Malicious PDF — malware analysis report

Static analysis result for SHA-256 149e92e55a5c2fba…

MALICIOUS

PDF

83.7 KB Created: 2021-05-23 20:45:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 395b1ace04cc48793dd3647588eacc88 SHA-1: 7c0a4af3626ac2fb32152a02ec4424480b0d4539 SHA-256: 149e92e55a5c2fba5023008f15eba676fe33f77b90e6cb84a119bce244a7fd89
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO link farms and phishing. The document body, though partially corrupted, suggests a lure related to a popular movie, aiming to trick users into clicking malicious links. The presence of ClamAV and ML heuristic firings strongly indicates malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=la+saga+crepusculo+eclipse+pelicula+completa+en+espa%25C3%25B1ol+latino+cuevana PDF link annotation
    • https://mirepabokotixiz.weebly.com/uploads/1/3/2/7/132712407/3007353.pdfIn PDF document text
    • https://dobuxavebixeli.weebly.com/uploads/1/3/4/7/134725246/1770233.pdfIn PDF document text
    • https://fexedewikefitug.weebly.com/uploads/1/3/2/6/132681233/2363906.pdfIn PDF document text
    • https://soxoxalumowaju.weebly.com/uploads/1/3/4/7/134768556/xidobafitipesimenasu.pdfIn PDF document text
    • https://gatiwisukebemo.weebly.com/uploads/1/3/1/4/131438587/b0d885f3a.pdfIn PDF document text
    • https://jakilirimilibev.weebly.com/uploads/1/3/4/8/134862861/3212614.pdfIn PDF document text
    • https://melekutiruj.weebly.com/uploads/1/3/2/7/132740408/xesebututekinuful.pdfIn PDF document text
    • https://notaxivarem.weebly.com/uploads/1/3/4/6/134633458/4677594.pdfIn PDF document text
    • https://lufegema.weebly.com/uploads/1/3/4/1/134132410/xosezusuluwazev.pdfIn PDF document text
    • https://wajirabipuxu.weebly.com/uploads/1/3/0/8/130874591/0ae22599b.pdfIn PDF document text
    • https://xesisawizes.weebly.com/uploads/1/3/1/6/131606125/vuresukejetu-juditalo-nevewa.pdfIn PDF document text
    • https://bifukumuvu.weebly.com/uploads/1/3/5/3/135347201/1a87a62aaf57ab7.pdfIn PDF document text
    • https://nepufetok.weebly.com/uploads/1/3/1/4/131438640/lasamofuzimilatowol.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/legesiliv/16630505404.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/579b03b5-ed97-4d42-b2ba-061c17f49897/what_is_the_fighter_diet_plan.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/sukabazotemapumo.pdfIn PDF document text
    • https://s3.amazonaws.com/xebuvuwov/75294440162.pdfIn PDF document text
    • https://s3.amazonaws.com/xoxaneral/kavejizifomoref.pdfIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/warriors_dont_cry_sparknotes_chapter_5.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62a54203-1dbc-413d-9736-5a8054b506a7/moputafajatukuzaxokuxika.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8854231c-4902-437c-90ae-b9f84d234361/asus_m5a97_r2.0_compatible_gpu.pdfIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/66032627412.pdfIn PDF document text
    • https://s3.amazonaws.com/kabisebax/strikemaster_mora_ice_auger_drill_adapter.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010546.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10546 5468 bytes
SHA-256: 5ba98f8e74c65d95245a1b8e491b46b5594980d0868676269f5f00038d566cb4
font_01_sfnt_off00011795.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11795 11604 bytes
SHA-256: 9ccea6c36ef93f9fa57b11f907eb518ffb66a3dccafb6ce8ae69f7770e0b4e32

Open this report in the interactive analyzer, or submit your own file for analysis.