Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ca7494ad376d8f3…

MALICIOUS

PDF

82.1 KB Created: 2021-03-28 19:36:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4126c56c516a4f94c07d41fedef94715 SHA-1: 446d0a98df0fc8fe0fc8af5adbb854a1b1654421 SHA-256: 0ca7494ad376d8f3fb6cb2f00385338b4f71f41d3da79d84494392947cc756c9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was identified as malicious by multiple heuristics and an ML classifier, with ClamAV detecting it as Pdf.Phishing.Trojan. The PDF contains a large number of external links, suggesting a link farm or phishing attempt, with one prominent URL being https://maypoin.ru/award?keyword=amines+class+12+mcq+pdf. No scripts were extracted, but the presence of numerous external links indicates a potential for redirecting users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=amines+class+12+mcq+pdf
    • https://juporolo.weebly.com/uploads/1/3/1/3/131380745/dexedew.pdf
    • https://zisafidavilux.weebly.com/uploads/1/3/2/8/132814196/32bb76a81db7df0.pdf
    • https://watalixajine.weebly.com/uploads/1/3/4/6/134635748/e264d8b6d3.pdf
    • https://kodetinerimaguw.weebly.com/uploads/1/3/5/3/135347088/5343280.pdf
    • https://penopamez.weebly.com/uploads/1/3/4/4/134496097/toremegega_bumepaputuxuken_siruwusipijeda_jelibubim.pdf
    • https://lejalapu.weebly.com/uploads/1/3/0/8/130874477/dekujisololun.pdf
    • https://wodaxudufusan.weebly.com/uploads/1/3/0/8/130814186/5615537.pdf
    • https://tetejinuditobig.weebly.com/uploads/1/3/5/9/135973847/rilabobe-wogigasirafo-tirudo.pdf
    • https://depesusexufajev.weebly.com/uploads/1/3/5/3/135351117/pozepub_vegezuwanal.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://aa6eca1a-c690-4a36-985e-a873157a80b3.filesusr.com/ugd/081493_0ffeb70604144c9ab23bd2047eb272b5.pdf?index=true
    • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_5bed367583274c15a0c5e2b6f44335db.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c1fb9628-4c88-4a2e-a2ff-a46ab5cf6868/32212427243.pdf
    • https://uploads.strikinglycdn.com/files/4daf0471-6ebc-4620-a0ec-9a095ba6f860/how_to_put_water_in_a_bissell_proheat_2x.pdf
    • https://uploads.strikinglycdn.com/files/31d13cfc-88b4-4f74-9a20-5f97fee6844d/8634817001.pdf
    • https://uploads.strikinglycdn.com/files/b4628655-2cd9-496d-a0e2-54ea5b046919/average_speed_equation_calculus.pdf
    • https://f495c71d-628d-4070-9a3d-b699cbb46ba4.filesusr.com/ugd/d99ef3_cf82e5434e0247aaa39fe263efcdc894.pdf?index=true
    • https://5a98ae10-8c7e-48da-b83f-9bcbc644cfa3.filesusr.com/ugd/9a8764_2607e5afbefc44ca912f9f65015c8951.pdf?index=true
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_99e0d50d9f4543b68ec9577d59fca9c0.pdf?index=true
    • https://75e6d08a-b14f-4c2c-bd4e-3e6431d9d11c.filesusr.com/ugd/497a87_76f0ca8f83bc4465abfc843bd1c544bb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/54bb67d7-cc4b-4fda-b463-f71c9f61a342/ruvazutovesow.pdf
    • https://d321836a-1bf8-47c4-b4d3-67fe1e7f0250.filesusr.com/ugd/33ab24_9dc1940e6afc4e95bd0eb40280994598.pdf?index=true
    • https://0a497e50-07dd-462d-832d-d8678f741a8e.filesusr.com/ugd/5f857b_27d845f8cbb747828f412f0a6205274c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f40a.bin
4d7591a9e3617d358d605cb79c92fc557512081c8339fca514ff0e4c56ac4ede		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF40A 5504 bytes
font_01_sfnt_off00010682.bin
be917c0db7373273820b965e09a90eb2fe17fe2eb699b6f9fe1ec8b3b19cfce3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10682 6168 bytes
font_02_sfnt_off0001156f.bin
1ea43578f38d4bb5e985bacd5786d7799a0ce8a2840f5af904155c40ed3cc634		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1156F 11104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.