Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f6b2e845b5d947f…

MALICIOUS

PDF

68.1 KB Created: 2021-05-15 23:07:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c9f585f26c6dd3791133dc7d95e18194 SHA-1: 0ad1d847511ed31973d402940d3af77e9746b1cc SHA-256: 0f6b2e845b5d947fdad00dbe850c917920c05c52e99da6892de750cf0ebf554c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used to create link farms for SEO manipulation or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, with one prominent example being 'https://jiromozuno.weebly.com/uploads/1/3/5/3/135387519/gofanojidixajun.pdf'. The presence of a malicious ML classifier score and ClamAV detection further supports its malicious nature, likely as a phishing or trojan distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7916

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=ilustraciones+para+predicas+evangelicas
    • https://jiromozuno.weebly.com/uploads/1/3/5/3/135387519/gofanojidixajun.pdf
    • https://nofuxufemi.weebly.com/uploads/1/3/2/6/132681390/408057d86.pdf
    • https://bodonovovo.weebly.com/uploads/1/3/1/6/131607174/6186483.pdf
    • https://cdn.sqhk.co/pixafosabow/l5rgjjs/modern_combat_3_fallen_nation_apk_mod.pdf
    • http://menesoger.iblogger.org/derogable_and_non_derogable_rights.pdf
    • https://xitosuwoga.weebly.com/uploads/1/3/3/9/133988858/rupofew_nufudulu_jogusuwu.pdf
    • http://tulumobutu.22web.org/fuxulirabironarurudiposa.pdf
    • http://piwifeg.22web.org/driverless_car_project.pdf
    • https://cdn.sqhk.co/wetewajaba/ijA1ihc/84905158622.pdf
    • http://totalcreditcheck.info/90268070316l7sp5.pdf
    • http://demask.fun/diary_with_lock_fingerprint_lock_20190j2fw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tozemuj.rf.gd/guided_imagery_medical_meaning.pdf
    • https://s3.amazonaws.com/xurixado/winning_performance_britain_s_got_talent_2019.pdf
    • https://80172413-d145-4b71-b7cf-4a007d76ad29.filesusr.com/ugd/cacfd7_9efe1556b05249b78e48c345a2532325.pdf?index=true
    • https://d5e9a058-cbdc-4968-ba72-30cdbf1e36a3.filesusr.com/ugd/9cfd0a_897de5299a584a62a5c8160566bfdd7d.pdf?index=true
    • https://s3.amazonaws.com/wivunonovef/getting_through_the_labyrinth.pdf
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_922d2c9754474cf89681853a9c5e4e4f.pdf?index=true
    • https://s3.amazonaws.com/gozifep/97762623909.pdf
    • https://s3.amazonaws.com/lekelepowo/indian_interior_design_company_profile.pdf
    • https://s3.amazonaws.com/lorifawuvawot/bahnwrter_thiel_gerhart_hauptmann.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100af.bin
8c7300572206a1f58abcb0e06ed0d4a94dc13c5f5ea9c1e704e845b697116718		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100AF 5236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.