Malicious PDF — malware analysis report

Static analysis result for SHA-256 050e6fdfae2e4fc9…

MALICIOUS

PDF

83.1 KB Created: 2021-03-12 08:32:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92302d1aa7d9ab66b3132c5866863a9d SHA-1: 3a263a3961675816ebc83d7e00d96d339a9f66f3 SHA-256: 050e6fdfae2e4fc95da697417549e79060b37227c4747941a6dcedcaeedc864a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm or redirection mechanism. ClamAV and ML classifiers identified this as a phishing or malicious PDF. The document body, though heavily obfuscated, contains references to a budget speech and PDF metadata indicating it was generated by wkhtmltopdf, a tool often used to create documents for SEO spam or phishing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=punjab+budget+speech+2018-+19+pdf
    • https://static.s123-cdn-static.com/uploads/4378152/normal_5fe2b6eb3ac0e.pdf
    • https://static.s123-cdn-static.com/uploads/4421788/normal_600962918ba0a.pdf
    • https://static.s123-cdn-static.com/uploads/4413578/normal_5ff19bdd98844.pdf
    • http://dapajurop.mygamesonline.org/namurifirij.pdf
    • http://bumasujofoj.getenjoyment.net/34523448994.pdf
    • https://cdn.sqhk.co/wakivugex/aYjfgdK/download_smurfs_village_mod_apk_new_version.pdf
    • https://cdn.sqhk.co/sifalavuxozo/hQgfGm3/wenizuluxozodemisodof.pdf
    • http://vogudikomi.getenjoyment.net/best_ab_workouts.pdf
    • http://wejowadizabudex.mypressonline.com/the_sense_of_an_ending_movie_free_download.pdf
    • https://cdn-cms.f-static.net/uploads/4483081/normal_6026a2433d6d3.pdf
    • https://static.s123-cdn-static.com/uploads/4491437/normal_5fc9bb4ca1936.pdf
    • https://cdn.sqhk.co/tinolefowi/Z2jf2gd/87882485297.pdf
    • https://static.s123-cdn-static.com/uploads/4393204/normal_60010a23b4b92.pdf
    • https://static.s123-cdn-static.com/uploads/4452381/normal_5fcc167877849.pdf
    • http://tonedomopoja.scienceontheweb.net/5668499497.pdf
    • https://cdn.sqhk.co/jifedibodo/hagiahb/54317069213.pdf
    • https://cdn.sqhk.co/kawonidoza/ifk8hay/66359854864.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://45f61934-b4a1-4335-a9e3-e142d9465b5b.filesusr.com/ugd/0dd040_ef7d6a29d53a429bb47c180fd1832cbb.pdf?index=true
    • https://93bb5028-8b17-4c47-8ab9-f46a024b0e86.filesusr.com/ugd/041612_5bc6745946324b4594dcea27fa04d8bc.pdf?index=true
    • https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_6672955a3c904d6781e1111dcd0f2a90.pdf?index=true
    • https://9907981b-0bc7-4fd3-a434-169f7cdadf42.filesusr.com/ugd/575363_ed3bc6a9b65b4a278097bec756843aa7.pdf?index=true
    • https://917ed8d3-8a9f-4c5c-a3ad-554e533308ad.filesusr.com/ugd/a4e402_f22200e7513f4649968ff6b9fc559ea9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010452.bin
c5f9e1fafedad2297a097f59ae1a39cfc50c176d788599002ec4c246481b18f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10452 6216 bytes
font_01_sfnt_off00011984.bin
0022e57604b37c11ca3ebd64a917b1e698ed1a4106d3c1ef3a8d5c9b37b25a29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11984 10944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.