Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1c0b202a468e447…

MALICIOUS

PDF

79.6 KB Created: 2021-02-14 12:53:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: b1a3d3f5daca668e78dc2a710647b72a SHA-1: 9cf65267fa826c92468c6bcaa5f7557cd1138a27 SHA-256: b1c0b202a468e447337f8583c5187d37699d3bf1f05379945c2998d66e6a6141
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://crophysi.ru/123?utm_term=delta+milwaukee+jointer+manual'. This, combined with ML classification and ClamAV detection, strongly indicates a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/123?utm_term=delta+milwaukee+jointer+manual In PDF document text
    • https://static.s123-cdn-static.com/uploads/4482023/normal_5fcb1eb588c63.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488336/normal_601886c32cd0e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404124/normal_5fe92c0cb514b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420451/normal_6023ee1a0ac3d.pdfIn PDF document text
    • http://gaydating.world/gikarikifewotilevilalibe3whdq.pdfIn PDF document text
    • https://cdn.sqhk.co/dudugetogi/esDgifU/frozen_oreo_ice_cream_cake_recipe.pdfIn PDF document text
    • https://cdn.sqhk.co/rorefevobo/hcjdrZa/xezinuzufin.pdfIn PDF document text
    • http://neo-tp.ru/34065808350ydd4p.pdfIn PDF document text
    • https://cdn.sqhk.co/wetewajaba/hfo4nCP/bulapamarevaguzoginelup.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383156/normal_601db30f6ac38.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426815/normal_5fda2f2b42620.pdfIn PDF document text
    • https://cdn.sqhk.co/pidodalatip/jMojd8A/wapedage.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447267/normal_602089749cb8d.pdfIn PDF document text
    • http://itprod.space/hodder_plus_edexcel_physics_a2_answersyff0l.pdfIn PDF document text
    • https://cdn.sqhk.co/pajokiman/jgrZicn/creations_pottery_painting_loughborough.pdfIn PDF document text
    • https://cdn.sqhk.co/pesuxitum/9HOPkhj/5_nights_at_freddy_s_movie_release_date.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456728/normal_5fef3986cabf8.pdfIn PDF document text
    • https://cdn.sqhk.co/wepigosogo/jvkjfgQ/super_wings_jett_run_hack_apk_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450439/normal_5fe48db8430c1.pdfIn PDF document text
    • https://cdn.sqhk.co/fedovipawe/Kgfr6jb/free_ios_chat_rooms_app.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f963.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF963 4884 bytes
SHA-256: 230b969ecbbe26990cd888860fcda08569f1254f25df2541e27326bf138fad90
font_01_sfnt_off00010a02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A02 11448 bytes
SHA-256: 8a7b1789329419b542e709e0c921655cae756c744bdd343069f4b933c2e5ff7e

Open this report in the interactive analyzer, or submit your own file for analysis.