Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a980412f946ec73…

MALICIOUS

PDF

77.4 KB Created: 2021-04-05 02:48:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b6bacb284969bff741f34a74eaaf873f SHA-1: 931c510bb275628ae3db5111ca5f2a3846325844 SHA-256: 1a980412f946ec7351615ec2f5062186499dc158e931c27bcfd95ebf7c01b480
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a deceptive message about a Steam SSL certificate error, designed to trick users into clicking a malicious URL. The presence of numerous external links, many pointing to PDF files, suggests a link farm or a distribution mechanism for further malicious content. ClamAV and ML classifiers confirm the malicious nature, identifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=steam+says+invalid+ssl+certificate
    • https://cdn.sqhk.co/zebenane/iqHku4C/zegazu.pdf
    • http://tujukesabegakom.mygamesonline.org/macbeth_shakespeare_play_video.pdf
    • http://kebenoda.scienceontheweb.net/vezosetojivefepumuxidifuz.pdf
    • https://cdn.sqhk.co/foxidagon/je5idj9/nhl_most_games_in_a_season.pdf
    • http://zurujavurobe.scienceontheweb.net/mitavab.pdf
    • http://melomone.scienceontheweb.net/xaximepinitamuzevolezos.pdf
    • http://texoraw.sportsontheweb.net/jbl_flip_3_connecting_bluetooth.pdf
    • http://xagakojitogiva.getenjoyment.net/wuzigudod.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://42e65457-ec34-4553-8979-78b6e302f774.filesusr.com/ugd/f1976d_d430ab868e82454c9de3e15a06295c66.pdf?index=true
    • https://71a5d838-4e22-4830-8da1-7955ec3365f5.filesusr.com/ugd/f2f43e_45c919ad45784f5696eb05573fe8cfa5.pdf?index=true
    • https://6648aa49-deb3-4d6f-81a8-a63cc7a297fb.filesusr.com/ugd/38eac1_a76856884eb3496da1ee1e6ad18b0315.pdf?index=true
    • https://4cd5eafb-d261-4666-a528-29b55b1676c1.filesusr.com/ugd/8dde66_6bbe2e55f03b449c86546031465ddbfe.pdf?index=true
    • https://1f49b3f1-4b09-4f89-88df-03804352fc9a.filesusr.com/ugd/a51aec_aefb1eb6023140ed8dde0615d361ff97.pdf?index=true
    • https://50aad03f-9d2a-47e6-be13-abd12f321b17.filesusr.com/ugd/3fd638_b77e7a5e8ea8414998c8fc5935a6ac13.pdf?index=true
    • http://rufapapufogap.onlinewebshop.net/gigemip.pdf
    • https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_4171aa60935946efb99cc8b38dd082f6.pdf?index=true
    • https://933527c5-e005-4225-a3aa-05fee46c7696.filesusr.com/ugd/b51dd5_eb72d4754b7543cd886b780721b1dbd3.pdf?index=true
    • https://571cbd0a-ba82-408d-be6d-2df53a8fcfe5.filesusr.com/ugd/02af14_8e65b6e96ff742dd994bcedf85ba31ee.pdf?index=true
    • http://faxiruvud.myartsonline.com/ruzabez.pdf
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_8c901d8d35bb44de8d8a7f0637096855.pdf?index=true
    • https://53002a68-e35f-4167-ac88-1ab9777d7e72.filesusr.com/ugd/f5bc2a_4e282f6b9c0947d88a24d77e139b87e1.pdf?index=true
    • https://77701ba7-c5ad-4750-ab17-5b03548f7fc0.filesusr.com/ugd/9a242c_dd8a0d2188694c659b1615cb1bcbf1ba.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f01e.bin
67ea5807e755fea19005960a56cb2822082751f16614c5a28b9560663660fe2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF01E 5432 bytes
font_01_sfnt_off0001028f.bin
23326bc37222c859ab7015674c7d42070076dd1b83fdd15ad0883d020669df87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1028F 10968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.