Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bcb596d0ab276b0…

MALICIOUS

PDF

77.7 KB Created: 2021-03-22 18:44:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d44d3124a6a6b7ca18a111d31cf3c254 SHA-1: dbe78b56257aa6d0d036d53b595564351dd89d3e SHA-256: 6bcb596d0ab276b019b248de84e31a2b7891641f062877e94ae916b9f8a2ca52
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are obfuscated or lead to potentially malicious content, as indicated by the PDF_SEO_LINK_FARM and ML_NYX_PDF_MALICIOUS heuristics. The primary malicious URL identified is https://seumenha.ru/strik?utm_term=how+to+build+a+deck+for+beginners, which is likely used for phishing or malware distribution. The document body, though heavily corrupted, suggests a lure related to 'how to build a deck for beginners'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+build+a+deck+for+beginners
    • https://cdn.sqhk.co/dubibuwa/jWCMC0a/cnc_tools_list.pdf
    • http://kufafukedexepix.mygamesonline.org/measuring_triangle_angles_with_protractor_worksheet.pdf
    • http://kijumubafenu.mypressonline.com/47443123726.pdf
    • https://cdn.sqhk.co/babakobesuxe/Scr0Zji/principles_of_membrane_transport.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a86a6b26-b473-4b55-b9aa-7628a2bff077.filesusr.com/ugd/4f270c_2d6d8150ef054ef19406762f03f28a35.pdf?index=true
    • https://a1bd7baf-2de3-4c81-8914-4b74a732ecf9.filesusr.com/ugd/c89f15_7ae60ef2d4c647a2bb357cb5a6e1d4d5.pdf?index=true
    • https://748f1d53-d141-46c1-926a-d14fc69713a3.filesusr.com/ugd/e3ed1f_f06e4100e99f4864904a52da81ca6c24.pdf?index=true
    • https://fb5b3b17-6e6a-47c5-ae49-26eddba71e57.filesusr.com/ugd/aff7be_fcff2e9bb1c848359afffbe6038e7ee4.pdf?index=true
    • https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_4ccf82ae1cf447aa9d163ade7fbd5163.pdf?index=true
    • https://edf6f6ec-8a93-4ac2-80af-f76282245ca6.filesusr.com/ugd/738632_85209a54cde6415eaf4c415d4791cceb.pdf?index=true
    • http://beliraguw.onlinewebshop.net/what_is_scrum_in_laymans_terms.pdf
    • https://c8a164a7-2549-4056-b209-d27d417f800b.filesusr.com/ugd/136d3d_8a235bec980f41099dec1b4ced43a905.pdf?index=true
    • http://bananamiw.rf.gd/symbolic_logic_irving_m_copi.pdf
    • https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_cfdb4c68a8a7479f990b43b7bd807497.pdf?index=true
    • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_e7b84e24cac54bf8a1bd4a9157833218.pdf?index=true
    • http://fuvarijes.atwebpages.com/29089254263.pdf
    • http://fipabadidori.epizy.com/zanafanixinulojogisawoleg.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2e5.bin
b803ffa10644e975d5f19897078824e77cdadf9a2fc1d510f1e0301189d86553		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E5 5444 bytes
font_01_sfnt_off0001058b.bin
51bf1775aed1161bb91f7b79800d44336e2495c987154c8674719ff8e4b2dbf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1058B 10700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.