Potential Network Intrusion Through PDF

[infamousk]

I received a pdf file that upon download Norton Ultra notified me of a script used to install malicious software in the file and sanitized it.

I ran the file through virus total and there were a couple curious comments.

Im providing a copy of the results here.  Can anyone tell me what this means?

I also parsed an /objstm in the PDF file and found some more things that are curious, including missing metadata on an /objstm modification.  

 

Can anyone tell me what's going on? Was this file coded to somehow cause a data breach or network intrusion?

VirusTotal - File - 3058863cd7da6ac3993305641a06c47c72d3618cc66faf19daf02b3658490160(2).pdf VirusTotal - File - 3058863cd7da6ac3993305641a06c47c72d3618cc66faf19daf02b3658490160(1).pdf VirusTotal - File - 3058863cd7da6ac3993305641a06c47c72d3618cc66faf19daf02b3658490160.pdf

[infamousk]

The attached files are the virus total scan results.  If this isn't appropriate please tell me where to go to post and show me where to find the rules on how to post.

 

[infamousk]

And if the files are inappropriate or not allowed like that in general the indications I'm most concerned of are http-length message body truncated at snort registered user ruleset level.  But then it says unknown underneath it.

 

It also has something about mitre attacks and masquerade something.

 

I'm really concerned.

[David H. Lipman]

Please take that suspicious PDF and place it in a RAR, ZIP or 7zip Archive and create a new post in;  Newest Malware Threats  and attach the Archive file as well as post the actual Virus Total Report URL alongside the 'PDF in Archive' submission.

Thank you in advance.

Edited May 24, 2023 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[infamousk]

1 hour ago, David H. Lipman said:

Please take that suspicious PDF and place it in a RAR, ZIP or 7zip Archive and create a new post in;  Newest Malware Threats  and attach the Archive file as well as post the actual Virus Total Report URL alongside the 'PDF in Archive' submission.

Thank you in advance.

 

 

 

[AdvancedSetup]

Please run the following @infamousk

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

 

[infamousk]

3 hours ago, AdvancedSetup said:

Please run the following @infamousk

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

 

Is there a tool to do this on Ubuntu?  I have since done a reset on my laptop since dow loading the file.  I then created a standalone portable SSD with Ubuntu operating system on it.

 

I then disabled my windows boot manager and subsequently booted from the SSD.  I then downloaded the file with absolutely no security system installed onto the portable SSD.

 

So I would have to run a similar scan on there.  How would I do that?

[AdvancedSetup]

Sorry, we don't support Linux

You'd need to visit a forum that fully supports Linux desktop solutions.

 

[David H. Lipman]

The PDF was not malicious.

 

[David H. Lipman]

Since the PDF was created by a legitimate source with you being named correspondent and said PDF was not found to be malicious and you are on Linux, which is unsupported in the Windows Malware Removal Help & Support sub-forum, I am closing this thread.

Thank you for the opportunity to examine and very the associated PDF.

[David H. Lipman]

Since this issue is resolved the topic will now be closed to prevent others from posting here.

If you need assistance please start your own new topic and someone will be happy to assist you.

Thanks