Malicious PDF — malware analysis report

Static analysis result for SHA-256 88ac6e6fb33d678e…

MALICIOUS

PDF

81.4 KB Created: 2021-03-05 13:41:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: ab4037a0d2da7a901b6f9fdfa49d7231 SHA-1: 2103429268a95b62198d8b92ce30af0ce977e917 SHA-256: 88ac6e6fb33d678e0e28d501aa8d0d1e5575b96eeb27e51d56b856f2bad50f28
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1105 Ingress Tool Transfer

The PDF document uses a lure related to MIG welding to disguise its malicious intent, as indicated by the document body and the embedded URL. The ML classifier and ClamAV detection strongly suggest malicious content, likely a phishing or trojan payload. The presence of multiple external URLs, including one that appears to be a download link for another PDF, points towards a multi-stage attack involving the transfer of additional malicious tools.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=how+do+you+mig+weld+for+beginners PDF link annotation
    • http://winoraama.website/where_are_the_georgia_guidestones_locatedgrj7s.pdfIn PDF document text
    • http://apple-fruit.space/dezevowavj671w.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387709/normal_5fed95892557c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420013/normal_60402079557a1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495684/normal_602a6f2161cca.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383795/normal_6000a0eeeb995.pdfIn PDF document text
    • https://s3.amazonawIn macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/nuxulikiwab/bruce_lee_workout_routine.pdfIn PDF document text
    • https://s3.amazonaws.com/rolefosiju/hack_alien_shooter_free_android.pdfIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/mapa_budapest_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/fadadedezeker/bill_of_lading_template_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/juzinaramip/19607687630.pdfIn PDF document text
    • http://lofunadex.myartsonline.com/hp_officejet_pro_8500a_plus_printhead_alignment_failure.pdfIn PDF document text
    • http://tiwosutodegadax.onlinewebshop.net/zorix.pdfIn PDF document text
    • https://s3.amazonaws.com/tibanepoxilibud/lung_cancer_guidelines_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/dudujopixejikug/cmd_commands_windows_7_factory_reset.pdfIn PDF document text
    • https://s3.amazonaws.com/kubafezin/london_william_blake_best_quotes.pdfIn PDF document text
    • https://s3.amazonaws.com/wowonesoribu/xujiweruxezowubizidusow.pdfIn macro / runtime command snippet
    • https://s3.amazonaws.com/tetofamuxulil/xerevepizekokidiva.pdfIn PDF document text
    • https://s3.amazonaws.com/bipepezuwed/radenovifenalemi.pdfIn PDF document text
    • https://s3.amazonaws.com/paxunu/48829648536.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4A2 5116 bytes
SHA-256: 4bfced28afb1083c076b90f8ea1a9d03ee674fdc7d14e44118321a18454debd3
font_01_sfnt_off000105f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105F9 10524 bytes
SHA-256: 73756f2af409af410b2a40dd1afe0f3d1d32022ecab5ca1d5b107626224474d4
font_02_sfnt_off000129bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129BD 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.