Malicious PDF — malware analysis report

Static analysis result for SHA-256 481b7075d511e134…

MALICIOUS

PDF

76.7 KB Created: 2021-03-16 04:44:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 5556b93d9dd38f7ed6fd46edbe24bcfb SHA-1: b5d427891e8b9b9a7584cca42c470ddecaa6d733 SHA-256: 481b7075d511e134a2d4a740b4aacce2c19de9fdaca5b97883911640aa08fce3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains references to 'Craftsman table saw motor replacement', suggesting a lure to a malicious URL. The presence of numerous external URIs, including one pointing to 'pelibifir.ru', further supports a phishing or malware distribution attack pattern. No scripts were extracted, but the PDF structure and embedded URIs are sufficient to infer a malicious purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=craftsman+table+saw+motor+replacement PDF link annotation
    • http://lorakuze.sportsontheweb.net/palm_astrology_in_tamil.pdfIn PDF document text
    • http://liberum.sportsontheweb.net/a_single_man_movie.pdfIn PDF document text
    • https://cdn.sqhk.co/tatogevi/66DigdJ/fafatu.pdfIn PDF document text
    • https://cdn.sqhk.co/figegixo/diaXlhg/12339887583.pdfIn PDF document text
    • http://kindraretterath.com/zarchiver_mod_apk_android_14kin9.pdfIn PDF document text
    • http://wildber.store/79518371158aprnt.pdfIn PDF document text
    • http://raftgjgr.space/tuxegata3xk42.pdfIn PDF document text
    • http://savadaqwe.space/the_crusades_through_arab_eyes_book_reviewheudp.pdfIn PDF document text
    • https://cdn.sqhk.co/junukexad/iaKggwD/58671469386.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://8964868a-aef6-4da0-9a9b-29de7c28e0c5.filesusr.com/ugd/b910ae_738bebec5ec14092bc67e714c8a00bdc.pdf?index=trueIn PDF document text
    • http://tafiwepamubov.atwebpages.com/12658827936.pdfIn PDF document text
    • https://s3.amazonaws.com/jexijer/42111225146.pdfIn PDF document text
    • https://s3.amazonaws.com/natewared/android_10_call_recording_root.pdfIn PDF document text
    • https://8b8c7005-3af0-45a1-8e5b-a6902caa9335.filesusr.com/ugd/dbd7d9_7fdc44e40e29447fa81c93f3be287cf9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/world_war_z_2_full_movie_watch_online_free_gomovies.pdfIn PDF document text
    • http://jezevenakos.myartsonline.com/89793893741.pdfIn PDF document text
    • http://teluroluxeterez.myartsonline.com/todos_los_conectores_en_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/rirusozo/rumako.pdfIn PDF document text
    • https://0e75ab8e-f6a1-4360-bef2-1d94e06fde4e.filesusr.com/ugd/c0518c_8c06b0c41aa546379a6f33a8f2e30ef1.pdf?index=trueIn PDF document text
    • https://e1eccfe9-8888-4f52-a155-e9c8e84e0752.filesusr.com/ugd/4fb05f_5e7e3b3389074ef4abc2e1a26a68429a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC83 5296 bytes
SHA-256: 81d85db505f4edaea729b93fc19cc1a0a117530f6ad2acb4656b8cb47483e407
font_01_sfnt_off0000fe7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE7F 11656 bytes
SHA-256: c494c41efeb919be24f5035fd1cbcde039b7e5153789215cf8d51ce8311917fc

Open this report in the interactive analyzer, or submit your own file for analysis.