Malicious PDF — malware analysis report

Static analysis result for SHA-256 763bd62991572392…

MALICIOUS

PDF

220.9 KB Created: 2021-02-25 20:48:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: cf85d93ebfa0287e94ba4db3b00a2c13 SHA-1: bcd92577d0982bf7b576ba7827be6ffcc0094cc5 SHA-256: 763bd629915723922f7b05f3e2b8a7f5e5d3d57d5a49d322488a4f227997df27
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded URLs and a heuristic firing for brand-impersonation credential phishing. The ML classifier also strongly indicated maliciousness. The document body appears to be garbled text, but the presence of a link to 'vataripisak.weebly.com' and the phishing heuristic suggest the intent is to trick the user into downloading a malicious file or visiting a phishing site. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9935

Heuristics 4

  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://vataripisak.weebly.com/uploads/1/3/4/6/134600115/7162843.pdf.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=folk+devils+and+moral+panics+the+creation+of+the+mods+and+rockers+1980 PDF link annotation
    • https://vataripisak.weebly.com/uploads/1/3/4/6/134600115/7162843.pdfIn PDF document text
    • https://mujeganivavubu.weebly.com/uploads/1/3/1/4/131406781/nodoreg-dabuj-davorolukexote.pdfIn PDF document text
    • http://wumewil.sportsontheweb.net/6735786892.pdfIn PDF document text
    • http://jabilevij.mypressonline.com/how_do_you_motivate_yourself_to_achieve_your_targets_at_work.pdfIn PDF document text
    • https://sunatoruxule.weebly.com/uploads/1/3/4/4/134476105/saxetidebotoji.pdfIn PDF document text
    • http://warixedivukinat.mygamesonline.org/42326984361.pdfIn PDF document text
    • https://cdn.sqhk.co/noxibogalu/aDeHeji/fezakagujilasaxavito.pdfIn PDF document text
    • https://nipetetoxijekuj.weebly.com/uploads/1/3/4/7/134718304/belut.pdfIn PDF document text
    • http://sijubuwejipamun.mywebcommunity.org/11588074820.pdfIn PDF document text
    • http://baliferifopiz.mypressonline.com/71803515465.pdfIn PDF document text
    • https://cdn.sqhk.co/zuxolusufa/thfWUhe/car_gear_shift_pattern.pdfIn PDF document text
    • http://genokoti.iblogger.org/14686511796.pdfIn PDF document text
    • http://demejizato.22web.org/career_coaching_workbook.pdfIn PDF document text
    • http://gojavodevagajuw.mygamesonline.org/what_does_a_large_sweet_potato_look_like.pdfIn PDF document text
    • http://tonedomopoja.scienceontheweb.net/universal_remote_code_for_toshiba_tv_dvd_vcr_combo.pdfIn PDF document text
    • https://cdn.sqhk.co/ravuviwidi/jjgP0gc/drop_it_like_it_s_hot_lil_wayne.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xapimiwosusuv.epizy.com/chicago_citation_page_format.pdfIn PDF document text
    • http://rulamiji.onlinewebshop.net/grade_7_math_pretest.pdfIn PDF document text
    • http://bofoputuweja.rf.gd/677450536.pdfIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/inter_tel_axxess_software.pdfIn PDF document text
    • http://gogamezotuzapop.epizy.com/war_plane_games_for_pc_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00030aec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30AEC 6020 bytes
SHA-256: c4f878a4e3d3cfba948d2ac84d81e60b79f197420d15a97a295fade131534e0d
font_01_sfnt_off00031f4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31F4C 13304 bytes
SHA-256: cf8c9624c861c28d39a0b67a5c5a0eb69bedfb53274b6ef17e012c2b9bbf32d3
font_02_sfnt_off00034aa6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34AA6 17428 bytes
SHA-256: aab08c9316ab98875248f9ccccf69039e8eeb77a71e70bccea831b43cf00d5b1

Open this report in the interactive analyzer, or submit your own file for analysis.