Malicious PDF — malware analysis report

Static analysis result for SHA-256 d35651476c3c8e5d…

MALICIOUS

PDF

202.0 KB Created: 2018-04-25 15:37:22 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 81923d07d8b2ef49da7b32be9b4b09f2 SHA-1: 0d0f30a38df5364fad83fc5573ddabd852b196b1 SHA-256: d35651476c3c8e5d1237cd384ac828d877f991df4d252018984c6a948422cd9f
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a heuristic indicating it is an SEO redirector for phishing, specifically a 'free-download phishing' lure. The embedded URL, http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D1%84%D0%B8%D0%B7%D0%B8%D0%BA%D0%B8+%D0%BB%D0%BE%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BA%D0%BE%D0%B2+%D0%BF%D0%B0%D0%BD%D0%B5%D0%B1%D1%80%D0%B0%D1%82%D1%86%D0%B5%D0%B2, is the primary indicator of this malicious activity. While no scripts were explicitly extracted, the PDF structure and the nature of the redirector suggest it's designed to lead the user to a malicious site, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7668

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D1%84%D0%B8%D0%B7%D0%B8%D0%BA%D0%B8+%D0%BB%D0%BE%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BA%D0%BE%D0%B2+%D0%BF%D0%B0%D0%BD%D0%B5%D0%B1%D1%80%D0%B0%D1%82%D1%86%D0%B5%D0%B2 PDF link annotation
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907224_bugufonvliiaiutliotsenkiegenamedal2017tenabol.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906885_bawarreshebnikuchebnikapofizike10klassmiakishevgabisi.pdfIn PDF document text
    • https://inernutbang1982.files.wordpress.com/2018/04/lijofegiga-gdz-po-geometrii-8-klass-2003-god-kikiso.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906183_kefgdzangliiskiiiazyk5klassuchebnikafanasevamikheevadojido.pdfIn PDF document text
    • https://alkrabhelra1974.files.wordpress.com/2018/04/biwipetume-windows-loader-by-daz-2-6-2-unsupported-partition-table-judozodeguli.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906154_vaderesmolenskatsspravochniksawi.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907885_pemumgdzpomatematike5klasszadachniksamostoiatelnaiarabota13zomuz.pdfIn PDF document text
    • https://dersraposgue1981.files.wordpress.com/2018/04/zitajabetaw-gdz-reshebnik-po-algebre-7-klass-makarychev-sivazakavevazid.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906162_baxrealnyekimyporusskomuiazykuege2017sotvetamipejizad.pdfIn PDF document text
    • https://fettimicut1978.files.wordpress.com/2018/04/zipetulo-perevozchik-3-srochnaia-dostavka-perevozchiki-v-realnom-mire-torrent-bebisole.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906549_takusgdzpoliterature4klasskotirabochaiatetrad1chastkubazor.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906421_pasegepoobshchestvuspravochnikbaranovsok.pdfIn PDF document text
    • https://rimervikab1977.files.wordpress.com/2018/04/wiwaboxisaf-3-klass-reshebnik-po-chteniiu-2-chast-efrosinina-poxivuzevuzu.pdfIn PDF document text
    • https://muebiosetua1987.files.wordpress.com/2018/04/wowuparigadin-gdz-istoriia-srednikh-vekov-6-klass-rabochaia-tetrad-kriuchkova-2016-otvety-fiminop.pdfIn PDF document text
    • https://drowgeifrasce1988.files.wordpress.com/2018/04/vizule-ege-obshchestvoznanie-samostoiatelnaia-podgotovka-daluxusizib.pdfIn PDF document text
    • https://muebiosetua1987.files.wordpress.com/2018/04/wowuparigadin-gdz-istoriia-srednikh-vekov-6-klass-rabochaia-tetrad-kriuchkova-2016-otvety-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0002c157.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a48d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA48D 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002c157.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C157 30792 bytes
SHA-256: a6d3861e091a0bbcce61943bacdb90706059b341706a034918ca50bac3e5bde2
font_01_sfnt_off00030700.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30700 15644 bytes
SHA-256: 8b552156df0a8b10a37a42776b9ae5e484b79fa694b52c9b746b56d77ef892ef

Open this report in the interactive analyzer, or submit your own file for analysis.