Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a8aa3c3f14f87ea…

MALICIOUS

PDF

82.9 KB Created: 2021-03-29 23:56:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0385c17bea1c4a126959afd8562b71a0 SHA-1: 20222e3167433347717a583b587b377907c80200 SHA-256: 1a8aa3c3f14f87ea5182427d51a5450b7542d01657cd02ac55af683de8c836de
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and an ML classifier indicated a high probability of maliciousness. The document contains a large number of external links, with one heuristic specifically identifying it as a 'PDF_SEO_LINK_FARM'. The primary malicious URL observed is 'https://soxebez.ru/123?utm_term=webee+liker+app', suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=webee+liker+app
    • https://cdn-cms.f-static.net/uploads/4492600/normal_6046e9e84278c.pdf
    • http://suzupuwejal.mygamesonline.org/1164138326.pdf
    • http://sigixexizo.sportsontheweb.net/65956077071.pdf
    • https://cdn-cms.f-static.net/uploads/4493200/normal_60394f4b6cd9f.pdf
    • http://kikababono.mywebcommunity.org/dufofu.pdf
    • http://kalukoroduro.mygamesonline.org/ancient_greece_timeline_worksheet.pdf
    • https://static.s123-cdn-static.com/uploads/4443595/normal_5ffb1499a94f6.pdf
    • https://cdn-cms.f-static.net/uploads/4427523/normal_602a25070cfe9.pdf
    • https://cdn-cms.f-static.net/uploads/4423454/normal_601c9895ce011.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1d307963-625a-4d8b-8675-cd83ec600373/best_ww2_flight_sim_xbox_one.pdf
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_a53b672fbebb4df083df97e7913b16f4.pdf?index=true
    • https://0f285ee0-1b14-49a2-8a3e-060a2db94812.filesusr.com/ugd/4bf67f_ea535ca2089b480c8dcd26a9f65e25ad.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1570c9c6-1cd0-408b-86c5-34c630267678/wegokoropemopetozulog.pdf
    • http://nubirumoxid.onlinewebshop.net/curriculum_vitae_editable.pdf
    • https://uploads.strikinglycdn.com/files/79b1c0e7-bb46-438b-a271-ae0cd4c00b67/86902869994.pdf
    • https://67d298e0-85f4-4ad4-bf36-e1ac857e42fc.filesusr.com/ugd/b6bf5b_dab37439adc94dc494f3ffcd1ebe0999.pdf?index=true
    • https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_2adf3b585c224015a3403723c1b25ce2.pdf?index=true
    • https://4fcc26ae-a476-48f2-98aa-cdc5c12f4544.filesusr.com/ugd/32d0e1_af4c8b762f5c483b85f8ef43aea873cf.pdf?index=true
    • https://e301b21f-f707-426c-a094-6199d4b1a2d6.filesusr.com/ugd/f65518_4ac76247d1ad473fa0118085ff7fb357.pdf?index=true
    • https://f1e11ea9-a931-46ad-af30-391325c877dd.filesusr.com/ugd/423518_8ec30747c71441a283e09c329baccde1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/aac6b545-da29-4dab-baaa-5bc0a10d4355/how_to_write_a_letter_of_intent_university.pdf
    • https://uploads.strikinglycdn.com/files/b59bff07-a7be-4659-a334-4b1fcb7be135/bepawetetojuwu.pdf
    • https://uploads.strikinglycdn.com/files/1fe2a31f-634e-4529-88bc-a4874b7d7200/what_is_the_use_of_data_science_course.pdf
    • https://d8d078ea-10ec-4787-8e21-ef6e32b87a24.filesusr.com/ugd/8f6098_c9482e80852c4bf49e0dbfaa6e48e6f5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b9584672-47d0-4a00-bf79-4968296cbf2b/80305851948.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00011942.bin
3d93a3cbe9d4e0efc9c68daa3822f2cf0f8e2450db8c42af05cf9e341afd325c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11942 22300 bytes
font_00_sfnt_off0000e209.bin
683352c63a226ef072b193c1f27f2647169f3631b41005064dcb967a574faacc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE209 4852 bytes
font_01_sfnt_off0000f2a8.bin
43ae16bb65945095f471fb43555af58a30a78ec7c8296fc79e73e4ca5edbe2ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2A8 11276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.