Malicious PDF — malware analysis report

Static analysis result for SHA-256 068a4d91b7bcbce8…

MALICIOUS

PDF

73.5 KB Created: 2021-03-21 00:44:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 776984286d17df6f4b3ac9150212ea1b SHA-1: 74f1d1f67050a52a68daa3a964bd4d961f6885f6 SHA-256: 068a4d91b7bcbce81155898e434b3a971729f814290225572d5e8969b30a5034
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains numerous external links, a common tactic for SEO spam or phishing. The embedded URL 'https://jumiwimov.ru/wix?keyword=course+hero+unblur+inspect' and the linked PDF 'http://vepijukakogad.rf.gd/finogenug.pdf' are suspicious. Heuristics indicate a link farm and a phishing/malicious classification by ClamAV and an ML classifier, strongly suggesting malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=course+hero+unblur+inspect
    • https://kubazavazagemu.weebly.com/uploads/1/3/4/4/134464578/2592569.pdf
    • https://pidowiwosuzaji.weebly.com/uploads/1/3/0/9/130969191/1174158.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vepijukakogad.rf.gd/finogenug.pdf
    • https://s3.amazonaws.com/levumoduf/blank_magnetic_sheets_for_cars.pdf
    • http://dunetenarep.epizy.com/dewey_decimal_system_autobiography.pdf
    • https://cf268418-7549-4780-9cff-e39e61b5276c.filesusr.com/ugd/0b1cf2_2b57f048f9ad413aaadeb33fa259f7a4.pdf?index=true
    • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_8c9fffd1aa2f4168803059ab780d37d8.pdf?index=true
    • https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_c2c4be2782294acf9c530ce8b72d3140.pdf?index=true
    • https://d4508431-0eee-4913-ac2a-2ec907ed9b18.filesusr.com/ugd/12daa7_25b619a041944ded85ed6621693d82f8.pdf?index=true
    • https://621cd70f-1aca-46de-91df-1bd8162c3e90.filesusr.com/ugd/9f1ad6_f2fd9433024744e881d0d6de2c813b66.pdf?index=true
    • https://s3.amazonaws.com/mokuwanibof/xeraxelixowatobar.pdf
    • https://s3.amazonaws.com/peveziwoguxuzam/intensive_care_society_guidelines_2015.pdf
    • https://d23eb412-52e1-45ef-a32a-0c032022daee.filesusr.com/ugd/03485a_24275c92f8724d758dc0c31ef5f6ddba.pdf?index=true
    • https://e57d8632-f742-4524-ada6-9cdf759d9f13.filesusr.com/ugd/b0cb2d_240214cfa4cc41c39ded5708b372ccd2.pdf?index=true
    • http://fufabufitilaf.epizy.com/dexivixunipefoliba.pdf
    • http://luresagapitep.rf.gd/kojurirefowovikulemogosis.pdf
    • https://5e024257-ca51-40df-b6b5-a3104c7b7124.filesusr.com/ugd/97368a_87ac3203a6f4486dae34778e0b088488.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4bd.bin
cc22b54efa730138f1192c95cc229ba6568fd843f39cc89fe355f17b48bad0de		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4BD 4856 bytes
font_01_sfnt_off0000f535.bin
2ecb5bf58a2c6df247c23cdffd3789f14d9b4675d2ac55fd3d3477e6b9157b82		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF535 10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.