Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6c22812bf9d28f9…

MALICIOUS

PDF

74.4 KB Created: 2021-06-09 13:54:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 0345c66b36a8cea5850a1f75c6db8d24 SHA-1: cf4bff1bee3ade7bfb193e64a8b1458e0f363044 SHA-256: c6c22812bf9d28f98667e8e0c477174ab3780546d0d6d38dedc35650ebacf195
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan variant. It contains numerous embedded URLs, with a primary suspicious URL pointing to 'medvor.ru'. The document body, though heavily obfuscated, suggests a lure related to 'fire cape strategy osrs', indicating a potential phishing attempt to exploit user interest.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=fire+cape+strategy+osrs PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366653/normal_5fd1451276200.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459784/normal_605aa6b56504e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500200/normal_5ff622c62af1d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4530429/normal_6020b5e13aa29.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456393/normal_5fe9b6584cc52.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e1207c1-39b6-4769-a99c-f0f9e68bed08/bowflex_xceed_workout_plan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af5a7fcd-2908-4ad5-b80c-0554c29c6bed/frases_con_pronombres_relativos_en_ingles.pdfIn PDF document text
    • http://mibegenav.pbworks.com/w/file/fetch/144463065/yvonne_chaka_chaka_thank_you_mr_dj_youtube.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c49f7a7c-7c20-4ddb-9cc4-2c1f35e09975/renkli_tecvidli_kuran_kerim.pdfIn PDF document text
    • http://momoruxoxim.pbworks.com/f/81368846088.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29c203f5-afd5-4b7a-8309-6e1009cd5360/what_are_the_characteristics_of_organizational_culture.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf43663c-e0a1-47aa-b22d-ae9c1b8eec7d/88552097783.pdfIn PDF document text
    • http://wigonewakil.pbworks.com/f/68779781383.pdfIn PDF document text
    • http://nozobitativi.pbworks.com/w/file/fetch/144552669/rigiwanesofagovefuvoxoxap.pdfIn PDF document text
    • http://lekadebixe.pbworks.com/f/sofijiwutomilewijolox.pdfIn PDF document text
    • http://fatakalewene.pbworks.com/f/woseputaxulajugafarazal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2b529fc-c243-49f0-8238-533952467a7d/what_is_dbt_handout.pdfIn PDF document text
    • http://sonopewobu.pbworks.com/w/file/fetch/144715518/play_minecraft_online_with_friends_ipad.pdfIn PDF document text
    • http://gijorugisaw.pbworks.com/f/71775499152.pdfIn PDF document text
    • http://duziruromeja.pbworks.com/f/17097977460.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77966221-d41e-4f01-8b6c-3aa20903a8b7/engineering_mechanics_statics_14th_edition_hibbeler.pdfIn PDF document text
    • http://pidexuxok.pbworks.com/f/tozak.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e749.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE749 5124 bytes
SHA-256: daf3922563013e82200c0c1dd9046916966965579c412c3d29f6b90584c8a240
font_01_sfnt_off0000f8d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8D6 10812 bytes
SHA-256: a027f95c8c506a98680497259ad5f103ce9d8cfe6d31a8cf5e56a720865a611a

Open this report in the interactive analyzer, or submit your own file for analysis.