Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e313dafae3dac8a…

MALICIOUS

PDF

79.4 KB Created: 2021-03-19 04:24:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97c2ca4ffc62f58e6f3e70fdae278cf8 SHA-1: 9fa97b0cf60098a7bfe628686e5d9b7ec49d1a0a SHA-256: 1e313dafae3dac8ab47a3f4fb5a09ffe5e2582e6b03c1705cf8c86a808272cb1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection and ML classifier also flag this PDF as malicious, specifically as a phishing trojan. The embedded URLs suggest an attempt to redirect users to malicious sites for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+unhealthy+are+dunkin+donuts+breakfast+sandwiches
    • http://legionmone.xyz/radiwumakabutb5s.pdf
    • http://detonic-hypertonie.website/linksys_ac1200_ea6100_router_setup78lzm.pdf
    • http://kuvesukide.iblogger.org/ikea_kitchen_installation_guide_2019.pdf
    • http://cardioactiveufficiale.site/free_gospel_music_lead_sheets1qjso.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zuwimadaneb/faruzu.pdf
    • https://s3.amazonaws.com/kovezodepugov/vivah_movie_songs_mr_jatt.pdf
    • https://s3.amazonaws.com/nemafu/wosajuzuputesedib.pdf
    • https://s3.amazonaws.com/sosupejuxofedo/wizard_of_legend_guide.pdf
    • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_e92180149f6b40638a40c0cf2f41d549.pdf?index=true
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_ebd93a3eced341778c35f1190bd08ead.pdf?index=true
    • https://s3.amazonaws.com/gapivegek/chestnut_puree_nutritional_information.pdf
    • https://uploads.strikinglycdn.com/files/01a64f6b-3885-43ac-be2b-8493203fcdbb/lord_of_the_flies_chapter_2_summary_quiz_gapfill_exercise_answers.pdf
    • https://uploads.strikinglycdn.com/files/0fd1f0c0-566e-480b-b77c-2beb9427f2da/gasim.pdf
    • https://s3.amazonaws.com/fomaralunex/bootice_free_filehippo.pdf
    • https://s3.amazonaws.com/bokelur/93493865427.pdf
    • http://kumugirenukelil.epizy.com/2064023489.pdf
    • https://s3.amazonaws.com/tetofamuxulil/66887009420.pdf
    • https://uploads.strikinglycdn.com/files/9e7d682d-606f-45d4-93bd-ebda3f417252/durowinemozezeduwaxodopun.pdf
    • http://pukevekoba.rf.gd/41030987490.pdf
    • https://5053e88e-9e18-4719-890c-32a1cca0295d.filesusr.com/ugd/411503_84c55c5e15f04b9f874999f49cc5dc1c.pdf?index=true
    • https://a5a7f18c-b887-48a0-80cc-3627c14345d5.filesusr.com/ugd/609f59_8d58889b9f3a406799b1b8424b33e2b7.pdf?index=true
    • https://s3.amazonaws.com/nolarifaforuxop/destiny_2_armor_2._0_guide.pdf
    • https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_ea704634c9654e608b9029106517e335.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3fa.bin
bdd00f64a6fcc2632b5ce12c21cb8aa9715b6ea961d0ca720f12cd49df64cb5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3FA 5468 bytes
font_01_sfnt_off000106a3.bin
96b37b3b3dcf0e3aac7f2933fbceaddf0674f090d89d79dee8ebf7d994c44dd5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106A3 11552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.