Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d217633ae7bc5dc…

MALICIOUS

PDF

91.1 KB Created: 2021-06-08 20:03:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4880e11a7fa7b302dc4d948635ee4848 SHA-1: d7f59e54b4dfbf2c9277d57045d73c94abb5fa2b SHA-256: 0d217633ae7bc5dc0dd412de5ca72f07d04012151068714b6c548328c36c6697
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are related to software downloads, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URL points to a site offering 'clash of clans mod apk download', further supporting a lure for potentially unwanted or malicious software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=clash+of+clans+mod+apk+download+unlimited+everything+2021
    • https://cdn-cms.f-static.net/uploads/4425515/normal_6027b31ba6ec3.pdf
    • https://cdn-cms.f-static.net/uploads/4488566/normal_6021f99ee4fe9.pdf
    • https://fizinizaboz.weebly.com/uploads/1/3/5/3/135304720/8553689.pdf
    • https://cdn-cms.f-static.net/uploads/4377128/normal_60199ca9f0226.pdf
    • https://cdn-cms.f-static.net/uploads/4530868/normal_5fd6790606eb9.pdf
    • https://cdn-cms.f-static.net/uploads/4393637/normal_601f9ed21798e.pdf
    • https://cdn-cms.f-static.net/uploads/4366668/normal_6023b94327de3.pdf
    • https://cdn-cms.f-static.net/uploads/4501996/normal_604fbdb0acc93.pdf
    • https://cdn-cms.f-static.net/uploads/4464055/normal_603f1fc68dc3e.pdf
    • https://wokopapun.weebly.com/uploads/1/3/5/3/135388848/a2fc9f868cea58.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/71622125-6319-4f8f-8b46-35956d405607/pokemon_go_joystick_android_without_root.pdf
    • https://uploads.strikinglycdn.com/files/de52fe3e-3efc-45ea-9603-7191032c2e16/43747950066.pdf
    • https://uploads.strikinglycdn.com/files/184e157e-d7fa-402e-9384-1d5ea3bb9ce8/lawn_boy_mower_oil.pdf
    • https://uploads.strikinglycdn.com/files/f9b63bd8-5428-4e86-9c9b-87f866e88816/having_difficult_conversations_training_canada.pdf
    • https://uploads.strikinglycdn.com/files/ac3aa8e9-c94c-40fd-850e-cd3414c7496c/87850443519.pdf
    • https://uploads.strikinglycdn.com/files/86ef7d07-50b4-4c1b-bd27-647ecaf13873/kreepy_krauly_marathon_parts_diagram.pdf
    • https://uploads.strikinglycdn.com/files/562adbb3-1ab3-47c2-8c0c-fc9ed6231f01/unity_definition_english.pdf
    • https://uploads.strikinglycdn.com/files/53886f71-1ceb-4adf-a8f3-17f3800e4eab/jojezusagulifino.pdf
    • https://uploads.strikinglycdn.com/files/e3deb932-e449-4e59-abd7-5c041de5aa34/mental_status_exam_example_write_up.pdf
    • https://uploads.strikinglycdn.com/files/0d8dc955-324c-42b1-8d2d-ef04c908f9bc/ielts_academic_writing_task_1_samples_with_answers_band_8.pdf
    • https://uploads.strikinglycdn.com/files/9fd23ace-fe8a-4045-b814-56b07b3a37c8/bowflex_elite_cost.pdf
    • https://uploads.strikinglycdn.com/files/62feb8d7-a82c-4a17-a45b-b1b0f912a853/84841838357.pdf
    • https://uploads.strikinglycdn.com/files/f24c415d-6164-4cf4-9ad3-ffd2ca9506f2/2001_honda_civic_transmission_repair_cost.pdf
    • https://uploads.strikinglycdn.com/files/270d368f-cbca-4693-a56f-c6c625228f3a/the_true_story_of_the_three_little_pigs_book_cover.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000120d0.bin
6a5d7c691d45b36e326aee32f7deaba5abe19f6f3841a3cc8254b4b12eedd03b
pdf-font-stream PDF embedded font (sfnt) at offset 0x120D0 6116 bytes
font_01_sfnt_off0001359e.bin
89654630349a7c8beeeb22e626f3bc9335db0c927b11579ffd62291e4dfec642
pdf-font-stream PDF embedded font (sfnt) at offset 0x1359E 11300 bytes