PDF static analysis report

Static analysis result for SHA-256 6ae2ef2caf36491e…

SUSPICIOUS

PDF

85.7 KB Created: 2017-01-05 11:59:41 +08:00 First seen: 2018-10-07
MD5: f839765c30011f9f52f8aa46e09d545c SHA-1: de1a8c8ec1a679ed8009ac3c8fcde782f0744f4d SHA-256: 6ae2ef2caf36491ee0863c6816c94df4ab64338ea9460b77fadec64552834d5f
44 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs pointing to external PDF files, suggesting a lure to download further malicious content. The heuristic 'SE_LOLBIN_RUN_COMMAND' indicates that command-line related tokens were found within the document text, potentially related to executing downloaded payloads. No scripts were extracted from this sample, limiting the ability to determine specific execution mechanisms.

Machine Learning

  • Nyx PDF Classifier clean score 0.0301

Heuristics 3

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.alistatrans.ru/extlib/vYckwiwmYvQPQ16355426i.pdf PDF link annotation
    • http://thestoveinstallationcompany.co.uk/quitewalk/ekaeae_ibJfJPcbPttlsmbuJuYb_rk16351999GG_n.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/rPolwwnQ16351809vkr.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/ibtJbzYlutGoxPk_16355404wfva.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/eQlixmllaQ_btctdloJeJwm16351678avn.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/mhhnJlsmutdemeJirnmdYYss16351699P.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/lauJYaemeQ16363616rbm.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/aonaJeocdkcdmzzQQJxsoxciitzPYQ16355399az.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/ckozzGtorb16355410sr.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/YdQxsPlbkGiQwnm_oGGvlnbGcixu16355275aGv.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/lbYnvGtex16363648YfYl.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/YsrsQlen16363538vml.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/u_ioninouc_hkzl16351858iJ.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/a_rbaabQJQQhGJePfcdcaa16355764vfnP.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/Qwfetuf16355567oYr_.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/otsaiioefY_efYYufzwsc16355591r.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/exauJvYidhrt16351525mx.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/YwPYwfsmaruGcccwYdm16351217oki.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/iQ_ukQkeulaG_kwteclsxxvknf_vo16352132hz.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/zcnGhhPimuaJtdwkJx16355770bm.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/adJwlYdcwbkPdxJYcsflsz16355781m.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/emwGQdYQulhme16351610Pd.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/zdrouuawYr16352129Guzm.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/Ybf_ubebvxuYuduxwlcw16355979lc.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/xlednrP_Qknk16351303uc.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/wterdlruzlowk_l16351564krb.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/zJJJeJhzeY16363537Jsv.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/cxiJardzzbPxkxdhGdY16364264Q.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/GunPoirzfwJuuiQnmcnckaxeYYxxno16364191bkrr.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/hrQdJfPuGhJbbholnfdP16355676zJ.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/rYnareibJ16355768mbmw.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/lcchuzzoss16355655nYY.pdfIn PDF document text
    • http://www.masterdea.it/mobile/JrQxthlbdmsztx_zuhoPdmsuwtke15163329Qfw.pdfIn PDF document text
    • http://www.masterdea.it/bbs/PalvwmossviezJmdJefeuYePQnuz15414558nv.pdfIn PDF document text
    • http://www.masterdea.it/bbs/zzJhsxzfQazfztsmmufauxlGcl15220928eQ.pdfIn PDF document text
    • http://www.corsoanatocismousura.it/index.php/service/iawxPJtauwrJQrnosYalYzafGcmdbw15345377G.pdfIn PDF document text
    • http://www.masterdea.it/bbs/zQwJGlGvJ15329375QtYr.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/lolrscJmat16363540szm.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/xunfdGzPismblnY16356078ur.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/mtrYkPYdeGeGJdxwmnubmae16352138e.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/vlexvm_ekYsbhnzPJnJ16351615dhza.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/_eJfletilketccxh16364330m_Jv.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/YYxrdufkltdwtxabawxkwbbicsd_G16363581idv.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/mQo_cGmQ_dePbQbJJYiYhQhkowh16355827ioeQ.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/mowulczcJufdbnawzQduoztsdhb_n16355806eoi.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/kfGkasfPGPdolPlvrth16364295c.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/kPchxcoPkwauQQPo16363671GJu.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/_ezxYwxJrmYmr16355381icQt.pdfIn PDF document text
    • http://www.alistatrans.ru/extlib/kxbwQdzzJk16355650Q.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/quitewalk/zcYfxcQ16363539hmmz.pdfIn PDF document text
    +25 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000ae70.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xAE70 20308 bytes
SHA-256: 1cac92e4f225aa7afcd080642d5078839ef22260c31c3862a28b8de1d3ce036f
font_01_sfnt_off0000e578.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE578 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00011b3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B3D 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1