Malicious PDF — malware analysis report

Static analysis result for SHA-256 00bfa652b7b28372…

MALICIOUS

PDF

58.6 KB Created: 2021-01-02 11:32:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 3f6229af02cba4824cd4e06839d7efa6 SHA-1: 6f070e3e7890005f7f8b7ead4cca23d808278f34 SHA-256: 00bfa652b7b283724f41bdf84fcec94827e3a01d3c032bc5e6c5a9060d674d2f
272 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded script and a critical heuristic firing for a malicious redirector link. The embedded script likely serves to execute malicious actions or redirect the user. The primary malicious IOC is the URL pointing to known malicious infrastructure, which is designed to lead the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9507

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=context+clues+worksheets+multiple+choice+high+school In PDF document text
    • https://cdn.sqhk.co/sivunukiwe/gjVZ2Rx/today_s_nfl_schedule_on_tv.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387046/normal_5fde7b6cc14ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375541/normal_5f8c377372f5e.pdfIn PDF document text
    • https://cdn.sqhk.co/mawedabe/vyrjfgf/dokedexolibo.pdfIn PDF document text
    • https://cdn.sqhk.co/taxeseta/d67sgcc/yellowstone_season_1_episode_8_trailer.pdfIn PDF document text
    • https://cdn.sqhk.co/zenetofuma/eGjgOhc/vutajazusoranam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a3cc46c-4b08-4757-925b-3f7ffb5466c8/rokowukonu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a369039b-3791-4e54-a271-5db67c84db62/sotobolupevu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a96a74e-2c37-445f-8091-b995b4f5ce79/mad_zombie_sniper_gun_shot_3d_print.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/916498c8-d0ed-4e0a-92bf-c8a9b16afcbb/wudasizivosizimimurelatuk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/204ea7e3-7563-44e9-be86-348195966be7/unbroken_book_online_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a31bf7cd-1bed-4e6a-9865-ab0aff9b28d1/craig_bluetooth_speaker_dollar_general.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf5be769-e6f6-49c6-aa84-b4ab9a48f8d2/zidawametos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/508a7618-3e14-43f4-bd2d-750ab9360176/super_smash_bros_unblocked_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8929760d-a64d-4eb6-94a9-a149e366951e/windows_test_port_connection_powershell.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64b07de3-0213-4668-9ef5-367588cfbf1c/12161687644.pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00009e4f.bin pdf-embedded-script PDF decompressed stream script payload at offset 0x9E4F 59995 bytes
SHA-256: 36abf020b7bcdaf6a438445e4b37b49983091b6cab35d86e6a51ebc1eba8188d
Detection
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
%PDF-1.4
1 0 obj
<<
/Title (�� C o n t e x t   c l u e s   w o r k s h e e t s   m u l t i p l e   c h o i c e   h i g h   s c h o o l)
/Creator (�� w k h t m l t o p d f   0 . 1 2 . 5)
/Producer (�� Q t   4 . 8 . 7)
/CreationDate (D:20210102113250+02'00')
>>
endobj
3 0 obj
<<
/Type /ExtGState
/SA true
/SM 0.02
/ca 1.0
/CA 1.0
/AIS false
/SMask /None>>
endobj
4 0 obj
[/Pattern /DeviceRGB]
endobj
6 0 obj
<<
/Type /XObject
/Subtype /Image
/Width 625
/Height 155
/BitsPerComponent 8
/ColorSpace /DeviceRGB
/Length 7 0 R
/Filter /DCTDecode
>>
stream
����  JFIF     K K  �� C                                    	 	  
   


      	  
      �� C                                                                 ��    � q  "       ��                            	
 �� �                }        !1A  Qa "q 2��� #B�� R��$3br�	
     %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������                            	
 �� �                w       !1  AQ aq "2�  B����	#3R� br�
 $4�%�    &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������          ? ���m�!����m��H�L^c,p*�P B=3��Z�� ��O�KY�� O)�?�v?��K�vq7�}1��o4�
�G��v�� Z�C"� �����9����b얏s���߆. +��UL)Sq! �P �zP�  �7 @t�$�h7 �[� ���+�c�r�ڮ� I=�  ;��ia$@�! H!��O��w�v��[�E��� _�sR| ��ơt���[ːq��g���� 
o�P a��3��"y�I��
�+�dq�� ��H9 �>ߧj|Q � +�t � ��}�{ ����: �| �ז �s & ��� � ��ҟ'�? N { �YI�]����~��޺T�� 1�� �� �zI *FW�<o8�ӏ��j%$����  �[� ��m�Nvl���K� 3��u��� � �n�ۇ� }(��|���>����e Ԧ~R xϦ �>���1FXr n@;� x�  V �kN���sc� ���c�� � =��s��ӏ�ZS����˶�iA���\ � �� �] c�%\(�H� \w������"� �g vK ��j,��%��'�� $ۆ������$v�.���� 
 ص�m�r'� z�� �WO ,q  ���������	#�r � _j v���s���'��X�X �@��e#=z���� �a1,zrd6B���3�~�x�� �g5љ]'P 9b '�\ O s����� 7d����Q�}}� Zv�ϟ�qM��  � ��:� <; |�x98�b3� }�4����H�:q߀  �N:�Hn W׵t�v�X � �לt�E �ʁ�.=��JE��9���@�F�ȣ* �% }�� ��s��#| ��l�� �����q��Q��]0 ̤���  ���� Z�c ln �m .  ��з ~��9x~ �w���)�� �O��rAbG�O� �A��`�`+� 3K��`O_�t� c�r� q�  �#9� ����  v�"�1��� �p �"��1,�� ���A��H� xz" -5C( by <�p��:q],F9Y�ۊ1� ��8�GP���� 0{���+t)KNe/����/ ��  E ��� �0'��;un����  �=q<���*� ~�A���  ����Tw8�1� �^����S �� �� A o�3��N��d��� ���3 �� �!���  ����� ��}�J� �:ُ�9Yx'7 �� n� ��H#-�'Bs� \SS%�a�X� �r?�j[�To w��sQ�%��8 h�:���1� ��� �?�,�  �8  ��P��"yx�s���� �1�  G��O  ԝH� (�  � �� cZ� ��� Z��? �<�z��  G�V� н:�/��  ��UW
��S�;}�J�P �/�	 � z$R� �ߚ/�(���� ; �| ��a�`�` ��r9���8�� Jj|'��!�M ��C��S��:u��Wd�>�3�	� ��{�L��Yw >Q� �'���SD6���9��S~ ��� a� �H@��>osQ  �ؑ�i� |��h������S�ϧT � mR>�8�� 9��I��P[p�` �׊ } J.��6> �rH� h �����  ����Eᵜ Ә�����^s����� �I�$  *�I� c����~nN�	\�>�'��� �����sG��� >m;p  e������i��è�n��� ?} # ��_�𮐹/� d�=�  �� `��.�� �:v� =iX�{j����s�A�4֌��>|�#� 1��<�S��φ� �y �l��Oqر��q���LІ*v�rr %O?��z�2 d 0 p���u��� � ������|�y� h%   ٍ��&\ `��ޣ� � �� V`4ё�ظ� ��>���l>A _� ~�p"�9 q�G  '�:s� ƒ�\�o������  ��w��ϐ ޿{� ʐ|#��% ��m#-q) �#�w �c��#%w� �v8�=E �b6�*	9 A�׸� <�n�m�x� _���� �^  �t��l ��x� ^�=:}i���y ���#��Jr �� ?�t1���ʼn�	bI ����؍���	9 q�� ǹ�bUF����� �8���x!FH72|� � j|  �9 �i���ϗ��� ��D� � �v� $��i��H�ې�;� � �� ?�V�~�һ� ����t�&��Ďl6� � �� s�������m��ì#Μ���>�.:����zz���&�
 2�6��x����服� ��00��u8��sMh&ܝ��� ��sg��_M�� �y?_��� t	�)Ұ �L�c �  ����q�C� �  � _aHʩ W �   ���?O�!ɶ�9��S� L �   帔c���J �/ Ƭͧ�B s<�7�-�k�H� �   3t { �� Zs�f�Fp	 ��z�hЯz�Z _��s1|#��`
1Wp���N������N�� ��1��m u �e������k�H ޛ ?1\ �O�Iшf�E� �Q�>��?:,��4�9���í Ι�I� ��� j� �  In�^�ؐ H������Mt�2��PŎrGC�O� Wa�K+;I�`��� #$~�i�NMj��� _�s�� �Ҡh�ݠ��<� ���_�D� �;>P��`��ne�c8�� ��#�,���ߑ��� Z cwc#�T��d w � _���+���i�}�2~ �jU1 g  9 iW�t 7�� ��w�j�1�m� m�Q��w��ں@�^�
w7$g� ��?�4� �q ��qԌcځE� �9s��@��4ؕ~�EĀ��|��1�*H� xmdg  � �'�������{WD�p,��$��?��� �$R�c�_�d N ��� "�Z  ٦��8� �8cd:r�NߞY} �z �M���n&%�� �ǟ) < 7c���+����HP��  )�Oקa� �:*��  m��8� '����B������� v?�~ V �-�_�"�C�1��� ���| ��(WO;rA�s(�^k��?3�,  ��x��} G��'
� s6�B��O��4$9I� ����9����;� ; ���"R3�?{׿� Z�7��  �9Ӏ ���s�� �� Z�I�a^�N s/ ��NI�����
�  ���b��?�����/��
@�n�Xĸl�!<t9ݒx�	'� �� ��S�1YO,~�!�����q�q]3ǂ0[  W���\p>���ɀ��9 c�ߞ�� bJ�?�O��g6~ xr ʮ�����C��  �x� �� i�4�г ���� NO�� �
... (truncated)