Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec0b5b913f3ce6e9…

MALICIOUS

PDF

86.9 KB Created: 2021-07-22 12:24:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13
MD5: 0f9441ced8a7e5d91ad94f224e2986d3 SHA-1: 4817c40b3d2b908c67e1b135c5cc0ed766013813 SHA-256: ec0b5b913f3ce6e91177ad59b21a0473209b1fb769ff671abed9d520b30ea1e6
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a high-severity 'PDF_SEO_UTM_REDIRECTOR_LINK' and a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The embedded URL 'https://crewmak.ru/square?utm_term=fraction+division+class+5' is identified as a redirector, suggesting a phishing or malware distribution attempt. No scripts were extracted, but the overall pattern indicates a malicious document designed to redirect users to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/square?utm_term=fraction+division+class+5 PDF link annotation
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f8788a86d1dd7b304e5ad5/1626896522523/widatuxikapusodekofeg.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e775192b15604daad6e38c/1625781529849/23985882466.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e86125a90fb542e4ea63f8/1625841957651/dowry_prohibition_act_1961_in_marathi.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f3bb2e6167905317df580d/1626585902581/sdh_in_medical_terms.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e93d423ba7d954d5470960/1625898306837/loan_to_value_ratio_for_investment_property.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f09d869f99b45218f284bc/1626381702223/dil_dhadakne_do_full_movie_free_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f54856cba7b71501fd5445/1626687574542/redirect_to_stdout.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f7a41bfb97ec3952f6bfa9/1626842139977/10560040178.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f909b73f3fc43c4a255b89/1626933687758/turmeric_benefits_for_immune_system.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec78affd54eb070824abf0/1626110127975/the_croods_new_age_full_movie_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f81ad338b1e25ea6e4dea5/1626872532049/miranawejeliworobusiseve.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e83eead11b4c60cfc55c0c/1625833194913/204152939.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f12a430a71fd0da9ada34c/1626417731742/mivomugefi.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e871388061cb7c4098ebaa/1625846072968/meaning_of_interred.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec7d7b4c0b954f9ea39ea8/1626111355862/80744698178.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f6fb79fb8b1f61d651effc/1626798969327/how_to_gift_skins_from_your_locker.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f7a8c80f31d77fba39fd6e/1626843337011/70898087528.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ede4003be50f2c5dae2760/1626203137004/69101923011.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60eca40be0914637f38e0ddf/1626121227817/wuderakubuv.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e784c0738f973b331e3a2b/1625785536955/97648872136.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eedd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEDD 10408 bytes
SHA-256: 991e09ad3b01a642f8278216421c54df35ca2c74fe6c6bc6805faeee644f2859
font_01_sfnt_off00010696.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10696 17848 bytes
SHA-256: ea12db9f2680381c68248eec1c9ad59a3dacc44f622adc7d333cb612e48193cf
font_02_sfnt_off0001359e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1359E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.