Malicious PDF — malware analysis report

Static analysis result for SHA-256 024c4c59c407262b…

MALICIOUS

PDF

77.4 KB Created: 2021-06-13 18:58:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4ac67df8717d52782dac3b57ad6e247 SHA-1: dac0ac9efa05918825f67e824f6d52f87087eab0 SHA-256: 024c4c59c407262b32583a33d3099fdc1a4c9000456f9b28e580a397e66315c3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan variant. It contains numerous embedded URLs, with one prominent URL pointing to 'catamma.ru' and disguised as a 'Bible reading plan'. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is designed to host many links on disposable domains, suggesting a broad phishing or malware distribution campaign. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=bible+reading+plan+for+6+months
    • https://niladomawinur.weebly.com/uploads/1/3/4/8/134875702/af01140d174a24.pdf
    • https://nitowapesapu.weebly.com/uploads/1/3/4/4/134442046/bevopipavini.pdf
    • https://wetusaseri.weebly.com/uploads/1/3/5/2/135297966/sivedobe_jexajopep_tafetanutur_xiwaveguvap.pdf
    • https://cdn-cms.f-static.net/uploads/4464327/normal_606eaa8cf12c3.pdf
    • https://gepekipaw.weebly.com/uploads/1/3/5/3/135304147/68b6b.pdf
    • https://telutifezidawu.weebly.com/uploads/1/3/4/6/134624569/wodekokoxoba.pdf
    • https://cdn-cms.f-static.net/uploads/4376096/normal_6047a5eed5c23.pdf
    • https://cdn-cms.f-static.net/uploads/4372399/normal_6051c9b67c60c.pdf
    • https://cdn-cms.f-static.net/uploads/4475570/normal_6051f4268d8f2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1724962d-1d91-48ee-ad28-c6629f2673de/essentials_of_health_policy_and_law_3rd_edition_ebook.pdf
    • http://poxanoralanu.pbworks.com/f/dmv_va_test_manual.pdf
    • http://xojifot.pbworks.com/f/physics_for_scientists_and_engineers_knight_2nd_edition_solutions_manual.pdf
    • http://nugokasadi.pbworks.com/w/file/fetch/145252992/among_us_hack_mobile_always_imposter_apk.pdf
    • https://uploads.strikinglycdn.com/files/3b5ef4da-99b9-43cf-8924-13416724f37c/hampton_bay_ceiling_fans_with_remote_control_troubleshooting.pdf
    • http://juxivos.pbworks.com/w/file/fetch/145205790/54272705622.pdf
    • http://dizugizup.pbworks.com/w/file/fetch/145103949/47004340005.pdf
    • http://paderukut.pbworks.com/f/wokulevafaxuxover.pdf
    • http://foxobekizax.pbworks.com/w/file/fetch/144567942/que_es_un_pronostico_en_psicologia.pdf
    • http://kiwegofow.pbworks.com/f/solusutupegarebo.pdf
    • http://mibegenav.pbworks.com/w/file/fetch/144651474/google_sheets_budget_template_bi_weekly.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0e2.bin
be300167513203793ee04e6c9ccf300af87d3731c4ac75f680163c932e14d3c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0E2 5800 bytes
font_01_sfnt_off0001046c.bin
8ab06f25d8a9fef8dd074c89f7c3460ac409d6b59c1fa881c0c3ea8bb3fdaa73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1046C 10536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.