Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6731a64833eb2a7…

MALICIOUS

PDF

84.2 KB Created: 2021-06-07 17:28:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11d5e97c64f848692f4260325597133d SHA-1: d3578bdeab20ca2836036d9ab5fd47e637ba3b8a SHA-256: f6731a64833eb2a73fd769f8b318aad00940910806c38e621298fa1d8c09c3b0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains references to a movie title and the authoring application 'wkhtmltopdf', suggesting a lure. An embedded URI points to 'ketchas.ru', which is likely a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/pbw?utm_term=tres+metros+sobre+el+cielo+pelicula+completa+parte+2+facebook
    • https://sexaxekeka.weebly.com/uploads/1/3/5/3/135313825/5666288.pdf
    • https://dipediras.weebly.com/uploads/1/3/0/7/130739778/6413816.pdf
    • https://futivodefumir.weebly.com/uploads/1/3/4/8/134861147/8da01556f87e89.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1cc15080-e29a-4658-8142-af6f1201b03a/60092431951.pdf
    • http://dejapitud.pbworks.com/w/file/fetch/144799437/58145137358.pdf
    • http://pinurakus.pbworks.com/f/do_i_need_to_print_my_southwest_boarding_pass.pdf
    • http://gabekujijud.pbworks.com/w/file/fetch/144539022/8.pdf
    • http://vajaxasave.pbworks.com/f/jogutadubonegekegoj.pdf
    • http://bukafag.pbworks.com/f/how_to_download_rlcraft_on_minecraft_pc.pdf
    • http://letonepamusi.pbworks.com/f/37767552877.pdf
    • https://uploads.strikinglycdn.com/files/456dde25-49fa-4427-b113-a8f80a1bf226/51826766263.pdf
    • https://uploads.strikinglycdn.com/files/104aa06a-1f38-4c08-b36d-4f60aef5cd20/procreate_how_to_start.pdf
    • https://uploads.strikinglycdn.com/files/5bc6deeb-916d-45ab-a448-8290ff181015/what_are_the_first_20_elements_and_their_symbols.pdf
    • http://sipibujewadu.pbworks.com/f/vasos.pdf
    • https://uploads.strikinglycdn.com/files/5aefd5f4-0cd7-4351-add0-7d80b0e3dace/free_psn_code_generator_apk_downloader.pdf
    • http://bovojigu.pbworks.com/w/file/fetch/144418140/15246981713.pdf
    • http://favixose.pbworks.com/f/miwuta.pdf
    • http://mutoteja.pbworks.com/w/file/fetch/144503277/fath_ul_bari_urdu_free_download.pdf
    • http://sowenux.pbworks.com/w/file/fetch/144547428/nirisonidixo.pdf
    • https://uploads.strikinglycdn.com/files/3c89def9-8c09-4410-8a5b-b9e952ea057c/gafijudobosafesediguxifu.pdf
    • http://mokapuv.pbworks.com/f/88862024601.pdf
    • http://fezosubi.pbworks.com/w/file/fetch/144781308/duwisenuto.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010306.bin
24bf6164b1ec1d814f9ed684e7a0c23c4941bc36d297baed38c79427b2bff6d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10306 5444 bytes
font_01_sfnt_off00011575.bin
217044fecce00f39c3fbe5436a211270bf2cae68a189b5bdb5cb2f95935041ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11575 14860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.