Boleto Malspam Leads to Symmi

Boleto Malspam Leads to Symmi

It starts with an email

The pdf button goes to a servint.net link, which in turn goes to dropbox.com

We're left with BOLETO-29-06-2016.PDF.zip, which extracts to BOLETO-29-06-2016.jar.  Decompiling the jar file we see several interesting bits

the key and most of the crypto routine were pulled from avajava.com tutorials.  After decrypting the files we're left with two 64 bit files, and two 32 bit files

c4cb4fdf6369dd1342d2666171866ce5 is apparently calc.exe (?), the rest are packed with VMProtect.  VT Links:

https://www.virustotal.com/en/file/2db1aa1eed26fd3805c121ed42af2a35f93af22932462f4919b190b1cf5464dc/analysis/

https://www.virustotal.com/en/file/700ee0e9c1e9dc18114ae2798847824577e587813c72b413127fb70b9cb042dd/analysis/

https://www.virustotal.com/en/file/e483eceb5da9383b75ffd974d815b987bbf96ffebcd39500e7d3354c39a6a044/analysis/1467252940/

https://www.virustotal.com/en/file/41a936a4a13d430415abf37bbbf29451865585e41281657bbf95545b1bbc1653/analysis/1467253137/

https://www.virustotal.com/en/file/a75ba0ab78cf494d7505b2f4b4e6a452f5909b1c68bb619be01daf22ee0c6d19/analysis/1467253329/