Malicious PDF — malware analysis report

Static analysis result for SHA-256 04447ec8cd9f7968…

MALICIOUS

PDF

78.8 KB Created: 2021-04-09 03:06:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6fc064297f8d375165bfbba79fbab48d SHA-1: 265323ec4084f96faf5b73f8e4787e538d1c4847 SHA-256: 04447ec8cd9f7968acdd338339f7e444f17719925089d870accf4cb5875d7f5e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified as a link farm, with the primary purpose of directing users to potentially malicious websites. The document body, though heavily obfuscated, appears to be a lure related to movie cast information. ClamAV and ML heuristics confirm the malicious nature, classifying it as a phishing or trojan PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=the+monkey%2527s+paw+movie+2011+cast
    • https://jenifamizoj.weebly.com/uploads/1/3/5/3/135319667/dcba47976d3fab2.pdf
    • http://moymagazin.xyz/llyn_brenig_latest_fishing_reportsl0bfz.pdf
    • https://getelomivono.weebly.com/uploads/1/3/0/7/130776590/2419102.pdf
    • http://itrom.fun/jigurukokelis1nh2.pdf
    • https://koburuwojut.weebly.com/uploads/1/3/1/3/131378968/1ec806c9477e285.pdf
    • https://rosojuvawava.weebly.com/uploads/1/3/4/7/134719385/fiwirejudulimujubuf.pdf
    • http://tryadasert.online/20520486498zgoqs.pdf
    • http://zonojebiridizo.mywebcommunity.org/92606394512.pdf
    • https://gebikatewizej.weebly.com/uploads/1/3/4/3/134311033/sapinuruja-lolekufalov-xajuwutefemi-merixagukux.pdf
    • http://komaxinatobofe.medianewsonline.com/zowivujikodujenazavejo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b6086c54-8ef4-40f3-ba18-bbbb993b339e.filesusr.com/ugd/36e927_25128382af784d7bb0866290f6acc795.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d8b12938-8553-4ba7-b7a0-d50bcf1ed13e/how_to_develop_android_app_using_netbeans.pdf
    • https://uploads.strikinglycdn.com/files/3748ee9a-8067-4fba-9f80-198a3477e2f7/ridobiditiwumoje.pdf
    • https://c216880a-03a2-4774-ab7e-121c93799e8f.filesusr.com/ugd/b5aed9_2d5ea156455b43928855ff32dc1242d8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7c74ed25-13a5-4084-88af-6dc21846a44d/85827048492.pdf
    • https://uploads.strikinglycdn.com/files/c8d03eaf-a3db-4263-82ef-74dd0a1d4f92/guardian_ultra_source_15_000_watt_electric_start_generator_parts.pdf
    • https://uploads.strikinglycdn.com/files/dc391659-6219-420e-b450-26c180d53ebb/62025867004.pdf
    • http://nabulegewuwal.myartsonline.com/verbal_nouns_examples.pdf
    • https://cc652f91-b1ab-470c-b36f-46d838ef85b2.filesusr.com/ugd/fbccce_9b5b919b8dc84ee28fe4332171fa6ff3.pdf?index=true
    • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_abce9aff31c9401498da38629bc8b338.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ec6f9490-5e95-4091-9c7f-887a6e265f93/the_night_before_christmas_song_gene_autry_rosemary_clooney.pdf
    • https://19e6fc83-c281-4d06-93fd-e8b16a02b90a.filesusr.com/ugd/ce5d00_b39ae480f36a43cc84cd5b794f34115f.pdf?index=true
    • http://rodedewezijore.atwebpages.com/adjacent_vertical_complementary_and_supplementary_angles.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2e3.bin
fec875f869e81133029e77d74901c1ab1503dd7d467616e8d48526f15d6e726d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E3 5672 bytes
font_01_sfnt_off00010639.bin
2786039e842d125f15361da549b13ff9beaba6855caf320b5a7fc93a58abf5ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10639 11612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.