UnknownPublished 17 May 2017Updated 3 Jul 2025

tlp white · 2017-05-16 Malspam Emailing:#####.pdf.pdf

Affects tlp whiteSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

2017-05-16 Malspam Emailing:#####.pdf.pdf

Impact

For European organizations, this threat poses a risk primarily through phishing and social engineering vectors. If users open the malicious PDF attachments, the ransomware can encrypt critical files, leading to operational disruption, data loss, and financial costs related to ransom payments or recovery efforts. Sectors with high reliance on data availability and integrity, such as healthcare, finance, and critical infrastructure, could face severe consequences. Additionally, the presence of network activity indicates potential for spreading within corporate networks, increasing the scope of impact. The campaign's low severity rating may reflect limited distribution or effectiveness at the time, but ransomware remains a persistent threat in Europe, where organizations are often targeted due to the high value of data and regulatory environments that emphasize data protection. The absence of patches means mitigation relies heavily on user awareness and preventive controls. The threat could also lead to reputational damage and regulatory penalties under GDPR if personal data is affected.

Defensive guidance

To mitigate this threat, European organizations should implement targeted measures beyond generic advice: 1) Enhance email filtering to detect and quarantine suspicious attachments, especially those with double extensions like ".pdf.pdf". 2) Conduct regular, scenario-based phishing awareness training emphasizing the risks of opening unexpected attachments and verifying sender authenticity. 3) Deploy endpoint detection and response (EDR) solutions capable of identifying ransomware behaviors such as unauthorized file encryption and suspicious process spawning. 4) Implement strict application whitelisting to prevent execution of unauthorized binaries dropped by malicious PDFs. 5) Enforce network segmentation to limit lateral movement if ransomware executes. 6) Maintain offline, immutable backups tested regularly to ensure rapid recovery without paying ransom. 7) Monitor network traffic for unusual outbound connections indicative of command and control communication. 8) Establish incident response plans specifically addressing ransomware scenarios, including legal and communication strategies. These focused steps will reduce the likelihood of successful infection and limit damage if an attack occurs.

Indicators of compromise

Domains 25

beautyandearth.com
biarritzru.com
bioferme.biz
daweizhi.com
dodawanie.com
herrossoidffr6644qa.top
jomoba35.com
joshcomeauxhair.com
jsplast.ru
juvadent.de

URLs 27

http://beautyandearth.com/Nbiyure3
http://biarritzru.com/Nbiyure3
http://bioferme.biz/Nbiyure3
http://daweizhi.com/Nbiyure3
http://dodawanie.com/Nbiyure3
http://herrossoidffr6644qa.top/af/Nbiyure3
http://jomoba35.com/Nbiyure3
http://joshcomeauxhair.com/Nbiyure3
http://jsplast.ru/Nbiyure3
http://juvadent.de/Nbiyure3

IP addresses 26

108.167.156.28beautyandearth.com
81.177.141.58biarritzru.com
219.118.71.133bioferme.biz
115.29.111.183daweizhi.com
185.23.21.13dodawanie.com
185.23.21.123dodawanie.com
34.209.214.237herrossoidffr6644qa.top
143.95.239.78jomoba35.com
107.180.13.247joshcomeauxhair.com
194.58.119.16jsplast.ru

Hashes 15

ed8ed2f15cc120d56101f9278d2b7a90
3564428de04f35a9a9c7b1828d60edce
e79e31c6caee2d64b25588337e979eab
c2a760c6461449ac1d5a5538242bed11
2b2c0737949a56528b0834f642ff2635
fabc5b9309a1ffcbf9028cd01cf440edbd654c2faaacf7e64e5a39d63775a33e
2c8ea5c1957ab9ccf4afd255aeea47f13e278814- Xchecked via VT: fabc5b9309a1ffcbf9028cd01cf440edbd654c2faaacf7e64e5a39d63775a33e
387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092- Xchecked via VT: c2a760c6461449ac1d5a5538242bed11
59684c6261afc698c0f6a46658986f0268f4c5a0- Xchecked via VT: c2a760c6461449ac1d5a5538242bed11
aca726cb504599206e66823ff2863eb80c6a5f16ff71ca9fcdd907ad39b2d852- Xchecked via VT: e79e31c6caee2d64b25588337e979eab

Link 8

https://www.virustotal.com/en/file/fabc5b9309a1ffcbf9028cd01cf440edbd654c2faaacf7e64e5a39d63775a33e/analysis/1494930087/
https://malwr.com/submission/status/MmY0ZTQ2ODQzZjNhNDlkNzkyZjJiNDUwZmUzMmRjMGY/
https://www.hybrid-analysis.com/sample/fabc5b9309a1ffcbf9028cd01cf440edbd654c2faaacf7e64e5a39d63775a33e?environmentId=100
https://www.virustotal.com/file/fabc5b9309a1ffcbf9028cd01cf440edbd654c2faaacf7e64e5a39d63775a33e/analysis/1494948925/- Xchecked via VT: fabc5b9309a1ffcbf9028cd01cf440edbd654c2faaacf7e64e5a39d63775a33e
https://www.virustotal.com/file/387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092/analysis/1495000686/- Xchecked via VT: c2a760c6461449ac1d5a5538242bed11
https://www.virustotal.com/file/aca726cb504599206e66823ff2863eb80c6a5f16ff71ca9fcdd907ad39b2d852/analysis/1494969979/- Xchecked via VT: e79e31c6caee2d64b25588337e979eab
https://www.virustotal.com/file/ae7f1496e098b24ed52f3796b2751e31300c1f414cdb9852ccb42dfdc261c98d/analysis/1495008698/- Xchecked via VT: 3564428de04f35a9a9c7b1828d60edce
https://www.virustotal.com/file/04cdba9177bcb633604469e09c5d9348719706ea86f3cdd0aaaf5cb4c6b0dece/analysis/1494994547/- Xchecked via VT: ed8ed2f15cc120d56101f9278d2b7a90

Community reviews

Loading reviews…