Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b6433ed2eac4cc6…

MALICIOUS

PDF

207.9 KB Created: 2018-04-25 17:42:21 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2021-06-28
MD5: 44bfc186908bf13f1a61c2521220f3c0 SHA-1: 2c438dbf972ee3c7c57aa702daaffe893fe92725 SHA-256: 2b6433ed2eac4cc6bdd0f9d511943c1059c56c0382908513b6da66ffe8c13432
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an external URI and a redirector link that points to a suspicious domain, indicating a phishing or malware distribution attempt. The heuristic 'PDF_SEO_UTM_REDIRECTOR_LINK' specifically flags this as a free-download phishing lure. No scripts were extracted, but the embedded URLs suggest the document's primary purpose is to redirect users to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7263

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://renimba.info/wp1?keyword=%D1%80%D0%B5%D1%88%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA+%D0%BF%D0%BE+%D0%BA%D0%B8%D0%BC+7+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%B3%D0%B5%D0%BE%D0%BC%D0%B5%D1%82%D1%80%D0%B8%D1%8F PDF link annotation
    • https://thibarpobe1983.files.wordpress.com/2018/04/dupiwawupedur-iptv-freedom-skachat-dexex.pdfIn PDF document text
    • https://thirsnanagtheo1974.files.wordpress.com/2018/04/vijopanofotugir-stikh-na-angliiskom-iazyke-pro-novyi-god-5-klass-modiboke.pdfIn PDF document text
    • https://taslowido1984.files.wordpress.com/2018/04/gamib-syrnye-lepeshki-s-vetchinoi-v-dukhovke-retsept-s-foto-fofimoxigifiwo.pdfIn PDF document text
    • https://pesatemea1975.files.wordpress.com/2018/04/zibazipupimaru-gdz-po-istorii-6-klass-vseobshchaia-istoriia-agibalova-wojosuzososez.pdfIn PDF document text
    • https://unazadbit1973.files.wordpress.com/2018/04/jabapovibura-reshebnik-po-russkomu-iazyku-4-klass-klimanova-babushkina-tetonaj.pdfIn PDF document text
    • https://inelnapho1974.files.wordpress.com/2018/04/susutigu-skachat-igry-na-pk-zombi-protiv-rastenii-2-ribewuza.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907604_ziwatreshebnikpomatematike5klassladyzhenskaia2016kefa.pdfIn PDF document text
    • https://unazadbit1973.files.wordpress.com/2018/04/gipogad-reshebnik-po-khimii-10-klass-o-s-gabrielian-rigure.pdfIn PDF document text
    • https://velpdinazi1983.files.wordpress.com/2018/04/tekefojegowalif-microsoft-office-2016-skachat-besplatno-dlia-windows-10-ofitsialnyi-sait-suzasa.pdfIn PDF document text
    • https://cirrgeekbgosen1984.files.wordpress.com/2018/04/zuwawifupuno-gdz-po-fizike-11-klass-testy-gubanov-fejuviximorufiv.pdfIn PDF document text
    • https://prooflichamko1985.files.wordpress.com/2018/04/wuvoxomuxigazi-mendeleev-vikipediia-biografiia-kratko-korurirugozib.pdfIn PDF document text
    • https://piespanenti1979.files.wordpress.com/2018/04/gagidij-srednii-ball-ege-2016-po-russkomu-iazyku-v-altaiskom-krae-ragot.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5911/5911262_ranoxaegepokhimii201730zadaniefozaz.pdfIn PDF document text
    • https://inpetfipen1982.files.wordpress.com/2018/04/badilejifagi-programma-dlia-foto-uluchsheniia-skachat-besplatno-xipiveroramova.pdfIn PDF document text
    • https://fettimicut1978.files.wordpress.com/2018/04/konuzonivefaxos-pozdravitelnye-otkrytki-s-dnem-zashchitnika-otechestva-skachat-besplatno-livafig.pdfIn PDF document text
    • https://fettimicut1978.files.wordpress.com/2018/04/konuzonivefaxos-pozdravitelnye-otkrytki-s-dnem-zashchitnika-otechestva-skachat-besplatno-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0002dd4e.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a487.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA487 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002dd4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DD4E 28588 bytes
SHA-256: a986a0e82813a526444b53f7e36efadd878503e7d2d24fcbd32692d5aa5d1784
font_01_sfnt_off00031eae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31EAE 15484 bytes
SHA-256: bced592e4f0451530a88861d7417c2bbac9d31873c471e7ee5d82402d992b3db