Malicious PDF — malware analysis report

Static analysis result for SHA-256 07bbe2924b8cc292…

MALICIOUS

PDF

122.8 KB Created: 2021-04-03 10:34:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 04903fb592122f8e676d98eab5be06cd SHA-1: 60d84534a7d2fb346c2644b870d35abb183a8692 SHA-256: 07bbe2924b8cc292f7eae6d1b07c514b89b364f7301b83a96aa44c36a5c11473
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to Weebly-hosted PDFs with numeric slugs, indicative of a link farm or SEO spam campaign. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution via the linked URLs. No scripts were extracted, but the PDF structure itself is used to host numerous external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=billardtisch+selber+bauen+pdf PDF link annotation
    • https://sudivepa.weebly.com/uploads/1/3/5/3/135315425/zulubipafor.pdfIn PDF document text
    • https://tagipuzato.weebly.com/uploads/1/3/0/7/130776724/59704b1bce9ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403673/normal_6025c0b254225.pdfIn PDF document text
    • https://cdn.sqhk.co/fabokofe/hjiiejd/pixel_car_racer_mod_apk_pc.pdfIn PDF document text
    • https://cdn.sqhk.co/funixatugesi/TFCIgfL/somafumunixaliwiporula.pdfIn PDF document text
    • https://zedunuburow.weebly.com/uploads/1/3/4/0/134042823/fa41d75.pdfIn PDF document text
    • https://kegipulavuraruz.weebly.com/uploads/1/3/1/1/131163865/89d7a.pdfIn PDF document text
    • https://razivizufizide.weebly.com/uploads/1/3/4/5/134525322/dewimis-fedodamixuxozul.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479684/normal_6022ceb117497.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392656/normal_601cda8f3a413.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454040/normal_5ff7604f530d0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sixenogafopoj/architecture_students_presentation_sheets.pdfIn PDF document text
    • https://s3.amazonaws.com/palevijuj/aplikasi_videoder_uptodown.pdfIn PDF document text
    • https://s3.amazonaws.com/mefonevimimix/raporidedur.pdfIn PDF document text
    • https://s3.amazonaws.com/jezaxojipevu/microsoft_management_reporter.pdfIn PDF document text
    • https://s3.amazonaws.com/wizuluworafid/79946689157.pdfIn PDF document text
    • http://gaziwagepatoz.rf.gd/himno_del_maestro_ecuatoriano.pdfIn PDF document text
    • https://s3.amazonaws.com/xojafemori/boss_bengali_movie_songs_pagalworld.pdfIn PDF document text
    • http://bomafedugu.epizy.com/viper_479v_remote_start_programming.pdfIn PDF document text
    • https://s3.amazonaws.com/gofiguj/asm_study_manual_for_soa_exam_p.pdfIn PDF document text
    • https://s3.amazonaws.com/lizuseguwix/why_apostolic_succession_is_wrong.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a2bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A2BC 5432 bytes
SHA-256: ed062984f503919c7cc9a55713a48008356718cd036bfa622311cbe0c94c228f
font_01_sfnt_off0001b528.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B528 12316 bytes
SHA-256: a61c5e4e1e15750d247b869baa20dd88dcd7c037db318e9d5c9b820dabb0ce67

Open this report in the interactive analyzer, or submit your own file for analysis.