Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee37e3998aef7926…

MALICIOUS

PDF

70.8 KB Created: 2021-06-09 00:15:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 2c998c2a1de9d26f86c0513c31ebd26a SHA-1: 04c9b571c920a4a0c758b0cf33b8470116cb0ed9 SHA-256: ee37e3998aef792692aff36d266be9c7e9c8c86acb57eee10ee2123f8f22d904
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'infrive.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'vegetables pictures drawing'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=vegetables+pictures+drawing PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4485014/normal_5ff3112f8ead0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377403/normal_5fc80f32ddec0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379054/normal_600d86d923902.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462344/normal_5fd8e6c7f1fe8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba2eccf3-eb8e-423f-aa6d-d0660473e1c4/what_is_the_purpose_of_an_ethical_decision_making_model_in_nursing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3791bab3-2aa7-4025-ad56-87fc9db2c38f/how_do_you_use_a_hoover_steam_mop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9ab6931-6714-4ead-bb86-1a3dba7f15d9/miller_211_auto_set_manual.pdfIn PDF document text
    • http://wiliser.pbworks.com/w/file/fetch/144898500/88743850106.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4b1ff5e-80c1-4738-9529-efe552d7cdf7/how_to_clean_epson_wf-3640.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06ca7a59-bf52-4b9a-a8ed-493eab886ad5/how_do_i_program_an_rca_systemlink_4_remote_control.pdfIn PDF document text
    • http://mijatonevu.pbworks.com/f/nuvupawovuvepol.pdfIn PDF document text
    • http://zusemivak.pbworks.com/w/file/fetch/144594288/buxonejevavumopaputakuli.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/378fd6d4-a101-47eb-a9ad-a380fe486076/zetekib.pdfIn PDF document text
    • http://risoxef.pbworks.com/w/file/fetch/144782358/fadebiganuwavila.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d18b84cc-284f-4bf3-838b-012c445b4b1e/jamey_aebersold_play_along_tracks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/150b4cdd-35cb-462d-b130-dbdc3e6003be/reference_code_s0600_spectrum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7f937cb-2aa0-437f-af5e-59a652f98b03/zexagasivuzoruwemitudutos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9476f01d-4aab-475f-a398-35b297bdae56/online_project_management_certificate_course.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3054881-b16a-4331-ab7e-56cf75c3db72/animal_encyclopedia_book_2020.pdfIn PDF document text
    • http://gupipax.pbworks.com/f/play_online_games_bike_racing_3d.pdfIn PDF document text
    • http://jitilabajeko.pbworks.com/f/what_to_eat_for_carb_cycling.pdfIn PDF document text
    • http://xexufokug.pbworks.com/w/file/fetch/144870372/tivat.pdfIn PDF document text
    • http://juwelite.pbworks.com/f/why_is_my_smoke_alarm_still_chirping_after_i_replace_the_battery.pdfIn PDF document text
    • http://liwuvedesisu.pbworks.com/w/file/fetch/144485292/29577816034.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82524405-8f0d-4913-8d34-7eacb1cd323f/foluwudajibuzaxewagu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ccb6483d-7a99-43a9-8f62-289356ecaf78/why_wont_my_whirlpool_washer_drain_and_spin.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9BD 5440 bytes
SHA-256: fac9ba509cc60472d9c24f29f901356d1012977eccb679f901af3aa4a479d3f3
font_01_sfnt_off0000ec5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC5B 9800 bytes
SHA-256: e53205015c3c32b9365b81404b3663b65382f1ffacb646947b938494966cab56

Open this report in the interactive analyzer, or submit your own file for analysis.