Malicious PDF — malware analysis report

Static analysis result for SHA-256 08c678570f041679…

MALICIOUS

PDF

79.8 KB Created: 2021-03-24 05:05:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 986ca8e0f20d84f04496ae158fd098a5 SHA-1: 24a77c9fa22528d2f6edfc354b54c91777e31181 SHA-256: 08c678570f041679198cfb2f46332b6bae31dc7213bfe1ab416f7497f67cbc41
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing or malware distribution lure. The presence of a mass external PDF link farm and a 'download' button suggests an attempt to trick users into clicking malicious links. The ClamAV detection and ML classifier further support its malicious nature, indicating it likely serves as a distribution point for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=scanned+pdf+to+dwg+converter+online
    • https://cdn.sqhk.co/muzipajat/jgjjfa9/smooth_criminal_video_mp4.pdf
    • https://cdn.sqhk.co/midipijikami/njaZpje/star_traders_frontiers_explorer_build.pdf
    • https://cdn.sqhk.co/ditetona/hbhhLge/johnny_bonasera_1_full_apk.pdf
    • https://tupivoxutod.weebly.com/uploads/1/3/4/4/134467409/vavipetarigap-maxab.pdf
    • https://cdn.sqhk.co/wowasuperan/Xjd0Hje/student_work_experience_report_example.pdf
    • https://cdn-cms.f-static.net/uploads/4470405/normal_6048e416bab99.pdf
    • http://dewigogazesad.iblogger.org/dissociative_identity_disorder_treatment.pdf
    • https://cdn.sqhk.co/letinumi/5jjcgil/last_player_survival_battleground_game_download_apkpure.pdf
    • https://pebajubidu.weebly.com/uploads/1/3/1/3/131383648/a58970483b.pdf
    • https://static.s123-cdn-static.com/uploads/4497358/normal_5fcdd29d06d42.pdf
    • https://static.s123-cdn-static.com/uploads/4387433/normal_5fc5b806e4458.pdf
    • https://keregejuvuja.weebly.com/uploads/1/3/4/3/134345288/kidumudidakuvakivero.pdf
    • https://nuvaxavixo.weebly.com/uploads/1/3/0/7/130738964/9796281.pdf
    • https://cdn-cms.f-static.net/uploads/4373264/normal_5fe994c81369d.pdf
    • https://cdn.sqhk.co/nexasolonit/sZQigjg/roman_tower_defense_games.pdf
    • https://cdn.sqhk.co/kuzetuzame/diaqmje/4_band_snake_puzzle_ring_solution.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f8d82b49-d438-4da2-b906-f876cb6fe635.filesusr.com/ugd/12dc78_079f78e9abad4907a9fedf4e27df3a88.pdf?index=true
    • http://tezajiduzut.epizy.com/poxitevarojixa.pdf
    • http://juzefabamurever.rf.gd/formation_of_andalusite_hornfels.pdf
    • https://a29d81ee-e589-4368-99bd-4e0be04eb4c0.filesusr.com/ugd/a89e6e_7941d960966c4a24aff28d386f01653a.pdf?index=true
    • https://d6ac5066-27fc-4e71-a07d-b30af50dfe8b.filesusr.com/ugd/934fc3_be8cd720b76f483fb8ded8d39a9939d5.pdf?index=true
    • https://b6e49935-6d58-4bde-831f-6e0b746776d3.filesusr.com/ugd/7d321f_588038aa58f941d9a84caded9b625b04.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea31.bin
9440f71eefa4f59c7a71b16fb0b9f65724f2db68f71ee41650680a98f027c4b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA31 4032 bytes
font_01_sfnt_off0000f8a2.bin
a78f7a533f574c39783a7c9f9bd17f9da6f12698f611ed4681d8d4261821b25b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8A2 5400 bytes
font_02_sfnt_off00010b2e.bin
66627cbfdff904f0be19afa1fe6f18001b07b4547cdd7196208ad39cdd39f645		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B2E 11576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.