Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bf0b5b84cd711de…

MALICIOUS

PDF

82.3 KB Created: 2021-03-14 13:26:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b48a1c7caeb5ca166315e29e00e6daac SHA-1: a0469fa25a2e96ab6bb1a0bf8fe8b353c8b6a1fa SHA-256: 0bf0b5b84cd711defeb5ef668859faa9364bb5f561b2174e743675c922b0a531
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are associated with link farms and SEO manipulation, indicating a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and numerous external URIs point towards a phishing or malicious content delivery mechanism, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=cub+scout+pack+meeting+program+template
    • https://vufosaxirit.weebly.com/uploads/1/3/4/0/134018891/8223582.pdf
    • http://dimupure.22web.org/anjali_anjali_pushpanjali_song_telugu.pdf
    • https://cdn-cms.f-static.net/uploads/4367643/normal_60342060c20a9.pdf
    • https://cdn-cms.f-static.net/uploads/4481285/normal_600a4a67578fc.pdf
    • https://cdn-cms.f-static.net/uploads/4445321/normal_60315e505090d.pdf
    • https://kebolegenadudus.weebly.com/uploads/1/3/1/4/131454121/3273a.pdf
    • https://fisoguxosat.weebly.com/uploads/1/3/2/7/132740182/6854961.pdf
    • https://static.s123-cdn-static.com/uploads/4368481/normal_5fc98bcc62c01.pdf
    • https://static.s123-cdn-static.com/uploads/4449615/normal_5ff9094646384.pdf
    • https://cdn-cms.f-static.net/uploads/4369330/normal_602cb250cfc2d.pdf
    • https://cdn-cms.f-static.net/uploads/4487662/normal_601b314d5df3e.pdf
    • https://cdn-cms.f-static.net/uploads/4405929/normal_604dce388a8b0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/bidemewufa/badlapur_full_movie_480p_filmywap.pdf
    • https://s3.amazonaws.com/taguxif/nepal_tourist_guide_map.pdf
    • https://s3.amazonaws.com/pexodugosa/manowe.pdf
    • https://s3.amazonaws.com/gotenukevepunin/funipudizujajemugukasoz.pdf
    • https://s3.amazonaws.com/wemupajese/acousticsamples_uku_ukulele_library.pdf
    • http://wofufudemito.epizy.com/project_assessment_questionnaire_templates.pdf
    • http://lunupesefobe.rf.gd/how_much_does_a_log_cabin_home_kit_cost.pdf
    • http://bumupumelagel.epizy.com/a_for_dummies.pdf
    • https://s3.amazonaws.com/xisefowu/adobe_creative_suite_full.pdf
    • https://s3.amazonaws.com/xuzed/patikebaxej.pdf
    • https://s3.amazonaws.com/mokuwanibof/how_much_does_a_big_buddy_heater_weigh.pdf
    • https://s3.amazonaws.com/mojivikapeti/rijizi.pdf
    • http://forilojemani.epizy.com/android_21_phone_wallpaper.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecfe.bin
fb84ef31f98a7068fe6571aa9b96361b749c2b59180a32da956d21e91752f1bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECFE 5360 bytes
font_01_sfnt_off0000ff18.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF18 1800 bytes
font_02_sfnt_off000107a5.bin
b49a29586d42d27689556d23c9edbc38a010a4264a96b9335fdd7b988b8560ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107A5 10304 bytes
font_03_sfnt_off00012b00.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B00 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.