Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a1f03d20832ed64…

MALICIOUS

PDF

80.8 KB Created: 2021-03-23 20:32:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1b5f5e8102cbe79cb9dfa2672cb1741 SHA-1: 23e18ddc04e3a875f8877fe76c9597a024803f80 SHA-256: 1a1f03d20832ed64ef12edda1dc375bc5ab423feb9ef276a77e29758120f59dd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' heuristics strongly suggest malicious intent. The document body, though heavily obfuscated, appears to mimic search results, a common lure for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/aws?utm_term=rheem+hot+water+heater+reviews
    • http://jejederepox.medianewsonline.com/47639497052.pdf
    • https://rerutafedebe.weebly.com/uploads/1/3/2/8/132815298/9058011.pdf
    • https://daxolefuziru.weebly.com/uploads/1/3/5/9/135963055/c9c0b.pdf
    • http://barashik.space/78306009250evhuk.pdf
    • http://ruvinowuge.scienceontheweb.net/what_causes_a_ge_washing_machine_not_to_drain.pdf
    • http://nuredalad.iblogger.org/greenland_ice_sheet_crater.pdf
    • http://gonzo-3d.com/arbonne_shake_recipes_with_cinnamon_roll_proteinouapk.pdf
    • https://kikebepuziji.weebly.com/uploads/1/3/0/7/130775256/1855288.pdf
    • http://topafigo.mypressonline.com/download_adobe_reader_app.pdf
    • https://fitelibisubun.weebly.com/uploads/1/3/3/9/133987071/9216058.pdf
    • https://wutusexiradolo.weebly.com/uploads/1/3/0/9/130969471/penasekalowe.pdf
    • http://edayafar.xyz/10308321519paujy.pdf
    • http://zonizubiro.getenjoyment.net/all_ly_words.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_1a09c523a631408ab8d241b05d55a269.pdf?index=true
    • http://jupasugego.rf.gd/wekemiri.pdf
    • https://5e6d3f51-9b35-4a29-baf4-1f036254a461.filesusr.com/ugd/99a8f2_3b65b99789cb4a3c933b298554e626fb.pdf?index=true
    • http://mubodadekutaxim.atwebpages.com/kitchenaid_cooktop_parts_replacement.pdf
    • https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_956fa6e08629489cb3dc8f4766abe164.pdf?index=true
    • https://47ab6ce1-aee6-4086-a8e7-31fe393d2411.filesusr.com/ugd/afbef4_fee67ad2fdac443f80c78f7e52d8caba.pdf?index=true
    • http://timavutiziv.epizy.com/america_the_story_of_us_worksheets.pdf
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_b1b498d607cb47998a28576ad3423eba.pdf?index=true
    • https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_eda17f839c5b4bdbb9f8a63990787f1c.pdf?index=true
    • http://tutufot.rf.gd/algebraic_equations_questions_and_answers.pdf
    • https://6184de0c-c318-42a7-882e-c5ddc63b817d.filesusr.com/ugd/1c8c1e_936b1ab0ebf04ac5b45c8f09bda062da.pdf?index=true
    • https://c18d7360-3707-4bf1-9d6f-52ba7510fa17.filesusr.com/ugd/76cb06_03f20b96ffad44638128c0f148c134f3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100a2.bin
8492481d0c9d458c53868d5c84dd8a7c07f3fc0b5d40422930caf5b0d19a8960		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100A2 5052 bytes
font_01_sfnt_off000111bc.bin
863f113f3fc8a2f7a65aacbefe13d8e2a98697ec9712dbb8682433d5a24e887e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111BC 10392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.