Malicious PDF — malware analysis report

Static analysis result for SHA-256 08f9acd48349cd18…

MALICIOUS

PDF

122.2 KB Created: 2021-03-17 22:12:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 552192684c64a119bc0f1e0925766ff6 SHA-1: 4901b45a5f5c169c14cf48d70c93612efb91de3f SHA-256: 08f9acd48349cd183f424f450cafb57ab144490ed6a0a32b2e69b494f1d6a49e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. One prominent URL, 'https://pelibifir.ru/wix?keyword=dragostea+din+tei+translation+spanish', is directly embedded and flagged as unknown reputation. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=dragostea+din+tei+translation+spanish
    • http://dolugonowavogo.iblogger.org/amines_preparation.pdf
    • http://zuraribofib.22web.org/blank_calendar_format_2019.pdf
    • http://remontnatali.ru/professional_event_coordination_2nd_edition_free_downloadq4nmn.pdf
    • http://chempion.coffee/67030351420yqpkx.pdf
    • http://www.opentle.org
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9e67c384-bfa9-40d0-a599-f67b3566c9dc/warutaxepixoziwime.pdf
    • https://uploads.strikinglycdn.com/files/b5b256cc-15a6-41bb-b7c8-63bb7fd94e4b/how_do_you_write_a_critical_self_reflection.pdf
    • https://uploads.strikinglycdn.com/files/c5b815d1-68cb-4e77-b287-a29ecdd0e8d7/laxovuwejagalodazijunu.pdf
    • https://s3.amazonaws.com/jevedijadiki/labubuxobaj.pdf
    • https://uploads.strikinglycdn.com/files/57202093-1c2d-45b5-a68c-3a333b2515af/monster_rap_song_lyrics.pdf
    • https://724418e0-3ace-43c1-abd8-628b4820fc71.filesusr.com/ugd/6df952_b0b5e762309e4342b7d1e385479f0fb6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4b548524-953d-422a-9752-4451b9ea609d/trigonometric_identities_class_10.pdf
    • https://s3.amazonaws.com/sebunuzu/ceidg-_1_wersja_1._8._8.pdf
    • http://bufivuz.rf.gd/84608540218.pdf
    • https://uploads.strikinglycdn.com/files/ca9d20d5-9231-481c-8c3c-1ef87890afd2/90037854670.pdf
    • https://uploads.strikinglycdn.com/files/ff1647dd-abfe-4c52-a09f-8b2c1dd04b52/hp_laserjet_p1606dn_network_installation.pdf
    • https://s3.amazonaws.com/bupaxomu/chopin_waltz_in_a_minor_sheet_music.pdf
    • https://s3.amazonaws.com/kaxukok/how_to_clean_honeywell_quietset_whole_room_tower_fan.pdf
    • https://30d6ba4c-d201-4e26-8f31-a0e059b28788.filesusr.com/ugd/f9b8bb_269b29cbcecd4530830bc536228ffa40.pdf?index=true
    • https://s3.amazonaws.com/padosumifubobo/new_punjabi_song_ringtone_pagalworld.pdf
    • http://wavagejofelodun.rf.gd/wizard_spell_list_5e.pdf
    • https://1682489e-d94b-4f22-b6a6-c8ecb623ca2e.filesusr.com/ugd/5f226e_bf31e3b2243e4f5092dddde94d9b8881.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a39e2690-6d7c-4509-831b-0a3a6e49ebf3/gidakijugulidofisowosewi.pdf
    • https://uploads.strikinglycdn.com/files/7117c99b-6d20-44a9-92d2-85f158b38abe/94773327143.pdf
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_b4fc4fa831b041a2822fa196f8be449a.pdf?index=true
    • https://7f3dc8b3-869c-44c5-82eb-14ae88d57796.filesusr.com/ugd/dc4ca1_1f63148b62aa4723b17f0233f205a8c0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://www.gnu.org/licenses/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001906d.bin
639fd1640373e40941402288b96239e8a89343187987d152bd490f9114b24717		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1906D 8544 bytes
font_00_sfnt_off000145e8.bin
cd8578d0ac0a17ab8efd5566b551c6c28ed46a252cec1ae573d3a18190ff3774		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145E8 17520 bytes
font_01_sfnt_off00017ebc.bin
3982288468f001873645998779846993789bd0100410f1842511caee551d3c66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17EBC 5220 bytes
font_03_sfnt_off0001a848.bin
6f1297245f99090cf6cb6231f012100d6af5a82514425dc40c24e3b5512d1bad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A848 17724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.