Malicious PDF — malware analysis report

Static analysis result for SHA-256 863bdd012a7003aa…

MALICIOUS

PDF

72.4 KB Created: 2021-06-04 12:24:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e0dc8e54ef9d4d1ac03b8204c109fcc0 SHA-1: 20b158fa0f801b166899ccc27018d5ae4b7f2870 SHA-256: 863bdd012a7003aaf5175471d610d9d53153ebb3a11f60b0ba85a5258a840d84
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains embedded URLs and a heuristic firing for 'PDF_SEO_LINK_FARM' indicates a large number of external links, with one pointing to 'http://fokopaviwu.pbworks.com/f/sexekovulememalarare.pdf'. The 'SE_CALLBACK_LURE' heuristic suggests the document is designed to trick users into calling a phone number, consistent with phishing or scam tactics. The primary URL 'https://coretry.ru/pbw?utm_term=caller+name+location+tracker+apk+download' further supports the lure of downloading an application.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/pbw?utm_term=caller+name+location+tracker+apk+download
    • https://cdn-cms.f-static.net/uploads/4382631/normal_600ab019dfa5d.pdf
    • https://komimuvupelogi.weebly.com/uploads/1/3/4/3/134312664/vitulirirewobafob.pdf
    • https://xebokedobonu.weebly.com/uploads/1/3/4/7/134719403/jafak_zukakuvevuviz_mofekajo_tonipekadez.pdf
    • https://viwoxinuzozaxa.weebly.com/uploads/1/3/1/6/131636825/3023634.pdf
    • https://manasuma.weebly.com/uploads/1/3/0/8/130873954/8348936.pdf
    • https://cdn-cms.f-static.net/uploads/4401711/normal_601bc8f8a4c6a.pdf
    • https://pozimifekof.weebly.com/uploads/1/3/4/6/134674510/635611413c62.pdf
    • https://cdn-cms.f-static.net/uploads/4449406/normal_60552fccb9f5d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fokopaviwu.pbworks.com/f/sexekovulememalarare.pdf
    • https://uploads.strikinglycdn.com/files/9aea0546-5e22-4ea9-9784-d8e861420fae/nojuzotovijir.pdf
    • http://detomipipu.pbworks.com/w/file/fetch/144509511/zimifofebavo.pdf
    • https://uploads.strikinglycdn.com/files/ac36291c-4590-411c-842b-d28d3d8a7101/towixizekevidibugazizogoz.pdf
    • https://uploads.strikinglycdn.com/files/cf948c46-d9d6-4ec7-bcce-5e5dbefd7b84/optiplex_gx620_drivers_win_xp.pdf
    • http://xetuduju.pbworks.com/w/file/fetch/144555315/tevebivizafofomisu.pdf
    • http://wikitaxif.pbworks.com/w/file/fetch/144542556/pobofozozajefomovapotifij.pdf
    • https://uploads.strikinglycdn.com/files/3603eed1-e561-4c13-a097-6c9f9c2e70a2/repomef.pdf
    • http://xorunezagu.pbworks.com/w/file/fetch/144460650/sing_to_jehovah_songbook.pdf
    • http://wuxikadafi.pbworks.com/f/68347297888.pdf
    • https://uploads.strikinglycdn.com/files/5a8c467c-fc88-404d-b4b5-9be2e9aedc82/74860206318.pdf
    • https://uploads.strikinglycdn.com/files/35126860-c2f5-4a82-b64d-312fdd3df763/2000_sundance_optima_manual.pdf
    • https://uploads.strikinglycdn.com/files/1a672dd0-33f0-448f-831d-5a67070a9604/symbols_that_represent_romeo_and_juliet_act_1.pdf
    • https://uploads.strikinglycdn.com/files/cfe9e9f4-c076-405e-8ebb-c69d91b2c5b5/jogiw.pdf
    • http://nolumemonip.pbworks.com/f/29936737142.pdf
    • https://uploads.strikinglycdn.com/files/e2cb0991-30ae-451e-af6c-9dc90025d48c/29880246503.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dca8.bin
64d16967bee6d3855e20d029e839bb8ac3bd9ef5bda606831546b070c548f898		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCA8 5104 bytes
font_01_sfnt_off0000edfd.bin
ccbf08419a948e50bb7d9b70cd1bfe2bdbda666d7206adf9241b7a34e1245d96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDFD 10576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.