{"id":1172,"date":"2024-08-30T05:05:22","date_gmt":"2024-08-30T05:05:22","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=1172"},"modified":"2025-07-28T15:54:01","modified_gmt":"2025-07-28T15:54:01","slug":"virus-total-delivers-clean-result-for-malicious-pdf-file","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/virus-total-delivers-clean-result-for-malicious-pdf-file\/","title":{"rendered":"Virus Total Delivers Clean Result For Malicious PDF file"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

This PDF file was received in a suspicious email from an unknown sender:<\/p>\n\n\n\n

\"\"
Figure 1 Attachment in spam mail<\/em><\/figcaption><\/figure>\n\n\n\n

When we checked the hash value of the file on the Virus Total website to determine whether it had been flagged as malicious, the file was present, but it’s detection rate was 0\/56. Here is that link.  We have continued to monitor and as of the latest analysis, the detection rate had increased to only 15\/56 with many of the leading antivirus tools failing to detect.<\/p>\n\n\n\n

We have dissected the file to look for any malicious content inside.<\/p>\n\n\n\n

Static Analysis:<\/strong><\/p>\n\n\n\n

We found the following suspicious code:<\/p>\n\n\n\n

  <<\n\n    \/Type \/Action\n\n    \/S \/URI\n\n    \/URI (https:\n\n    \/ \/bit.ly\n\n    \/2p9sWKu )\n\n  >>\n\n\/StructParent 0<\/code><\/pre>\n\n\n\n
\n
><\/p>\n<\/blockquote>\n\n\n\n
Note the link: bit(.)ly \/2p9sWKu (short url)<\/p>\n\n\n\n
Expanded URL: hxxp:\/\/democrats(.)ge\/images\/stories\/august\/documents(.)php<\/p>\n\n\n\n
Dynamic Analysis:<\/strong><\/p>\n\n\n\n
\"\"
Figure 2 PDF Dynamic analysis<\/em><\/figcaption><\/figure>\n\n\n\n
When we executed the suspicious PDF file, a message reads that it is a \u201cSecured PDF Online Document\u201d which can be viewed on the Adobe site. The same shortened URL is found to be the online site here.<\/p>\n\n\n\n
Website and Code Analysis:<\/strong><\/p>\n\n\n\n
The Virus Total result of the above URL identifies that it is malicious and a phishing site. See that link here.<\/p>\n\n\n\n
We visited the site and downloaded that php code for analysis. It was heavily obfuscated.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
So, we de-obfuscated the code and found the following code.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
When we de-obfuscated it a second time, we found the following:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
This is an iframe injection. We checked that site hxxp:\/\/limpdexa(.)com<\/p>\n\n\n\n
Virus Total also identifies it as a malware site. See that link here.<\/p>\n\n\n\n
This is also flagged as a malicious website: https:\/\/urlscan.io\/result\/2077850e-e12a-4e75-a598-a2374ffcffb3#summary (a malicious site according to Google safe browsing).<\/p>\n\n\n\n
A screenshot of a similar landing page.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Conclusion:<\/strong><\/p>\n\n\n\n
We believe this is a phishing, password stealer using Adobe as the main vector, and one that is not being universally identified as can be seen by the ongoing lag in detection as reported by Virus Total.<\/p>\n","protected":false},"excerpt":{"rendered":"
When we checked the hash value of the file on the Virus Total website to determine whether it had been flagged as malicious, the file was present, but it’s detection rate was 0\/56. Here is that link. \u00a0We have continued to monitor and as of the latest analysis, the detection rate had increased to only 15\/56 with many of the leading antivirus tools failing to detect. We have dissected the file to look for any malicious content inside.<\/p>\n","protected":false},"author":1,"featured_media":1180,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1172","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=1172"}],"version-history":[{"count":4,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1172\/revisions"}],"predecessor-version":[{"id":4445,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1172\/revisions\/4445"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/1180"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=1172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=1172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=1172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}