Malicious PDF — malware analysis report

Static analysis result for SHA-256 0488e2297906180e…

MALICIOUS

PDF

91.9 KB Created: 2021-03-31 08:09:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f02404ba089d57095a60eef270401203 SHA-1: ba170b1b0b68f1301b177be1937e97532d45962f SHA-256: 0488e2297906180e41db00352451b473dfccea8025050fbdbcd145c1640abb49
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains numerous embedded links, forming a link farm, and directs users to external sites. The document body, though heavily obfuscated, suggests a lure related to 'minecraft equivalent exchange 2', likely to trick users into visiting malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=minecraft+equivalent+exchange+2
    • http://ketotreno.buzz/93669330547ix29i.pdf
    • https://nutagabe.weebly.com/uploads/1/3/5/3/135325028/watubukoziz.pdf
    • https://zinelenugep.weebly.com/uploads/1/3/1/6/131636957/4330227.pdf
    • https://buvonage.weebly.com/uploads/1/3/0/9/130969236/f1a97.pdf
    • https://rolorizumi.weebly.com/uploads/1/3/4/3/134316308/zomamizut_sipixipotig.pdf
    • http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdf
    • http://myyshooop227.site/operation_transformation_chicken_and_chorizo_pasta_bakecrptd.pdf
    • https://wexetapita.weebly.com/uploads/1/3/4/3/134307875/4c30ee.pdf
    • https://taboxataxenigo.weebly.com/uploads/1/3/4/1/134108556/6848111.pdf
    • https://xenolato.weebly.com/uploads/1/3/4/8/134868471/penurevewuz-ludutakoru-fujabubesad.pdf
    • http://usmileofficial.site/846567700805mfp0.pdf
    • https://bizidijekivaza.weebly.com/uploads/1/3/4/5/134502856/8503071.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9b36b698-b494-48ea-8a0f-75b37c3645b9/26745231456.pdf
    • https://uploads.strikinglycdn.com/files/56e30608-bb0f-4ac2-91e4-ce77ff28185d/78541940291.pdf
    • https://35057dd6-1d18-4acd-96c9-af3b7fddc7cd.filesusr.com/ugd/978dd5_4540173b97d241629142ccdf09b435da.pdf?index=true
    • https://43fe4710-460a-4ad3-90dc-2dd795c51528.filesusr.com/ugd/a32c20_292218ebc9554b89a84d4a6142cd0af6.pdf?index=true
    • https://b615eccc-4413-4b1d-8109-ede925130a83.filesusr.com/ugd/0994f9_bb5fcdab127c47e984e0307db086a3ab.pdf?index=true
    • https://ad646471-8556-449a-8150-55a6f6ff724f.filesusr.com/ugd/7a1c5b_14c63782c720426a848a3a2c640592e6.pdf?index=true
    • https://55afd15b-9a96-48ff-beb6-d705f4765584.filesusr.com/ugd/8b06a9_22bb77e364814ee99aaa38fb07f027a3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/09d3b3e4-aed5-4b2b-95d5-681059d24deb/sportdog_bark_collar_manual_sdt54.pdf
    • https://uploads.strikinglycdn.com/files/92b84cb3-8d31-4b25-9084-84e0e5402379/wuludimosezukapokunuzagu.pdf
    • https://30d6ba4c-d201-4e26-8f31-a0e059b28788.filesusr.com/ugd/f9b8bb_a2a036a9adb84ca3af3208f725015927.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000110c3.bin
8387452bc8c17e78e9e87ea9619a12f639cff9c7414977d4f1c24787bc078122		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110C3 5356 bytes
font_01_sfnt_off00012315.bin
67fd1667a9fd9868b6f57fea0c006ffba56a2d9e972a957f75e08ab74f24d3b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12315 12080 bytes
font_02_sfnt_off00014ba5.bin
6f41d85279102efce3c4bd26fddb767baf9b68a4f55e239fba9bedc2a2d3b953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BA5 16064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.