Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0fec36c55c0248a…

MALICIOUS

PDF

88.3 KB Created: 2021-03-28 10:00:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 341d92414f111c303f135d1b56eac803 SHA-1: 21ddf60f587ba53e231d43ad3341f74ce443afc7 SHA-256: b0fec36c55c0248aa6865fd56115c017fa797c16428e5a4176078c1c8d2da063
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document prompts the user to install a browser update or plugin. Several extracted URLs, such as https://druttle.ru/123?utm_term=uc+browser+old+version+2018, are associated with this lure, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=uc+browser+old+version+2018 PDF link annotation
    • https://cdn.sqhk.co/venitalobeni/B9ihFif/59756719933.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475562/normal_604864f2e67d1.pdfIn PDF document text
    • http://rowexusaje.mypressonline.com/42692688136.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485570/normal_5fdb284f9993a.pdfIn PDF document text
    • https://cdn.sqhk.co/guzowozuk/jV6SZhf/rajudunavunivimolikedi.pdfIn PDF document text
    • http://zegobudipaju.mywebcommunity.org/around_the_world_in_80_days_macmillan.pdfIn PDF document text
    • https://cdn.sqhk.co/baxotonad/cSjgjhd/ludo_world_online_pc.pdfIn PDF document text
    • http://pipavinekiga.mywebcommunity.org/rorolu.pdfIn PDF document text
    • http://mizifasurogik.mywebcommunity.org/best_english_grammar_correction_software.pdfIn PDF document text
    • http://fepaporipevari.mypressonline.com/char_broil_oil_less_fryer_turkey_time.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417321/normal_5fd284da12731.pdfIn PDF document text
    • https://cdn.sqhk.co/nufopusifa/ggdiggc/download_game_bmx_boy_mod_apk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4a12baa-d0ca-4f14-aed1-9a5476a4de77/235116551.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab199608-eb9b-4f4c-9ed3-5f5d23201ae3/perfect-english-grammar.com_past_participle.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a053a68-88c2-4f7d-82fe-68f5ce4459c2/65459694479.pdfIn PDF document text
    • http://pikubub.onlinewebshop.net/fossil_q_explorist_hr_gen_4_charger.pdfIn PDF document text
    • http://valupakukav.myartsonline.com/dd_wrt_router_ip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bf8572b-a9c9-43f1-83eb-a193a46a10a3/79718736707.pdfIn PDF document text
    • http://fajazimigig.atwebpages.com/16376791587.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ae595df-619f-44aa-a1ca-3c73118fb4c7/how_to_use_clever_fox_budget_book.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c670.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC670 3988 bytes
SHA-256: 6ca6804b9db785ba4d05ee7a7a7c4d18933686719a51b374f48d22400336ba17
font_01_sfnt_off0000d498.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD498 5528 bytes
SHA-256: d7fe2b2af809785631c99075b3e0879e6f965a60c40317e799d4a6406e1693f3
font_02_sfnt_off0000e791.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE791 4140 bytes
SHA-256: fbdd9df555c8710fa493947bde41d1b30e4b750f457ece442df516a7dd53c510
font_03_sfnt_off0000f4ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4AC 6640 bytes
SHA-256: eca62b72654736461a635ba366d09d794777fd95c58152d2b251becdfce657e0
font_04_sfnt_off00010649.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10649 11656 bytes
SHA-256: e834492eeed88677e4f14024515a2478b3ea13db3ec220d7ad23c51c08c47b5b
font_05_sfnt_off00012c16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C16 16988 bytes
SHA-256: ae2fc9a1facbf61d8968b36683d1a52421222a2f51032247e96ef581ff39d8ae
font_06_sfnt_off0001449b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1449B 2832 bytes
SHA-256: a12908a88df35a7e9eb57470e9a94a806bb52df392ce88a62d07cba2b79b9044

Open this report in the interactive analyzer, or submit your own file for analysis.