Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e78904e55335b4b…

MALICIOUS

PDF

69.7 KB Created: 2020-12-15 20:15:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8f4c42727700c2c2c8671d79d008b8f SHA-1: d3e62557d57bacd75e309a9cd3d9ec6bdb28261f SHA-256: 0e78904e55335b4b2fb2e7ea2e91507a0f1d8e098ea822a1b87a763decaa560c
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file, identified as malicious by ClamAV and an ML classifier, contains a large number of external links, indicating a link farm. The document body, though heavily obfuscated, suggests a lure related to 'adverbs of frequency worksheets printable'. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest the document is designed to redirect users to potentially harmful content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=adverbs+of+frequency+worksheets+printable
    • https://kidunaxu.weebly.com/uploads/1/3/1/4/131437100/gufegudipejabeko.pdf
    • https://cdn-cms.f-static.net/uploads/4495254/normal_5fd6b02bca9c7.pdf
    • https://cdn-cms.f-static.net/uploads/4480905/normal_5fb865ee1ac39.pdf
    • https://cdn-cms.f-static.net/uploads/4380867/normal_5f9c82ce2c849.pdf
    • https://cdn-cms.f-static.net/uploads/4383138/normal_5fb417fd41bf2.pdf
    • https://cdn-cms.f-static.net/uploads/4486220/normal_5fbca670e30e3.pdf
    • https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/padiwagunajomes.pdf
    • https://zokevuwokonumez.weebly.com/uploads/1/3/4/6/134682223/60efc9131311670.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fc5a1731c8c74131452292d/t/5fcf04ec05f6f2780750579b/1607402733455/raguxebaxufusikapogi.pdf
    • https://static1.squarespace.com/static/5fce2aea564f736a582ffe04/t/5fd084f71c49363a9b4c9c0b/1607501048144/warby_parker_eye_exam_free.pdf
    • https://static1.squarespace.com/static/5fc50c755bcb0228a29d2b40/t/5fc5465af81c9a2a0c5073c9/1606764123819/how_do_you_begin_your_investigation.pdf
    • https://static1.squarespace.com/static/5fc3b2b6a13a450bab05afe1/t/5fd071a75c296e7a68752769/1607496104115/diners_club_rewards_catalog_2019.pdf
    • https://static1.squarespace.com/static/5fc0e940bd14ff0dd29cb4d3/t/5fc246d218e72e5fdb227fe9/1606567635150/small_estate_affidavit_broward_county_florida.pdf
    • https://uploads.strikinglycdn.com/files/29da51b3-b630-4591-97e8-a070d823cba7/dazigi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d16e.bin
2a354f8e7663c3876781281376414101b8551f47c5a2c1571e9cf0fb5d02cdb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD16E 5816 bytes
font_01_sfnt_off0000e54f.bin
cf2bc0b027d7d8d6021a1fd75baffb9ff23cdb131c67e614421b26e12fc736b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE54F 10720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.