{"uuid": "aec5e85d-8628-485f-a9b7-1afbb411bb2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/hacking_Attack/54646", "content": "Black Hat Ethical Hacking\nSnake Keylogger Spreads Through Malicious PDFs\n\nSnake Keylogger Spreads Through Malicious PDFsPost Views: 2 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nWhile most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found.\nThe campaign\u2014discovered by researchers at HP Wolf Security\u2014aims to dupe victims with an attached PDF file purporting to have information about a remittance payment, according to a blog post\u00a0published Friday. Instead, it loads the info-stealing malware, using some tricky evasion tactics to avoid detection.\n\n\u201cWhile Office formats remain popular, this campaign shows how attackers are also using weaponized PDF documents to infect systems,\u201d HP Wolf Security researcher Patrick Schlapfer wrote in the post, which opined in the headline that \u201cPDF Malware Is Not Yet Dead.\u201d\n\nIndeed, attackers using malicious email campaigns have preferred to package malware in Microsoft Office file formats, particularly Word and Excel, for the past decade, Schlapfer said. In the first quarter of 2022 alone, nearly half (45 percent) of malware stopped by HP Wolf Security used Office formats, according to researchers.\n\n\u201cThe reasons are clear: users are familiar with these file types, the applications used to open them are ubiquitous, and they are suited to social engineering lures,\u201d he wrote.\n\nStill, while the new campaign does use PDF in the file lure, it later employs Microsoft Word to deliver the ultimate payload\u2014the Snake Keylogger, researchers found. Snake Keylogger is a malware developed using .NET that first appeared in late 2020 and is aimed at stealing sensitive information from a victim\u2019s device, including saved credentials, the victim\u2019s keystrokes, screenshots of the victim\u2019s screen, and clipboard data, according to Fortinet. \u2018Unusual\u2019 CampaignThe HPW Wolf Security team noticed a new PDF-based threat campaign on March 23 with an \u201cunusual infection chain,\u201d involving not just a PDF but also \u201cseveral tricks to evade detection, such as embedding malicious files, loading remotely-hosted exploits and shellcode encryption,\u201d Schlapfer wrote.\n\nAttackers target victims with emails that include a PDF document named \u201cREMMITANCE INVOICE.pdf\u201d\u2014misspelling intended\u2013as attachment. If someone opens the file, Adobe Reader prompts the user to open a .docx file with a rather curious name, researchers found.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \u201cThe attackers sneakily named the Word document \u201chas been verified. However PDF, Jpeg, xlsx, .docx\u201d to make it look as though the file name was part of the Adobe Reader prompt,\u201d according to the post.\n\nThe.docx file is stored as an EmbeddedFile object within the PDF, which opens Microsoft Word if clicked on, researchers found. If Protected View is disabled, Word downloads a Rich Text Format (.rtf) file from a web server, which then is run in the context of the open document.\n\nResearchers unzipped the contents of the .rtf\u2014which is an Office Open XML file\u2014finding a URL hidden in the \u201cdocument.xml.rels\u201d file that is not a legitimate domain found in Office documents, they said. 17-Year-Old Bug ExploitedConnecting to this URL leads to a redirect and then downloads an RTF document called \u201cf_document_shp.doc.\u00a0This document contained two \u201cnot well-formed\u201d OLE objects that revealed shellcode exploiting CVE-2017-11882, which researchers said is an \u201cover four-years-old\u201d remote code execution vulnerability (RCE) [...]", "creation_timestamp": "2026-09-02T01:01:48.407009Z"}