learn cybersecurity
Every day everybody receives many phishing attacks with malicious docs or PDFs. I decided to take a look at one of these files. I did a static analysis and I went straight to the point to make this reading simple and fast.
Here is the received email as it was from the Caixa Economica Federal bank, but we can see the sender uses Gmail services and a strange name.
I verified this e-mail header using MXtoolbox, and we can see the IP used by the sender (attacker).
Below is the reputation of the IP used by the attacker.
We can see this IP has a lot of mentions about malicious activities.
I downloaded this file in my VPS (Kali Linux) and used peepdf to do an analysis of the file structure, and I found 2 URIs in objects 3 and 5.
After I checked objects 3 and 5 using pdf-parser, I discovered a malicious URL in the 3.
I did a check about this URL in VirusTotal and it had a malicious reputation.
When I opened the file in the Kali, we could see it had an original logo of the bank and a button to click that will direct me to an URL.
When I clicked in this button the URL hxxp://cefonlineencaminha[.]z13[.[]web[.]core[.]windows[.]net redirect to another URL ms[.]meuappavisos[.]com
I checked the URL reputation, and it has a lot of mentions about it.
In conclusion, it’s essential to take care and attention to each detail when you open this kind of email because you can put your machine in a dangerous situation, have your data exfiltrated, be hacked and etc.
Tools used during the analysis:
You may also enjoy reading, CVEs You May Have Missed While Log4J Stole The Headlines
Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today
Remember, CyberSecurity Starts With You!
This post was last modified on 13 February 2022 4:46 PM
British high street chain WH Smith has recently revealed that it was hit by a…
As banks worldwide roll out Voice ID as a means of user authentication over the…
In the era of digital transformation, cybersecurity has become a major concern for businesses. When…
In today's digital age, cybersecurity threats have become a significant concern for businesses of all…
The RIG Exploit Kit is currently in the midst of its most productive phase, attempting…
One of the most transformational technologies of our time, artificial intelligence (AI), has quickly come…
Leave a Comment