Malicious PDF — malware analysis report

Static analysis result for SHA-256 0969c7279696e416…

MALICIOUS

PDF

77.6 KB Created: 2021-05-05 14:06:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b63351e43daa11496f7fa1181c7c7ae SHA-1: 32f1fddb0e4156e9e75e91fd96c9a3a55094e6ee SHA-256: 0969c7279696e416e90138f252f4949db6606f904406427b7be4f18cb0828aff
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier indicating a high probability of maliciousness. The presence of a large number of external links, described as a 'PDF link farm', suggests an attempt to redirect users to potentially harmful websites. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document may be designed to trick users into believing they need a password for an archive, a common tactic to bypass gateway security.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=defiant+bluetooth+light+factory+reset
    • https://cdn.sqhk.co/rubekafux/jRjaW68/wipezomuzokosisa.pdf
    • https://cdn-cms.f-static.net/uploads/4423430/normal_5fd1df8dab29e.pdf
    • https://cdn.sqhk.co/nizufalagef/jhigjcc/burger_king_menu_prices_2020_deals.pdf
    • https://cdn-cms.f-static.net/uploads/4450889/normal_606e6d0a09262.pdf
    • https://cdn.sqhk.co/desiketomasu/hoqaMlz/govetirefewoga.pdf
    • https://cdn.sqhk.co/wixikinotu/jdpVLAg/call_siren_head_in_real_life.pdf
    • https://cdn-cms.f-static.net/uploads/4373511/normal_605dacb20113e.pdf
    • https://cdn-cms.f-static.net/uploads/4407994/normal_604ee9e7cdc97.pdf
    • https://static.s123-cdn-static.com/uploads/4449599/normal_5fee9f5f41f2d.pdf
    • https://cdn-cms.f-static.net/uploads/4493876/normal_606100d5cbd79.pdf
    • https://cdn.sqhk.co/pefevepufi/rWJCiey/18868224711.pdf
    • https://cdn.sqhk.co/peferitukofa/aaKoZhd/titaxatu.pdf
    • https://cdn.sqhk.co/gapalagabig/hbQMPhj/97533235865.pdf
    • https://cdn.sqhk.co/zuxolusufa/djiaSgh/star_hero_story_mod_apk.pdf
    • https://static.s123-cdn-static.com/uploads/4491164/normal_5fcac9414cd8d.pdf
    • https://cdn.sqhk.co/daboxazile/ie0Xia9/21361559096.pdf
    • https://cdn-cms.f-static.net/uploads/4371005/normal_60332de93d1f5.pdf
    • https://cdn.sqhk.co/zetarizelub/PJjfEie/59747678828.pdf
    • https://cdn-cms.f-static.net/uploads/4465133/normal_6010c7c160af9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://38c8c62e-1823-4c1e-8220-bc61efcc8a1c.filesusr.com/ugd/c24b9b_b1ab47548e154cfdba1ec43dfed4b34a.pdf?index=true
    • https://9d0a8b69-4790-495c-a4d5-ed29f3eef23c.filesusr.com/ugd/4cd51e_2187748c23d14db69619022bd7351456.pdf?index=true
    • https://676a7a22-5bec-432e-92e0-9d4a0a27851c.filesusr.com/ugd/a1fb72_700cd20ebefb4318b62ec5240b45277c.pdf?index=true
    • https://30b7a97f-6117-4fff-8876-4b3c2220b6c6.filesusr.com/ugd/15cd4d_4366654f88a8487094d2148af2f9f47c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f241.bin
b87b4dae9b1eedbac9cda3a6b21dae149be6b5181f032784c2cdec2fee416b2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF241 5384 bytes
font_01_sfnt_off0001049e.bin
4ee1760546b302865b1067d8a21730a8fc84a75b6ea2121bb915e511e5236ea3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1049E 10580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.