Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e438844f556468e…

MALICIOUS

PDF

71.4 KB Created: 2021-04-06 06:19:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af0b585e23a936b8c43fe194c80046e6 SHA-1: 1548497dbad4456263fe97a12cfe8b1651dc0da5 SHA-256: 1e438844f556468e05af68b1c9231e07be4968269ef6398afe4eab7cd4f94f36
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO spam or phishing. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a large number of external links within the document. ClamAV also detected this as 'Pdf.Phishing.Trojan'. The embedded URLs suggest an attempt to redirect users to malicious or spam content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=k+coder+2015+earth+science+answer+key
    • https://cdn-cms.f-static.net/uploads/4424405/normal_6032967d0f5c3.pdf
    • https://cdn-cms.f-static.net/uploads/4413369/normal_603e9a92797e6.pdf
    • https://static.s123-cdn-static.com/uploads/4501356/normal_5fc7c87f29a8b.pdf
    • https://static.s123-cdn-static.com/uploads/4469103/normal_5fc9e7cc83592.pdf
    • https://cdn-cms.f-static.net/uploads/4457006/normal_605d71f0c8964.pdf
    • http://domsale.xyz/cl_windows_7_professionnel_64_bitsdovf1.pdf
    • https://cdn-cms.f-static.net/uploads/4465125/normal_6062744a36dc2.pdf
    • https://cdn-cms.f-static.net/uploads/4365551/normal_5fd23642cadbc.pdf
    • http://prechambre.xyz/how_to_crochet_a_granny_square_baby_blanket_for_beginners3cxki.pdf
    • http://faceit.su/povudoduvuwovekuzizi756sb.pdf
    • https://cdn-cms.f-static.net/uploads/4427499/normal_603a47c21324f.pdf
    • http://igbusinessabouthelp.com/doxumirakebupupozasuy8lr.pdf
    • https://cdn-cms.f-static.net/uploads/4481289/normal_6037ee07ddd9a.pdf
    • http://jenirafona.22web.org/donefexisij.pdf
    • https://cdn-cms.f-static.net/uploads/4415543/normal_604e90e7ccb43.pdf
    • https://cdn-cms.f-static.net/uploads/4529095/normal_6031e9f914be2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_08fb7eb591054e7391ce0d8a09a0f450.pdf?index=true
    • http://kuzotekekejepun.rf.gd/65103215397.pdf
    • https://e46eb8ae-11b5-47af-91b5-79e2db369635.filesusr.com/ugd/f84671_53df0c63000342c2a1a55df7f76a36e0.pdf?index=true
    • http://pitowurojagit.epizy.com/peavey_vypyr_vip_2_review.pdf
    • https://557345b1-98c6-442d-b460-9e357c178e5b.filesusr.com/ugd/dfb5f8_4b02fe5506dc4c529df80a4c52db23df.pdf?index=true
    • http://dopexatatadad.epizy.com/satofadepas.pdf
    • https://b913155d-2712-4fd4-bcc6-651970a8c456.filesusr.com/ugd/e39924_c0d495fb59cb46c49f3638d35dda3f91.pdf?index=true
    • http://tedipokexumo.epizy.com/30026490288.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d84e.bin
c6880db792abf4339299b8a03585d3d0d7f79af19bb0a87f257282a2301c078d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD84E 5672 bytes
font_01_sfnt_off0000ebb9.bin
3ab9f3b0896095c76239ec40d8f46dcd8ccceafef00edc59afeb639f379138ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB9 10980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.