Malicious PDF — malware analysis report

Static analysis result for SHA-256 938b0366907c88c0…

MALICIOUS

PDF

70.9 KB Created: 2021-06-14 05:36:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6fd287877b46e726f19b122ed417ddd0 SHA-1: 0f249b9c18e7c4c78d338dd002e1441b058eced7 SHA-256: 938b0366907c88c09fb63411a968fed6e8c157597e9dc5ef003c948d75438980
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier as malicious. It contains an external URI pointing to 'https://chcial.ru/pbw?utm_term=fulo+ka+taron+ka+sabka', which is likely a phishing or malware distribution URL. The document body is heavily obfuscated, but the presence of external links and the high heuristic scores indicate a malicious intent, likely related to phishing or delivering a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=fulo+ka+taron+ka+sabka
    • https://fetarulezi.weebly.com/uploads/1/3/4/4/134487317/lowadubivezegukiteb.pdf
    • https://pupewofitesog.weebly.com/uploads/1/3/4/7/134771191/6953227.pdf
    • https://gixapogaruxa.weebly.com/uploads/1/3/4/3/134331356/vizibamonujofituse.pdf
    • https://mowolonob.weebly.com/uploads/1/3/4/8/134874237/vijopesikorogugakosi.pdf
    • https://boripate.weebly.com/uploads/1/3/4/5/134590871/9b7b135.pdf
    • https://sidedelozamuk.weebly.com/uploads/1/3/1/4/131482822/wejodixivaro.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/6f14aa71-4aa4-4edd-8de6-5b3b59a1ec26/which_batman_comics_are_worth_money.pdf
    • http://wisarazed.pbworks.com/w/file/fetch/144934800/70450770340.pdf
    • http://jebodigezev.pbworks.com/w/file/fetch/145270026/12050551527.pdf
    • http://luwapoveduvi.pbworks.com/w/file/fetch/144660372/ziwizor.pdf
    • https://uploads.strikinglycdn.com/files/48d69f8f-7625-4dae-8331-50699e06c187/keto_intermittent_fasting_meal_plan_reddit.pdf
    • https://uploads.strikinglycdn.com/files/ac316bae-072d-4848-8bf3-2a095de2d3f4/oster_toaster_oven_tssttvmndg_parts.pdf
    • http://gozuwef.pbworks.com/w/file/fetch/144810957/stormbreaker_template.pdf
    • https://uploads.strikinglycdn.com/files/f73a54cc-ddec-47a5-a4aa-ebbf1a8937fe/91115981974.pdf
    • https://uploads.strikinglycdn.com/files/2ab9b530-948b-4c4d-943a-8ce643291e01/circular_11_2020.pdf
    • http://pimepovume.pbworks.com/w/file/fetch/145139190/rewunoxoxekisurib.pdf
    • http://sulegiwi.pbworks.com/w/file/fetch/145272471/25_nm_in_foot_pounds.pdf
    • https://uploads.strikinglycdn.com/files/afb4f1c1-cbe9-4b3f-bc07-5e8343351d4a/25211911850.pdf
    • http://furalagaposu.pbworks.com/f/how_far_does_a_22_bullet_drop_at_100_yards.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c287.bin
3ea9dc0fe5daeba8b7c1286de8752a991578e51b79301a8010be3d8f06b4997c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC287 3080 bytes
font_01_sfnt_off0000cd8f.bin
49a0ce9c3bff5412ca74c590118bc9f9681ab77355ef055e0815291478872902		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD8F 4552 bytes
font_02_sfnt_off0000dd09.bin
6555a4a7d9deb56de9d9d7c306cbc15a60f723c84c9c6afaddeae6d20543e73d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD09 10232 bytes
font_03_sfnt_off0001001e.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1001E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.