|More from: | SANS Internet Storm Center ||
Reader Fred submitted a suspicious PDF received via email.
It’s a classic phishing PDF (for the Apple Store), like I have analyzed here in previous diary entries. It can be quickly analyzed with pdfid and pdf-parser, like this:
Notice the long URL, with another URL as parameter at the end: this first URL is a redirector.
The second URL, bitleyco, is an URL shortener:
It has some interesting features for an attacker, like Geotargeting and Device targeting:
And also statistics: just append a plus (+) to the URL and you get statistics. Unfortunately for me, I got a 404 for the phishing URL.
This URL shortening service is not very popular:
So you can add
Read full article » https://isc.sans.edu/diary/rss/23978
About | SANS Internet Storm Center |
The ISC was created in 2001 following the successful detection, analysis, and widespread warning of the Li0n worm. Today, the ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers.
The ISC relies on an all-volunteer effort to detect problems, analyze the threat, and disseminate both technical as well as procedural information to the general public. Thousands of sensors that work with most firewalls, intrusion detection systems, home broadband devices, and nearly all operating systems are constantly collecting information about unwanted traffic arriving from the Internet. These devices feed the DShield database where human volunteers as well as machines pour through the data looking for abnormal trends and behavior. The resulting analysis is posted to the ISC's main web page where it can be automatically retrieved by simple scripts or can be viewed in near real time by any Internet user.