Malicious PDF — malware analysis report

Static analysis result for SHA-256 1698573ce01092db…

MALICIOUS

PDF

58.6 KB Created: 2021-03-10 06:18:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e25c028c0afc82e4e27cb1661d349ac SHA-1: 0e23714b3ef5511a29b5b2ece1e2b3dd0ab1626f SHA-256: 1698573ce01092dbe826495d3b386f021f34af235353a067c67632f1a8debd67
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are part of a link farm designed to appear as legitimate content. The primary external URI points to a URL that appears to be a lure for a phishing or malware download. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9637

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=allen+carr+arr%25C3%25AAter+de+fumer+tout+de+suite+pdf
    • http://timogefubor.22web.org/du_booster_apkpure.pdf
    • http://sabovibin.medianewsonline.com/where_is_midwest_boots_located.pdf
    • http://sixesijilolun.mywebcommunity.org/what_is_the_irwin_family_net_worth.pdf
    • https://nemelodanunoju.weebly.com/uploads/1/3/0/8/130874480/wazijug-janame-baseweb-supefemul.pdf
    • https://rasozonikazip.weebly.com/uploads/1/3/4/9/134904665/zewadivujiwitajexeve.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://adc0bc6f-2b4d-4951-bce0-9128d215fa34.filesusr.com/ugd/5ea4d5_89ddd94f5499496d9a3fbc0accfc93cc.pdf?index=true
    • https://s3.amazonaws.com/jafujasiwetid/kixorowural.pdf
    • http://tuwutexo.onlinewebshop.net/suzevuparegikezawe.pdf
    • https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_bb73af25b8504684b0bd20fc16307a49.pdf?index=true
    • https://uploads.strikinglycdn.com/files/454de771-c113-41fb-92c0-913671a2b795/nofafezuvako.pdf
    • https://uploads.strikinglycdn.com/files/ef6ac8a4-0874-4889-9a1a-7c587719eb45/40850285928.pdf
    • https://34e223d5-b18a-4f89-96b3-7c58aa965d90.filesusr.com/ugd/440e29_cdc0ec4470364bf7991d768b0fc03a6e.pdf?index=true
    • http://neduweleviwov.rf.gd/functional_resume_template_pages.pdf
    • https://s3.amazonaws.com/sazixipame/zizezedumowurepepunage.pdf
    • https://4de1274e-a26b-4e71-a0d1-d86f0cfee7ee.filesusr.com/ugd/ee4d88_6c202f09ccbf418fad7fd93d49fccdfb.pdf?index=true
    • http://fokibofu.epizy.com/concierto_de_aranjuez_guitar_part.pdf
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_86a8e562435a4a5faf6da473cf932c15.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d50f.bin
8866efda4938e2e83075e633e1ff12c983113d4da9a26d421fdc694f8a74fc66		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD50F 5320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.