Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e19714b7e4fa1ff…

MALICIOUS

PDF

82.6 KB Created: 2021-04-04 08:39:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d4fb8b99e301a6f34b84f3f429f6c46 SHA-1: 6bd07946bd974065c97cfb6c5fdb2d75f96269a0 SHA-256: 0e19714b7e4fa1ff54e9ab4c93638c4034d568cbc428f6b46bb6d7e252c7c03b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to PDF files, suggesting a link farm or phishing campaign. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to sheet music, likely to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=hopes+and+dreams+viola+sheet+music
    • https://static.s123-cdn-static.com/uploads/4463526/normal_5fef8a4827a4f.pdf
    • https://cdn-cms.f-static.net/uploads/4384828/normal_60465adecc3df.pdf
    • https://cdn-cms.f-static.net/uploads/4370307/normal_604a0217e014e.pdf
    • https://static.s123-cdn-static.com/uploads/4393790/normal_5ffe025f578fd.pdf
    • https://cdn-cms.f-static.net/uploads/4369149/normal_605f8639c6f64.pdf
    • http://xoriruviridov.22web.org/xujuvazolazetafal.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f27bca7f-571c-471d-9e77-92385e6dfcd0.filesusr.com/ugd/9a0fa1_2cbdf5167470462594a06dad7351b83b.pdf?index=true
    • https://63d876aa-455f-4c41-9c38-50747f3e0b95.filesusr.com/ugd/a220d5_b4142d5ac8804db38218414e2737229a.pdf?index=true
    • https://0c6b2c5e-c852-454c-8c01-bea24f6181fd.filesusr.com/ugd/b97644_59d92a34684e429b9afeab24bb0ba647.pdf?index=true
    • https://5197ab9a-5cbf-4c92-8863-96ce2dfafb62.filesusr.com/ugd/f34823_1009a22286624a14b640278b43593f00.pdf?index=true
    • https://5c06e36d-e6a7-492f-989e-88f86e9ca1b1.filesusr.com/ugd/c9ae65_248152e17fb34db2a334c73c4cd72381.pdf?index=true
    • http://lokakowevokeb.epizy.com/ford_mustang_ecoboost_fuel_economy.pdf
    • https://abaaaae4-9231-44fc-b12c-ad55ebcc68e7.filesusr.com/ugd/2ca09c_8dc813623efb4c88be2de3fc782db77e.pdf?index=true
    • https://s3.amazonaws.com/mozedijiz/vikupugosumudag.pdf
    • http://refakozisakuvul.epizy.com/kapogupajusufobogupa.pdf
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_f4e5bee6f0b54d2f89ad9bc3a1b222ce.pdf?index=true
    • https://s3.amazonaws.com/domegagowevag/formal_dresses_canada_sale.pdf
    • https://d650f791-4ca6-4964-96f1-ba9fac0414c1.filesusr.com/ugd/adf9cb_3e4217b1e23c4f70b312e0cd4e81fce3.pdf?index=true
    • http://pidumug.epizy.com/37662794232.pdf
    • https://s3.amazonaws.com/dotivaf/12572904878.pdf
    • https://153f2bed-3501-4ec5-9468-ed1987511f6d.filesusr.com/ugd/f67134_b051faf4cdb8481cb4f459876d2a3f64.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010379.bin
6db1e3ec7052aa198ddbf5214d4ef2f7640392797343ceeb20a336b271dca8b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10379 5336 bytes
font_01_sfnt_off00011573.bin
612ddaaa671ba668b1f4dda6d20ab5d770836cb6a87ed3cdd870afcb703b4c40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11573 11604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.