Malicious PDF — malware analysis report

Static analysis result for SHA-256 c00b8d0bcde49910…

MALICIOUS

PDF

84.7 KB Created: 2021-03-08 04:45:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5eae7f1aa3a0091bdbb09945cc61821d SHA-1: 71fbffa5d06268efe0319e385c4a77f6feda951c SHA-256: c00b8d0bcde499106c7245349b9835c2a5c97db245ac1235dca9570cf65128fd
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. The presence of a large number of external links, including a link farm, and the 'SE_PAYMENT_REDIRECT_LURE' heuristic suggest a phishing or redirection attack. The document's content, though heavily obfuscated, appears to be a lure related to 'simple machines examples of pulleys', likely a pretext to disguise malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=simple+machines+examples+of+pulleys
    • http://levantemosaic.com/making_a_spreadsheet_for_expenses1j8kg.pdf
    • https://bewotababuruga.weebly.com/uploads/1/3/1/1/131163836/60d6e0d2.pdf
    • https://pidofuvu.weebly.com/uploads/1/3/0/7/130739764/neranowokerudena.pdf
    • https://zepagowixo.weebly.com/uploads/1/3/4/8/134887299/7db67620cf.pdf
    • http://about-fb-support.com/skyrim_mods_to_avoidd08kl.pdf
    • https://nateguwab.weebly.com/uploads/1/3/1/4/131453796/wubetasoka.pdf
    • http://xidufefonudug.sportsontheweb.net/experience_and_education_john_dewey_ebook.pdf
    • https://rapironid.weebly.com/uploads/1/3/1/3/131398378/xasunidosugukupew.pdf
    • https://kejarokelevu.weebly.com/uploads/1/3/5/2/135297316/8264327.pdf
    • https://jobemorisawelav.weebly.com/uploads/1/3/4/1/134108772/7267643.pdf
    • http://drilltech.info/a_christmas_carol_guthrie_cast_2019zaslz.pdf
    • https://lisewukalog.weebly.com/uploads/1/3/4/4/134435391/mimefavigaxi_pikus_pamezodujix_fifelumasis.pdf
    • http://zoneeuro.pro/criminal_law_lecture_notes1edft.pdf
    • http://epaytds.xyz/podozikurulakulojoverexs4nsd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e1cd7dcf-8988-4be8-9b1a-722367337987.filesusr.com/ugd/6203b9_2f35573fec1f4dafa843001212c20541.pdf?index=true
    • https://cc652f91-b1ab-470c-b36f-46d838ef85b2.filesusr.com/ugd/fbccce_690645c1c38142cfb32a13f891fc9dba.pdf?index=true
    • http://dasobiviwadodaj.atwebpages.com/navy_protocol_manual.pdf
    • https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_a81b6b882b1c4f6789a88484057d4aa0.pdf?index=true
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_5865ebe774d041828ea9ed9b7fa0d2ff.pdf?index=true
    • https://3b0fe5ff-7f86-489c-8138-fc984e51136c.filesusr.com/ugd/bfd78a_085f8b54fc7f46939f756f25f9ed6550.pdf?index=true
    • https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_50461fb2186743cb9c1b1a4e3910474c.pdf?index=true
    • http://bivojeda.atwebpages.com/bissell_powerforce_compact_belt_size.pdf
    • https://1058d175-53f8-4d86-9201-ae9c1fc74009.filesusr.com/ugd/62a633_bf5992632455476db2e1fa48f7af101e.pdf?index=true
    • http://zitadufafasid.onlinewebshop.net/public_relations_manager_salary_uk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e4d.bin
82f43758ea86b14dc35109b1dbef9865c4758e1afb2ef7b740d19608b8030a8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E4D 5432 bytes
font_01_sfnt_off000120b2.bin
1b8d0f3d1ae646e3fe8933519722d3961f35359fe853e7d2ccf3d59a3c4b1484		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120B2 10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.