Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc1daf89a26a1eea…

MALICIOUS

PDF

218.9 KB Created: 2018-04-25 17:20:21 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 037ece5c354d4b2b3aee70d7dc010ece SHA-1: bd7aa451fae33ed3f1b3d851adba6142f4dc9c15 SHA-256: fc1daf89a26a1eead055b65c31d33520eb7335d8a9f4f7a0f75458ff91bb883c
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an external URI and a redirector link pointing to 'renimba.info', which is flagged as a lure for free downloads or phishing. The ML classifier also indicated maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to lure users to a malicious site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7263

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%B3%D0%B0%D0%B1%D1%80%D0%B8%D0%B5%D0%BB%D1%8F%D0%BD+%D1%85%D0%B8%D0%BC%D0%B8%D1%8F+9+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+2002+%D0%B3%D0%BE%D0%B4 PDF link annotation
    • https://plotadomus1989.files.wordpress.com/2018/04/kilovodijom-skhema-elektrooborudovaniia-motorollera-tulitsa-gosal.pdfIn PDF document text
    • https://reronessgel1985.files.wordpress.com/2018/04/lekafibo-iashchenko-ege-2017-matematika-36-variantov-otvety-s-resheniem-bazovyi-juzirekifel.pdfIn PDF document text
    • https://taslowido1984.files.wordpress.com/2018/04/numetikufepux-pribytie-poezda-bratev-liumer-skachat-besplatno-vakapira.pdfIn PDF document text
    • https://inpetfipen1982.files.wordpress.com/2018/04/lafij-eldzhei-allj-diskografiia-2017-cherez-torrent-zilijo.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906970_fijovereshuegeinformatika11klass2017sapo.pdfIn PDF document text
    • https://idemungrin1974.files.wordpress.com/2018/04/mixur-skachat-fotoshop-izmenit-fon-fotografii-gasebe.pdfIn PDF document text
    • https://callsuptone1988.files.wordpress.com/2018/04/fefeta-mp3tag-pro-9-5-torrent-2017-pokaf.pdfIn PDF document text
    • https://unkonebac1973.files.wordpress.com/2018/04/ponefupidufisog-gdz-po-angliiskomu-iazyku-3-klass-kuzovlev-uchebnik-2-chast-reshebnik-jazaki.pdfIn PDF document text
    • https://dusmorrcontra1986.files.wordpress.com/2018/04/xufulinanem-skachat-priglasheniia-na-den-materi-v-detskom-sadu-vopuwizixuxab.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906219_gawakivseobshchaiaistoriia11klassreshebnikvolobuevvofu.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5910/5910697_busuvegdzporusskomuiazyku8klass332uprazhnenieladyzhenskaiafotap.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5908/5908469_lekezimsredniiballegepofizike2016vsaratovskoioblastinumig.pdfIn PDF document text
    • https://piespanenti1979.files.wordpress.com/2018/04/donumugenediwa-skachat-kartu-zombi-apokalipsis-s-modom-na-oruzhie-1-6-4-sizefovutinor.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906152_wodpredlozheniiadliasintaksicheskogorazbora3klassproosenjus.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907135_wuletigdzpoalgebresidorov9jon.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00030041.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a48d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA48D 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off00030041.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30041 31960 bytes
SHA-256: a1dd0fd01dab6b65047a5506c3417676ee1c8f160acd594b25e2fba88fdfb9a8
font_01_sfnt_off0003491f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3491F 15956 bytes
SHA-256: cfc3da7b250283cfba66511a93151eac8e5a037b8abb5f98da02c65d4dcbea7f