Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbebc7d905f8b4d6…

MALICIOUS

PDF

75.9 KB Created: 2021-06-06 01:07:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75b2dfa9f048d2e34f7b23bc9bed0dea SHA-1: d940d404e93d25c20b176ea6c6b5eaea1b7b2152 SHA-256: bbebc7d905f8b4d61fa9f39befb00eda248ad8780feceee402d62f9dea67caf8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, 'https://wastran.ru/pbw?utm_term=programacion+lineal+excel+solver+pdf', is likely part of a phishing or social engineering scheme to redirect the user to a malicious site. No scripts were extracted, but the PDF structure and embedded URI suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/pbw?utm_term=programacion+lineal+excel+solver+pdf
    • https://pakipuxis.weebly.com/uploads/1/3/5/3/135347710/2024173.pdf
    • https://bisimopax.weebly.com/uploads/1/3/0/8/130814127/3492981.pdf
    • https://kulovuvakaj.weebly.com/uploads/1/3/4/5/134515365/8679b06183a.pdf
    • https://cdn-cms.f-static.net/uploads/4366010/normal_606ab5c4282b0.pdf
    • https://cdn-cms.f-static.net/uploads/4464707/normal_603da6fa78117.pdf
    • https://cdn-cms.f-static.net/uploads/4379720/normal_606ea6bfadfb4.pdf
    • https://woduberorakemam.weebly.com/uploads/1/3/4/6/134667752/javifazitidaxa.pdf
    • https://zematuwarun.weebly.com/uploads/1/3/4/3/134327873/6657399.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xetuduju.pbworks.com/f/how_long_to_watch_one_piece_without_filler.pdf
    • http://nixefijevumu.pbworks.com/w/file/fetch/144554652/how_many_types_of_cladding.pdf
    • http://supatibu.pbworks.com/f/fevexawukisolo.pdf
    • http://togiwuvoze.pbworks.com/w/file/fetch/144591006/atividades_para_fazer_com_bebe_de_1_ano_e_4_meses.pdf
    • https://uploads.strikinglycdn.com/files/22ca5179-d9b3-45e4-a36d-ca1cd53b1add/webewitulenugumawebo.pdf
    • http://dobifapig.pbworks.com/w/file/fetch/144571158/jirofawix.pdf
    • https://uploads.strikinglycdn.com/files/012519ab-f4b8-40e0-906e-dfc9a1c76e84/myers_briggs_types_percentages_uk.pdf
    • http://xoxafepapesu.pbworks.com/w/file/fetch/144424149/ejemplos_de_evaluacion_diagnostica_individual_en_preescolar.pdf
    • http://banusiv.pbworks.com/w/file/fetch/144446319/myles_munroe_books_kingdom.pdf
    • http://togusan.pbworks.com/w/file/fetch/144686358/59229792140.pdf
    • http://gepefupugalu.pbworks.com/w/file/fetch/144686310/mepawenar.pdf
    • https://uploads.strikinglycdn.com/files/9cc2cae6-83c3-4c1c-b1e8-d296f6106ca9/how_do_i_reset_my_spandana_password.pdf
    • https://uploads.strikinglycdn.com/files/a1c9b8d0-d037-48e2-acdc-502d81cfafb9/6629861655.pdf
    • https://uploads.strikinglycdn.com/files/0d006501-7bc6-475f-b414-1348c9189210/can_my_samsung_remote_control_my_soundbar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7c7.bin
0e38119e35ce80fc4b3cd7a324d6fdcdbb737f0a76607913a9a24838c8014219		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7C7 5604 bytes
font_01_sfnt_off0000facc.bin
28168a57212fca24afd8fb1526a2df89f132940f8190a3d45ddfefe8ec1e4d5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFACC 11580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.