Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bc2be8c6104a389…

MALICIOUS

PDF

91.8 KB Created: 2021-06-06 00:11:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5b9d8a8492e1c92fde31624c5375bf4 SHA-1: d84c48cce970b7f65d6b1f4722cd16ae72c67b4b SHA-256: 0bc2be8c6104a3893988c362b4faaf9f2e556793264ee0f2fc0661f48aee8fd6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a link farm, suggesting it's designed to direct users to external resources. The document body, though partially corrupted, contains text related to downloading an Xbox emulator, indicating a lure. The presence of multiple external URIs, including one flagged as potentially malicious, reinforces the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=descargar+emulador+de+xbox+360+para+pc+full+espa%25C3%25B1ol
    • https://gexawagezawa.weebly.com/uploads/1/3/2/6/132682787/23d1d2.pdf
    • https://dobojadu.weebly.com/uploads/1/3/2/7/132711966/xodolopejeloz-nuwusu.pdf
    • https://morewunopidov.weebly.com/uploads/1/3/4/8/134895133/fd33dd51.pdf
    • https://wuvatefowid.weebly.com/uploads/1/3/4/4/134470889/vonuxi.pdf
    • https://luzusuzure.weebly.com/uploads/1/3/0/7/130775685/dakukobejaloxagugulu.pdf
    • https://varudigenaka.weebly.com/uploads/1/3/4/5/134597471/faregu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/272a4f11-bf71-4ccc-aa90-a1544e9b5a05/feduxefareje.pdf
    • https://uploads.strikinglycdn.com/files/fa09af66-fef2-4833-af85-b79fda101835/nawadeva.pdf
    • https://uploads.strikinglycdn.com/files/beb7ebd6-9c51-42ea-a966-bd50750e9dea/instrumentos_de_recoleccion_de_datos_segun_autores_2018.pdf
    • http://zalonuzojeru.pbworks.com/f/47908456305.pdf
    • http://sejiliki.pbworks.com/w/file/fetch/144554820/37631997294.pdf
    • http://ruxafonan.pbworks.com/w/file/fetch/144686070/babizexidemi.pdf
    • http://duziruromeja.pbworks.com/f/niworejosevumujefaxo.pdf
    • https://uploads.strikinglycdn.com/files/7d4a1439-4362-44d7-9845-2d15ff2a4ba3/how_to_get_a_market_stall_in_spain.pdf
    • http://vafakana.pbworks.com/w/file/fetch/144576963/adjetivos_comparativos_y_superlativos_ejercicios.pdf
    • http://dawijunegolo.pbworks.com/w/file/fetch/144578823/the_tale_of_chunhyang_story.pdf
    • http://fudejob.pbworks.com/w/file/fetch/144529047/dstv_now_not_working_on_samsung_smart_tv.pdf
    • https://uploads.strikinglycdn.com/files/4765aae6-7edc-43ca-9310-2d9e983503ba/1807737269.pdf
    • http://giresizuloki.pbworks.com/w/file/fetch/144463413/90594901283.pdf
    • https://uploads.strikinglycdn.com/files/e38fa51a-ad08-4ef0-bd9b-121ed19c3130/an_echo_resounding_the_trove.pdf
    • https://uploads.strikinglycdn.com/files/bc7bf3c4-4c9f-4793-807a-bd2f83fafb70/37390056760.pdf
    • http://minuwaxiper.pbworks.com/f/80523695447.pdf
    • http://memofemovo.pbworks.com/f/96242362662.pdf
    • https://uploads.strikinglycdn.com/files/10e368bc-04c0-4893-914d-561ecb1b4b8d/how_to_fix_sew_machine.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d71.bin
7803f4436e000ea45e5324ab3305c05cfb88ac9b60371a0d034fde9adee7a2e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D71 6356 bytes
font_01_sfnt_off000122b8.bin
f9791ee22ce91487c8b1bf4b177d40f2009677d86358616a4f7c16b1a9b55712		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122B8 11776 bytes
font_02_sfnt_off00014948.bin
247dd58d45cfa3a2a720807f07e9afd39d09b7df8ba98f1ca8217d1fb54e9a0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14948 16156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.