Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d0a0f9819ca569b…

MALICIOUS

PDF

87.7 KB Created: 2021-04-18 16:08:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: e2db81e2f963aafe7aa223e263fe275c SHA-1: 8a267292c79ee66f97c06e8cc62946eebc203726 SHA-256: 0d0a0f9819ca569bb2e32c613ecf6bd70b606fca13bf5885ce1fded5bd575324
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various websites. The ML_NYX_PDF_MALICIOUS and CLAMAV_DETECTION heuristics confirm the malicious nature of the file. The embedded URLs suggest a phishing or malicious redirection attempt, likely to distribute further malware or engage in SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=draw+the+born+haber+cycle+of+mgo PDF link annotation
    • https://zukuvexoxowi.weebly.com/uploads/1/3/4/5/134597017/8716156.pdfIn PDF document text
    • http://sportita.fun/duke_basketball_report_forumbusnc.pdfIn PDF document text
    • https://xuxijoma.weebly.com/uploads/1/3/3/9/133997678/vubefulisikil_zazokini_ripumaxibibalid.pdfIn PDF document text
    • https://dipitamadupod.weebly.com/uploads/1/3/4/8/134882687/tifoxewa.pdfIn PDF document text
    • https://xidelefexowivap.weebly.com/uploads/1/3/4/3/134366840/gudarerebisozinog.pdfIn PDF document text
    • http://reduslimitaly-ufficiale.website/social_problems_15th_edition22dsa.pdfIn PDF document text
    • https://guwadutu.weebly.com/uploads/1/3/5/3/135347148/rusufimaxixifu.pdfIn PDF document text
    • https://vepazigomopu.weebly.com/uploads/1/3/4/3/134398405/689102451db7cc7.pdfIn PDF document text
    • http://redit.fun/literal_and_metaphorical_examples119v6.pdfIn PDF document text
    • http://de-bewertung-889562.icu/holy_quran_english_version_free_download_for_pczylk5.pdfIn PDF document text
    • https://simokatojerosu.weebly.com/uploads/1/3/0/8/130874490/c5fbda12.pdfIn PDF document text
    • https://tuberosaguxe.weebly.com/uploads/1/3/1/4/131437792/figidewinosovudolif.pdfIn PDF document text
    • http://smcjd.com/69586031390nip74.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wunupalezozerud/simple_responsive_web_templates_free.pdfIn PDF document text
    • https://s3.amazonaws.com/dazemi/audiolab_6000n_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/rubidokezive/the_bipartisan_campaign_reform_act_of_2002.pdfIn PDF document text
    • https://s3.amazonaws.com/befafuni/97462621232.pdfIn PDF document text
    • https://s3.amazonaws.com/ropuba/ditoze.pdfIn PDF document text
    • https://s3.amazonaws.com/dosipive/troilus_and_cressida_character_crossword.pdfIn PDF document text
    • https://55d63786-14d6-44de-84d0-33f1fb383c44.filesusr.com/ugd/45fd81_2e60c6956561461ab427a50b3a6e9b31.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lupuvogotog/63679507734.pdfIn PDF document text
    • https://e6343aec-df69-40e7-9959-3c0c55bf73c9.filesusr.com/ugd/6a9017_41efa3cc2e3a48d592396b539e923470.pdf?index=trueIn PDF document text
    • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_8c820d7dbd61457f8311a63b78a0d2cd.pdf?index=trueIn PDF document text
    • https://6f4861c6-cdf0-4a5f-ba2d-f9c5e5bfbee6.filesusr.com/ugd/77941b_6e54ad5f671a4199b091ca8c9a826c53.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001175c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1175C 5448 bytes
SHA-256: ea8c40279b10d305f9e6d7d03f434d333b7a523005e554587b62a8162d922873
font_01_sfnt_off000129e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129E3 11592 bytes
SHA-256: ac5050f9cb22bada90250f6ba172d6a2faf71f0ba4157578ffcd9b451967922a

Open this report in the interactive analyzer, or submit your own file for analysis.