Exposing the "PDF Botnet" – An OSINT Analysis

Dear blog readers,

I’ve recently stumbled upon a pretty interesting and worth mentioning malicious software and botnet spam and malicious software serving campaign that can be best described as a “PDF botnet” where the ultimate idea for both propagation and infection is the active utilization of PDF files which are exclusively hosted on compromised or on purposely malicious and fraudulent rogue and bogus infrastructure.

Sample screenshots include:

Sponsorships Available

Sponsorships Available

Sponsorships Available

Sample URLs known to have been involved in the campaign include:

hxxp:[/][/]ragaz[.]co[.]za[/]XSRYdR1H?utm_term=picsart+background+image++hd

hxxp:[/][/]www[.]lbtfilm[.]com[/]uploads[/]files[/]koxuwegemagobuwidewas[.]pdf

hxxp:[/][/]teputire[.]weebly[.]com[/]uploads[/]1[/]3[/]0[/]8[/]130813428[/]tixok[.]pdf

hxxp:[/][/]www[.]hypnotiseur[.]com[/]wp-content[/]plugins[/]formcraft[/]file-upload[/]server[/]content[/]files[/]16210e2f2aed0f—favagujegelivos[.]pdf

hxxp:[/][/]applecentervn[.]com[/]uploads[/]image[/]files[/]81922078809[.]pdf

hxxp:[/][/]villamishkan[.]com[/]310renonew[/]front[/]images[/]files[/]womosutilonotolil[.]pdf

hxxp:[/][/]jackinthegymtpe[.]com[/]uploads[/]files[/]202204101711569256[.]pdf

hxxp:[/][/]jigupipugefelo[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]3[/]134387822[/]kexowanegakuxiku[.]pdf

hxxp:[/][/]ulicetwojegomiasta[.]pl[/]kcfinder[/]upload[/]files[/]vadanetezukamiludi[.]pdf

hxxp:[/][/]toys4boysleather[.]com[/]userfiles[/]file[/]7982175874[.]pdf

hxxp:[/][/]93564497[.]com[/]userfiles[/]texanefimewakatovatoz[.]pdf

hxxp:[/][/]ceb[.]lk[/]assets[/]js[/]kcfinder[/]upload[/]files[/]58252873057[.]pdf

hxxp:[/][/]glassinter[.]de[/]kcfinder[/]upload[/]upload[/]23524790716[.]pdf

hxxp:[/][/]jaxurevinul[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]8[/]134868463[/]3f2975c6121556[.]pdf

hxxp:[/][/]szm[.]hu[/]userfiles[/]file[/]wenutoxeworudif[.]pdf

hxxp:[/][/]dojexivosofu[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]3[/]134348646[/]6486123[.]pdf

hxxp:[/][/]veraschwemmle[.]de[/]fckdata[/]file[/]dugivisoxolel[.]pdf

hxxp:[/][/]happycondo[.]leaddeehub[.]com[/]userfiles[/]files[/]lipefagajetelegusir[.]pdf

hxxp:[/][/]ninofupefuf[.]weebly[.]com[/]uploads[/]1[/]3[/]1[/]8[/]131856131[/]6e401701aa[.]pdf

hxxp:[/][/]www[.]auditsi[.]com[/]wp-content[/]plugins[/]formcraft[/]file-upload[/]server[/]content[/]files[/]1622914d312f84—45312087428[.]pdf

hxxp:[/][/]www[.]christinemartin[.]co[.]uk[/]wp-content[/]plugins[/]formcraft[/]file-upload[/]server[/]content[/]files[/]1621dac28b28a0—tufupavokuj[.]pdf

hxxp:[/][/]sendedianqi[.]com[/]upload_fck[/]file[/]2022-3-21[/]20220321161426543141[.]pdf

hxxp:[/][/]erdelyironkbutor[.]hu[/]admin[/]kcfinder[/]upload[/]files[/]sukotigipapewefowu[.]pdf

hxxp:[/][/]studioingegneriavaragnolo[.]com[/]userfiles[/]files[/]kilukowap[.]pdf

hxxp:[/][/]f-kcc[.]jp[/]user_data[/]userfiles[/]files[/]22156092393[.]pdf

hxxp:[/][/]alkoplast[.]rs[/]files[/]28560168304[.]pdf

hxxp:[/][/]arborspringsforestry[.]com[/]img[/]files[/]kelagug[.]pdf

hxxp:[/][/]cissud[.]it[/]uploads[/]ck_editor[/]files[/]33956310758[.]pdf

hxxp:[/][/]jfd[.]news[/]app[/]webroot[/]uploads[/]files[/]71167178402[.]pdf

hxxp:[/][/]leg-vein[.]jp[/]kcfinder[/]upload[/]files[/]sevavimelozojufezetowe[.]pdf

hxxp:[/][/]duxotitur[.]weebly[.]com[/]uploads[/]1[/]3[/]4[/]5[/]134596147[/]5545494[.]pdf

hxxp:[/][/]tree-house[.]jp[/]assets[/]news[/]files[/]tevasurodajaxajezetatug[.]pdf

hxxp:[/][/]kikebazelagugez[.]weebly[.]com[/]uploads[/]1[/]4[/]1[/]2[/]141287616[/]77fd513b304b[.]pdf

*** This is a Security Bloggers Network syndicated blog from Dancho Danchev's Blog - Mind Streams of Information Security Knowledge authored by Dancho Danchev. Read the original post at: https://ddanchev.blogspot.com/2023/03/exposing-pdf-botnet-osint-analysis.html