Outfoxing a Malicious PDF: An attacker's attempt to deliver a Stealc infostealer

Last updated 11 months ago

Intro

While scrolling through the X/Twitter feed, I noticed an interesting thread created by furryneko ().

The reason I was talking with him is that we share mutual followers whom I know and respect.

After a while, oscarxferral was offered a two-week paid internship.

$1500/week, 2-3 hours working, LMAO
Everything sounded too good to be true, which raised a red flag

The conversation continued in Discord, and oscarxferral was given a PDF file that "contains" the non-disclosure agreement.

Interestingly, "pabloNFT" emphasized using an old Foxit PDF Reader, specifically versions 12.0.2 or 12.1.0, since "their seals will not be displayed on the most recent version."

With all those red flags, oscarxferral uploaded the PDF file in Virustotal to do a final check.

The PDF (dropper)

I was curious about the kind of malware the PDF file delivers, so I examined the sample further.

Let's check with peepdf

Object 8 has a JavaScript code. Let's take a look at it.

Since it has a filter, I decided to pass the stream object through a filter, FlateDecode, via -f and view the raw output via -w

Here's the prettified content

We can infer that once the document is fully loaded (ready), then it executes the JavaScript payload to trigger event.target.exportXFAData after a delay of 0.5 seconds.

The exportXFAData is intended to export form data to a specified path. In this case, it is used maliciously to target the startup folder, C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\officeupdate.hta, to ensure persistence. The .hta file will be executed whenever the target signs in after logging out or after restarting/shutting down the computer.

I decided to extract further data in case I missed anything, using pdfextract...

Interesting, there are two scripts...

So, it was able to extract the JavaScript payload from earlier and another one, which will retrieve an executable file via Powershell.

Where is this located? I checked each stream and found it on stream/object 7.

Here's the prettified version:

This is the document's XFA configuration, which will be included in the export from earlier.

It uses JScript to execute a Powershell command to retrieve stale.exe from brazilanimalshelp[.]com , saves it to the startup folder as SecurityUpdate.exe, then executes the 2nd stage via Start-Process. It may look like persisting...though not really, which will be explained later.

Now we have the important payloads, let's try to open it with the desired Foxit PDF Reader versions of the malicious actor, namely:

12.0.2.12465
12.1.0.15250

During the installation, there's a Safe Reading Mode Setting, this is ticked by default, and I left it as it is just to see whether it would really work.

Now, let's open the PDF file...

It doesn't display anything other than executing the malicious script in the background.

It immediately creates the officeupdate.hta file in the startup folder, which renders the Safe Reading Mode useless.

This will likely be used as an excuse by the malicious actor to tell oscarxferral to restart/shut down the computer or log out for the "right" content to display, which will lead to the .hta file being executed due to its presence in the startup folder.

Here's the prettified content of the .hta file.

The chunk's contents are simply a base64 encoded text of the whole PDF file.

When the PDF file is opened using a different reader, say using Firefox, it won't execute the malicious script and will only show different content.

Restarted the computer to see the persistence in action. After logging in, a Powershell window shows up for a bit and this error is displayed.

Although it says an error has occurred, it will still execute the script without issues.

The executable file (2nd stage)

Let's take a look at it using Detect It Easy (DIE).

This was compiled using VB.NET, unsigned, and the original filename is guide_to_the_clubs_and_bars_of_the_city.exe

I tried to check using dnSpy...

...but it's obfuscated. I didn't notice anything important using floss either.

Decided to do a dynamic analysis instead.

An MSBuild.exe child process was spawned after a few minutes and stale.exe terminated itself. MSBuild can be seen doing a network request to 194.120.116[.]120

Created a full dump using process explorer and extracted the strings...

Interestingly, the behavior seems to be infostealer-like. The value of the file is a base64 encoded data of the target's machine, most likely for fingerprinting.

Remember earlier that this executable file is stored in the startup folder? Well, it won't persist. Sekoia determined that it self-deletes.

This can be seen in the dump as well.

CVE what?

I wondered if a CVE exists for a vulnerability targeting Foxit PDF Reader 12.0.2.12465 and 12.1.0.15250...

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in the exportXFAData method and is thus forced to write to the Startup folder with an .hta file that can execute arbitrary code after a restart. (CVE-2023-27363)

IOCs

Last updated 11 months ago