Malicious PDF — malware analysis report

Static analysis result for SHA-256 0211ccc13b9e4ce1…

MALICIOUS

PDF

228.4 KB Created: 2018-04-25 17:01:29 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2021-06-17
MD5: f0bdd28e411bc4a8b4d5dce5b9192296 SHA-1: 518e00843eee6de4d7421eda924a9dff79de951f SHA-256: 0211ccc13b9e4ce181d657d3b77cc6f8baee25fc0ab95aec9f96f0c178ca1c01
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI and a high-severity heuristic indicating it's an SEO redirector used for phishing. The document body and heuristics point to a lure related to educational materials, specifically 'gdz po algebre' (answers for algebra). The primary malicious indicator is the redirection URL, which likely leads to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7603

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D0%B0%D0%BB%D0%B3%D0%B5%D0%B1%D1%80%D0%B5+7+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BC%D0%B0%D0%BA%D0%B0%D1%80%D1%8B%D1%87%D0%B5%D0%B2+%D0%BD%D0%BE%D0%BC%D0%B5%D1%80+1083+%D1%81%D0%BF%D0%BE%D1%81%D0%BE%D0%B1%D0%BE%D0%BC+%D1%81%D0%BB%D0%BE%D0%B6%D0%B5%D0%BD%D0%B8%D1%8F PDF link annotation
    • http://matematika-domaIn PDF document text
    • https://play.��.��.startandroidIn PDF document text
    • https://play.tv/uchebnik-algebra-7-klass-In PDF document text
    • https://twitterIn PDF document text
    • http://matematika-doma.com/playlistIn PDF document text
    • https://www.startandroidIn PDF document text
    • http://matematika-doma.������������In PDF document text
    • https://uroki.com/onlinegdz_netOnlineGDZ.com/algebra-7-klass-makarychevIn PDF document text
    • https://play.ru/gdz/class-7/algebra/makarichev-In PDF document text
    • https://www.net������(��������������In PDF document text
    • http://matematika-doma.��In PDF document text
    • https://www.develop.com/playlist?list=PLCrA1G_tvIUtZe5f-In PDF document text
    • https://play.��.startandroid.��In PDF document text
    • https://www.develop.netIn PDF document text
    • http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D0%B0%D0%BB%D0%B3%D0%B5%D0%B1%D1%80%D0%B5+7+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BC%D0%B0%D0%BA%D0%B0%D1%80%D1%8B%D1%87%D0%B5%D0%B2+%D0%BD%D0%BE%D0%BC%D0%B5%D1%80+1083+%D1%81%D0%BF%D0%BE%D1%81%D0%BE%D0%B1%D0%BE%D0%BC+%D1%81%D0%BB%D0%BE%DPDF link annotation
    • https://prupaqrestio1977.files.wordpress.com/2018/04/latuk-gdz-russkii-iazyk-kontrolno-izmeritelnye-materialy-2-klass-siniakova-wefawowevepezu.pdfIn PDF document text
    • https://manryleramb1975.files.wordpress.com/2018/04/pofasow-radio-pleer-mini-skachat-na-russkom-mujuzaganikuz.pdfIn PDF document text
    • https://chrysgouseklund1980.files.wordpress.com/2018/04/wufumatas-skachat-referat-na-temu-filosofiia-iskusstva-bugipu.pdfIn PDF document text
    • https://damdispgenja1970.files.wordpress.com/2018/04/tevix-demokrit-biografiia-referat-jexanigegos.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906191_nebosasgdzrabochaiatetradnewopportunitiesintermediatevarez.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5909/5909482_zazogdzkuchebnikumordkovicha2chastalgebra8klasstajazo.pdfIn PDF document text
    • https://taslowido1984.files.wordpress.com/2018/04/bosabizilu-obshchii-srednii-i-predelnyi-produkt-referat-birukolov.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907308_noluwokgdzmatematika11klasgpbevzvgbevzrivenstandartudexomu.pdfIn PDF document text
    • https://presacbrigwic1980.files.wordpress.com/2018/04/dimosop-reshebnik-po-angliiskomu-iazyku-kontrolnykh-rabot-dipolidivu.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906173_subigdzpobiologii9klassrtkuchmenkobed.pdfIn PDF document text
    • https://krisaradre1989.files.wordpress.com/2018/04/gifewanaxe-gdz-geometriia-7-klass-mugikenepid.pdfIn PDF document text
    • https://unkonebac1973.files.wordpress.com/2018/04/meparaxajumib-gdz-shmelev-5-klass-russkii-iazyk-xugavufok.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906948_luxanangdzporusskomuiazykudliastarshikhklassovgrekovnavuwi.pdfIn PDF document text
    • https://rimervikab1977.files.wordpress.com/2018/04/xidejuvozimot-gdz-kontrolnaia-rabota-po-algebre-8-klass-sodaku.pdfIn PDF document text
    • https://unkonebac1973.files.wordpress.com/2018/04/jasizijijiw-skachat-karty-na-prokhozhdenie-dlia-mainkraft-1-10-2-vyzhivanie-v-butylke-vawizuna.pdfIn PDF document text
    • https://www.com/onlinegdz_netIn PDF document text
    • https://www.com/store/apps/details?id=ruIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_008_off0003219d.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4bf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4BF 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
stream_008_off0003219d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3219D 32996 bytes
SHA-256: 153824fa360cfd2e9a1870a82a7dbf0a06951eb5f9e9249891feff645a4f81f1
font_01_sfnt_off00036d6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36D6C 16468 bytes
SHA-256: 5dbc710f16171c1a9dbb702fb4dad07f6ef9cfebad541f39e1713703c5bee43b