Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e9c9dc45a7522a2…

MALICIOUS

PDF

197.3 KB Created: 2018-04-25 15:39:31 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 7464dea3926ec89414dfe9225c6517f9 SHA-1: c9ffa3cb394adcd65ed0f8451e1149823b6f078c SHA-256: 3e9c9dc45a7522a2e97917cde3b7818d64599604f861c6620bd9792bcd0b59ee
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI pointing to a suspicious domain, which was flagged by heuristics. The ML classifier also indicated a high probability of maliciousness. While no scripts were directly extracted, the presence of the external URI suggests an attempt to redirect the user to a potentially malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7668

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%BE%D0%BC%D1%83+%D1%8F%D0%B7%D1%8B%D0%BA%D1%83+6+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BE%D1%82+%D0%BF%D1%83%D1%82%D0%B8%D0%BD%D0%B0+%D1%88%D0%BC%D0%B5%D0%BB%D0%B5%D0%B2 PDF link annotation
    • https://hyapuwatchre1980.files.wordpress.com/2018/04/zixalerifa-reshebnik-po-russkomu-iazyku-8-klass-lvova-lvov-2010-juvanisofolo.pdfIn PDF document text
    • https://thibarpobe1983.files.wordpress.com/2018/04/bugisodefunitol-blank-zaiavleniia-v-gai-na-postanovku-na-uchet-skachat-wajoferodot.pdfIn PDF document text
    • https://inernutbang1982.files.wordpress.com/2018/04/fawuwulewejono-anti-anonim-fm-skachat-jijazilu.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906706_toggdzalgebra7klassngmindiuk2009godbederob.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907406_murrusskiazreshebnik11klasszuf.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907906_dumewagdzmatematika1klass2chastdorofeevmirakovafulebid.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907924_muzokilgdzpomatematike6klassdorofeevfgos2016godkusigig.pdfIn PDF document text
    • https://voypresappar1973.files.wordpress.com/2018/04/pemimub-ati2dvag-sinii-ekran-pri-vykliuchenii-windows-7-fenefuwigibo.pdfIn PDF document text
    • https://presacbrigwic1980.files.wordpress.com/2018/04/bigivozomuf-ruletiki-iz-kabachkov-s-raznymi-nachinkami-retsepty-s-foto-raspechatat-pibofet.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907278_fijoreshebnikpomatematike4klassmorovolkova1chastotvetyvupo.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907222_xovonowsaitfipiotkrytyibankzadaniioge9klassmatematikaniwa.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906174_gijaangliiskii7klasskuzovlevuchebnikgdzgir.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907826_begitulgeneratorzadaniiegepomatematike2017bazovyiurovensapek.pdfIn PDF document text
    • https://rimervikab1977.files.wordpress.com/2018/04/tukupude-poniatie-i-soderzhanie-dogovora-dareniia-kursovaia-rabota-nivos.pdfIn PDF document text
    • https://fettimicut1978.files.wordpress.com/2018/04/vepilutagidi-syrniki-iz-500-gr-tvoroga-retsept-s-foto-poshagovo-na-skovorode-momuliketowekif.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0002b2f9.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4a1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4A1 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002b2f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B2F9 28480 bytes
SHA-256: 0b6c5a12d608767eee1cc78092cc29088e8e081e1e7f013a891af4da52caf4ef
font_01_sfnt_off0002f388.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F388 15864 bytes
SHA-256: a0f35f407a639a56bc340b90d804f73521675543307ff6286d61415e28e1259e