Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6710a4bae2ead4a…

MALICIOUS

PDF

75.2 KB Created: 2021-09-24 07:59:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 0e9edec8df38470740a75db88d53fe1f SHA-1: 14384e0511bf17de7f7cf2d374bfa75f3aafbe6d SHA-256: b6710a4bae2ead4a680534c356e37678594e6a2aa838d0ee14b6f87a55d24fbf
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript and numerous external URIs, many of which are hosted on disposable domains or appear to be part of a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to malicious sites for exploitation or phishing. The presence of PRC/3D content and the 'LOLBin run command' heuristic further suggest an attempt to exploit vulnerabilities or execute commands.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9948

Heuristics 8

  • PRC/3D content in PDF high CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://b2bircruise.travflex.com/bot/ckfinder/uf/files/67146447683.pdf In PDF document text
    • https://alwaysthesame.pt/site/upload/file/wufoxatinepekagepoxen.pdfIn PDF document text
    • https://masterjobintl.com/ckfinder/userfiles/files/vedijibutif.pdfIn PDF document text
    • https://hkfew.org.hk/ckfinder/userfiles/files/jisegun.pdfIn PDF document text
    • http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/377pac78auragc53jomh52cv1i/dijifofajomejowaxapizax.pdfIn PDF document text
    • http://bkmarine.net/ckfinder/userfiles/files/1631177744.pdfIn PDF document text
    • http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/161480967d6652---nipebowexefonemuviwovilu.pdfIn PDF document text
    • https://tonwen.org/userfiles/file/nipolidoluzanevipazi.pdfIn PDF document text
    • http://gamjagolla.com/uploads/files/fizilusufoxawogi.pdfIn PDF document text
    • http://wxmx.cn/upload/ckimg/files/202109190529345694.pdfIn PDF document text
    • http://bjdfszwy.com/filespath/files/20210923075424.pdfIn PDF document text
    • https://texasbordervolunteers.org/userfiles/file/mawojigu.pdfIn PDF document text
    • http://underbutter.cz/download/foto/nedudapijupemakemuw.pdfIn PDF document text
    • http://cupta.org/userfiles/files/20210904115045.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/batoge.pdfIn PDF document text
    • http://xn--80aafbanafwvcftiqfecrg2a.xn--p1ai/pict/file/fuwavevivomolire.pdfIn PDF document text
    • http://circuitvietnamcambodge.com/hinhanh/file/lotebasiz.pdfIn PDF document text
    • http://gold-carsales.com/js/upload/files/munokarefejisasevemufo.pdfIn PDF document text
    • http://shesob.com/file/files/bojitewuzosinobimaneriw.pdfIn PDF document text
    • http://qdcmd.com/data/files/fibufijudixubasuk.pdfIn PDF document text
    • http://ilkjv.com/Images/Media/files/variradibebugewefoteni.pdfIn PDF document text
    • http://fcraregistration.com/UploadedData/file/wodikosepusujiwisinonaw.pdfIn macro / runtime command snippet
    • http://hoilhpnqbthanh.com/upload/file/2553311909.pdfIn PDF document text
    • http://analogsys.com/uploaded/file/1304960608613caa3168fd9.pdfIn PDF document text
    • http://ilkjv.com/ImIn macro / runtime command snippet
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=hello+kitty+dream+cafe+mod+apkPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE4A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000d65c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD65C 18552 bytes
SHA-256: 0c71b27fce36bf7f81a8012daea68786c9adc3427979c7f10e9701956493f697
font_02_sfnt_off00010690.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10690 10704 bytes
SHA-256: 0655750ccb52d886f489ec6bd7bd6c2c351fdc97927b87c8a95b10b9df50fbbf

Open this report in the interactive analyzer, or submit your own file for analysis.