/]23524790716[.]pdf

hxxp:[/][/]jaxurevinul[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]8[/]134868463[/]3f2975c6121556[.]pdf

hxxp:[/][/]szm[.]hu[/]userfiles[/]file[/]wenutoxeworudif[.]pdf

hxxp:[/][/]dojexivosofu[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]3[/]134348646[/]6486123[.]pdf

hxxp:[/][/]veraschwemmle[.]de[/]fckdata[/]file[/]dugivisoxolel[.]pdf

hxxp:[/][/]happycondo[.]leaddeehub[.]com[/]userfiles[/]files[/]lipefagajetelegusir[.]pdf

hxxp:[/][/]ninofupefuf[.]weebly[.]com[/]uploads[/]1[/]3[/]1[/]8[/]131856131[/]6e401701aa[.]pdf

hxxp:[/][/]www[.]auditsi[.]com[/]wp-content[/]plugins[/]formcraft[/]file-upload[/]server[/]content[/]files[/]1622914d312f84—45312087428[.]pdf

hxxp:[/][/]www[.]christinemartin[.]co[.]uk[/]wp-content[/]plugins[/]formcraft[/]file-upload[/]server[/]content[/]files[/]1621dac28b28a0—tufupavokuj[.]pdf

hxxp:[/][/]sendedianqi[.]com[/]upload_fck[/]file[/]2022-3-21[/]20220321161426543141[.]pdf

hxxp:[/][/]erdelyironkbutor[.]hu[/]admin[/]kcfinder[/]upload[/]files[/]sukotigipapewefowu[.]pdf

hxxp:[/][/]studioingegneriavaragnolo[.]com[/]userfiles[/]files[/]kilukowap[.]pdf

hxxp:[/][/]f-kcc[.]jp[/]user_data[/]userfiles[/]files[/]22156092393[.]pdf

hxxp:[/][/]alkoplast[.]rs[/]files[/]28560168304[.]pdf

hxxp:[/][/]arborspringsforestry[.]com[/]img[/]files[/]kelagug[.]pdf

hxxp:[/][/]cissud[.]it[/]uploads[/]ck_editor[/]files[/]33956310758[.]pdf

hxxp:[/][/]jfd[.]news[/]app[/]webroot[/]uploads[/]files[/]71167178402[.]pdf

hxxp:[/][/]leg-vein[.]jp[/]kcfinder[/]upload[/]files[/]sevavimelozojufezetowe[.]pdf

hxxp:[/][/]duxotitur[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]5[/]134596147[/]5545494[.]pdf

hxxp:[/][/]tree-house[.]jp[/]assets[/]news[/]files[/]tevasurodajaxajezetatug[.]pdf

hxxp:[/][/]kikebazelagugez[.]weebly[.]com[/]uploads[/]1[/]4[/]1[/]2[/]141287616[/]77fd513b304b[.]pdf

The post Exposing the “PDF Botnet” – An OSINT Analysis appeared first on Security Boulevard.

Read MoreSecurity Boulevard

Views: 0