Malicious PDF — malware analysis report

Static analysis result for SHA-256 09ce3b2b5e1dc662…

MALICIOUS

PDF

79.6 KB Created: 2021-05-19 05:52:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9976349e918aadd65cbccce86b281cdd SHA-1: dea09bcace3a30331038e465e72248ea4920ddea SHA-256: 09ce3b2b5e1dc662d74d5ff2222c18d9f45d2d2e9c29722013155a319271fa51
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to SEO-optimized PDF documents, indicating a link farm. One of the primary links directs to a URL associated with a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=tubal+ligation+side+effects+weight+gain
    • https://cdn-cms.f-static.net/uploads/4481510/normal_5fdc4ead77349.pdf
    • https://ferugagesavisux.weebly.com/uploads/1/3/4/6/134687542/wivegiru.pdf
    • https://finudekenituw.weebly.com/uploads/1/3/6/0/136053274/malifibezigo.pdf
    • https://kiwotatuna.weebly.com/uploads/1/3/1/8/131856308/kekoponomuwi.pdf
    • https://pelabinal.weebly.com/uploads/1/3/1/3/131379552/jetizizepaxiduw-bolifadir-topajolujowij.pdf
    • https://sabexinutix.weebly.com/uploads/1/3/0/7/130740027/luzepobodanizikobe.pdf
    • https://cdn-cms.f-static.net/uploads/4452587/normal_6020f8b558536.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4793ce35-284b-48aa-a5da-625cad1703e5/what_is_flash_column_chromatography.pdf
    • https://uploads.strikinglycdn.com/files/3c475018-e489-4871-a053-c49d6aaeb053/fokezuliwusavuwini.pdf
    • https://uploads.strikinglycdn.com/files/20bce03f-1d09-475d-844e-97df4e495bb8/instrumentos_de_recoleccion_de_datos_en_investigacion_cualitativa.pdf
    • https://s3.amazonaws.com/salade/nodegodo.pdf
    • https://uploads.strikinglycdn.com/files/f8c82bb9-07f8-404b-8b7f-7fa211b52596/fobebusorixokejofixo.pdf
    • https://uploads.strikinglycdn.com/files/fa2c97ae-4f76-4a2b-ae16-6c48f2520e6e/constitucion_politica_mexicana_articulo_118.pdf
    • https://s3.amazonaws.com/mudurixo/consent_form_for_medical_treatment_template.pdf
    • https://s3.amazonaws.com/ponivotigegepub/93561296285.pdf
    • https://uploads.strikinglycdn.com/files/5923edf8-6469-4abb-a59d-e786d3cfa676/principles_of_life_2nd_edition_notes.pdf
    • https://uploads.strikinglycdn.com/files/789430c3-2d3e-4064-8b44-95e64449bae0/barasepoxilelumo.pdf
    • https://uploads.strikinglycdn.com/files/b7349087-c4a0-4adc-85fd-8c750deb6534/fractions_decimals_and_percentages_table.pdf
    • https://uploads.strikinglycdn.com/files/9542af9a-176c-4898-b9c1-d02d38d3766b/visual_identity_system_template.pdf
    • https://s3.amazonaws.com/pekatikisuruki/rujugif.pdf
    • https://uploads.strikinglycdn.com/files/8672803b-01ec-424c-81cc-02b516dc1c28/2012_yamaha_yzf_r6_service_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbe5.bin
c7a37c3383a7726a6b21eacc27ac4a916cfe6430f9ce7e95551bdfb4c0ba7aa3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBE5 5368 bytes
font_01_sfnt_off00010e37.bin
b502c271c186628c446b60714b11b412a0718c7599b1c179853c43b3cbc1f4bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E37 10312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.