Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ea232cbd1fd065c…

MALICIOUS

PDF

81.5 KB Created: 2021-03-20 10:30:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2be0c111f720fd726cc26d2a531c9762 SHA-1: 87489f329f850051643a824c0eb21f2ba624c675 SHA-256: 1ea232cbd1fd065caf0c6a3ed2b1996d0b6ef7956317927e25223fd9fe41ebb8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, many of which point to suspicious domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, suggesting a phishing or malicious redirection scheme. The ClamAV detection and ML classifier further support the malicious nature of the file, likely serving as a lure for users to visit compromised or malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=raguvaran+b.+tech+telugu+movie+video+songs
    • https://cdn.sqhk.co/fowijuseziju/8hN6Ngj/best_chat_rooms_to_make_friends.pdf
    • https://cdn.sqhk.co/sategexarom/hghhatU/football_stickers_for_whatsapp_2020_transfer_update.pdf
    • https://cdn.sqhk.co/dodanadofu/g8Kijgm/9907702802.pdf
    • https://cdn.sqhk.co/jedelamodafa/fFjiVz1/lusaronitewamemeje.pdf
    • https://cdn-cms.f-static.net/uploads/4382614/normal_60273e8c11c8b.pdf
    • https://cdn-cms.f-static.net/uploads/4445879/normal_60217f600ad4a.pdf
    • https://cdn.sqhk.co/gujadozede/2lij4hh/video_poker_trainer_free_online.pdf
    • http://wozovumorawoka.sportsontheweb.net/niserovif.pdf
    • https://cdn.sqhk.co/sivefuxonix/gjjihhc/frog_god_games_the_blight_review.pdf
    • http://wumewil.sportsontheweb.net/my_name_sandra_cisneros_discussion_questions.pdf
    • https://cdn.sqhk.co/zujubokave/DNgjasg/italia_dance_music_radio.pdf
    • https://static.s123-cdn-static.com/uploads/4465539/normal_5ff6222641bbd.pdf
    • https://cdn.sqhk.co/nobutowug/hcif7dT/one_gold_app_review.pdf
    • https://cdn-cms.f-static.net/uploads/4499329/normal_604894f0c4fbd.pdf
    • http://nebofimanigi.sportsontheweb.net/98132005694.pdf
    • https://cdn.sqhk.co/vujenibolo/gfXiimM/teaching_strategies_gold_plus_login.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://93114ef4-bbe1-4cbc-9077-193f0e57bd61.filesusr.com/ugd/b0b521_3615754fa1b1446594481ca2812a52f8.pdf?index=true
    • https://2cc3dcad-61c1-4442-8662-ca5be7cd8672.filesusr.com/ugd/71b93f_c67f661436094ae9b96876a72d14882b.pdf?index=true
    • https://a1f0096d-76f5-425c-b826-5ccbd312c1bc.filesusr.com/ugd/8f8c07_5a754696b2b048148d6fd804912b9b29.pdf?index=true
    • https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_2ab58bdb1b114f7a87936e32609b6008.pdf?index=true
    • https://f92484db-e5b4-41f8-9431-508412042773.filesusr.com/ugd/b04c15_47f9acc0c2404e06ac36e2a9f5c2cbed.pdf?index=true
    • https://6323cc82-cf72-43ae-bc7a-f8d691a1d37e.filesusr.com/ugd/4f3578_0317d0f600fb4aa390b7541632fc41e9.pdf?index=true
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_1183442bb92947febcaf58050af4f929.pdf?index=true
    • http://sifebitufol.onlinewebshop.net/how_to_be_a_doctor_in_spain.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff82.bin
9a17ee4a843cfc93b001e50082717b132675969b308be7110fe6f65de8afd885		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF82 5592 bytes
font_01_sfnt_off0001126c.bin
9520078137dd4091152db989294d5b65aba8233f3cd9b66f39bfca652abbd9fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1126C 11016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.