Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bb3e270672a502a…

MALICIOUS

PDF

71.9 KB Created: 2021-06-11 17:24:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 56cc2ac8cb969ab0e6673031fc8f6676 SHA-1: 6ad30e89979d10751d00bf8c1016048b833527ba SHA-256: 5bb3e270672a502aa0d640ed4726ff2a94f0a114df6eef3facbc351c9065d91b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous external URIs, including one that directly links to 'grand_theft_auto_5_obb', suggesting a lure for game-related downloads. The presence of multiple disposable hosting links further supports a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=grand+theft+auto+5+obb
    • https://mizevazorabij.weebly.com/uploads/1/3/5/3/135347525/numexofalilubofesebu.pdf
    • https://cdn-cms.f-static.net/uploads/4500878/normal_6036192c9503e.pdf
    • https://dirukarizudabi.weebly.com/uploads/1/3/2/3/132303081/ritapumogelivub.pdf
    • https://tutemedoz.weebly.com/uploads/1/3/2/8/132814241/244737.pdf
    • https://renokiva.weebly.com/uploads/1/3/4/3/134353994/puguzofipo-zirowiw-tuxafu-mibajuralaja.pdf
    • https://cdn-cms.f-static.net/uploads/4460466/normal_605dddba5e33c.pdf
    • https://puwekuzegavezek.weebly.com/uploads/1/3/4/7/134734886/zodive.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://foziwedugumu.pbworks.com/w/file/fetch/144599127/what_should_i_wear_to_old_navy_orientation.pdf
    • http://mizunebapod.pbworks.com/w/file/fetch/145053030/81175523910.pdf
    • http://volikedejefa.pbworks.com/f/zagavusolag.pdf
    • http://febigadeviti.pbworks.com/w/file/fetch/145064904/http_injector_lite_files.pdf
    • http://zuvuzut.pbworks.com/w/file/fetch/145122495/garrys_mod_download_apk.pdf
    • http://xefobukeza.pbworks.com/w/file/fetch/144608385/what_to_put_for_server_on_resume.pdf
    • http://boxedaw.pbworks.com/w/file/fetch/144742113/rhinoceros_3d_tutorial_espaol.pdf
    • http://busututesemo.pbworks.com/f/67416680549.pdf
    • http://metudebebi.pbworks.com/w/file/fetch/145071696/35775799433.pdf
    • http://viruniruxo.pbworks.com/w/file/fetch/145004259/hushsms_frp_apk.pdf
    • http://dejimebez.pbworks.com/w/file/fetch/144776412/zivofib.pdf
    • http://bunemirudezo.pbworks.com/f/xinuzi.pdf
    • http://negovijalulu.pbworks.com/f/xubelopisav.pdf
    • http://fadoposapat.pbworks.com/f/what_are_the_two_main_components_of_natural_selection.pdf
    • http://raravisu.pbworks.com/w/file/fetch/144712638/do_stop_snoring_mouthpieces_work.pdf
    • http://juwelite.pbworks.com/w/file/fetch/144559299/balancing_chemical_equations_worksheet_intermediate_level_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcdb.bin
d683a2cdc874c7cb495d61f5531b0d594db30441a9df1f8664c6ee4efa2905c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCDB 5080 bytes
font_01_sfnt_off0000ee22.bin
e92b7a5d0616846fbd6ac032de63b121bb0aee8d296a10454942d7622de4e3f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE22 10688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.