Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fe0743f1a3265db…

MALICIOUS

PDF

92.1 KB Created: 2021-06-11 01:30:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c6ba64d844e768b9d746d2cc9fc7b83 SHA-1: e4e6fbf2df2d16b80b53b2012b5dfedea75375c0 SHA-256: 5fe0743f1a3265db04d139262f5693dfd90d2031561b1487ce2c0256eabb790c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains text related to downloading English books, suggesting a phishing or malware distribution lure. The presence of external URIs, including one pointing to krisoc.ru, further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/pbw?utm_term=spoken+english+book+download+in+tamil
    • https://fatagodudun.weebly.com/uploads/1/3/4/3/134327877/ce037dcb1cacf.pdf
    • https://natozopito.weebly.com/uploads/1/3/4/1/134108601/dunotavivo.pdf
    • https://lavidibiw.weebly.com/uploads/1/3/4/5/134582964/3532861.pdf
    • https://suxapenogabako.weebly.com/uploads/1/3/4/6/134602080/1053144.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://saladolu.pbworks.com/f/45051217550.pdf
    • http://jujirafamena.pbworks.com/f/juegos_para_conseguir_diamantes_gratis_en_free_fire.pdf
    • http://kuzimotum.pbworks.com/f/how_to_reset_bose_700_remote_control.pdf
    • http://negaboxa.pbworks.com/f/what_are_the_code_of_ethics_police.pdf
    • http://ritijix.pbworks.com/f/tubidy_video_download_mp3_mp4.pdf
    • https://uploads.strikinglycdn.com/files/54fd5aaa-9cdc-4cf0-b449-4fe453976430/rca_10_viking_pro_android_2-in-1_tablet_laptop.pdf
    • http://xudusuvo.pbworks.com/w/file/fetch/144855783/fuvazutazowul.pdf
    • https://uploads.strikinglycdn.com/files/a025d675-4563-40a7-86d1-d7ad26c49d8f/citizen_eco_drive_quartz_watch_price.pdf
    • http://zegugas.pbworks.com/f/cinderella_and_four_knights_ep_13_eng_sub_full.pdf
    • http://xudusuvo.pbworks.com/w/file/fetch/145086150/vocabulary_workshop_unit_8_answers.pdf
    • http://jedilukiwo.pbworks.com/w/file/fetch/144566646/dezikiv.pdf
    • https://uploads.strikinglycdn.com/files/2dbc7958-651f-4867-9f54-d2dba5219374/integracin_de_la_cadena_de_valor_para_la_ventaja_competitiva.pdf
    • https://uploads.strikinglycdn.com/files/5e908470-f8e3-47ed-9f1e-f696d80fcaf2/29936289858.pdf
    • https://uploads.strikinglycdn.com/files/9ec8f16e-02cc-4f0b-84fb-20583bdc1cb9/zugibuletetevepem.pdf
    • https://uploads.strikinglycdn.com/files/c347f5ea-d85c-4849-9b6d-070c76e30951/xupedufomifu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000f383.bin
4df96c9a47ffde4004655ffa6c9242f5f095b83cd435fa928fadc4f00b3ed718		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF383 17032 bytes
font_00_sfnt_off0000e051.bin
ac2c23e814952b0cded432eaf72606151f7efe9205f4910403920fde0e82b009		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE051 5676 bytes
font_02_sfnt_off00011a27.bin
2ab820159410a183fd4027b82a7f609129b285a2e0d37c049f52f2539ced98c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A27 18328 bytes
font_03_sfnt_off00014f13.bin
bf487064bdec4387c4d2d5407515c2732e31716f11290bdbfd499fb0b6e2694c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14F13 4668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.