Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f487dc49d780315…

MALICIOUS

PDF

80.7 KB Created: 2021-04-03 18:40:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b0d87f617638a4846059c279fb52b85 SHA-1: 2b4cec6a0754f6fcae0adb554d0684466d7f2f16 SHA-256: 1f487dc49d78031510ac7d059df3b3d5272942a3d01a87c638e6c083e12be7aa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm, suggesting a distribution or phishing campaign. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=calcula+molaridad+de+una+disolucion
    • https://cdn.sqhk.co/xivijela/VBjiaD0/xululuvukijiwi.pdf
    • https://cdn.sqhk.co/dogutadova/oXif2gi/joola_ping_pong_table_walmart.pdf
    • https://cdn.sqhk.co/dagozuwemep/gdgiuif/kopegetelofe.pdf
    • https://cdn.sqhk.co/muwitajo/TgjfB9B/toronuwopebud.pdf
    • http://jivegajisuv.22web.org/neretesurik.pdf
    • http://mutodute.22web.org/49554643608.pdf
    • https://cdn.sqhk.co/nenuguvan/mihgoih/rollerball_massager_for_neck_back.pdf
    • https://cdn.sqhk.co/pugepavofu/ibugj5q/80583631607.pdf
    • https://cdn.sqhk.co/fudimesa/heuXhTB/desert_survival_shooting_game_offline.pdf
    • https://cdn.sqhk.co/jemajujo/heygfii/gixugonikuzaxubore.pdf
    • https://cdn.sqhk.co/zegofurop/ihbheia/11574829078.pdf
    • https://cdn.sqhk.co/sirejeforox/iiUiaCV/box_with_x_instead_of_emoji_android_fix.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1cf095b7-1d29-4152-b82c-7733cf7ba0c7.filesusr.com/ugd/c1de29_7b9658cb14ac465bbf0efae915144844.pdf?index=true
    • https://09ec9d85-9312-4337-94d0-b84080e05f2e.filesusr.com/ugd/ac0094_70f21ff4c3e64b2a8be30796796690b0.pdf?index=true
    • https://e4034479-4ead-418b-af8c-5be8dc72bdbe.filesusr.com/ugd/1e8759_ad3957766d3d4924aa619d89b54399ee.pdf?index=true
    • http://fotexamaluvim.epizy.com/49389897339.pdf
    • http://refewebol.epizy.com/how_a_man_should_treat_a_woman_in_a_relationship.pdf
    • https://b354d503-40d1-4c97-84b4-bc0b16c12f35.filesusr.com/ugd/8c7d07_0478630c969a42c690bf3e94ea287d10.pdf?index=true
    • https://b7c6a474-53ed-4139-af63-4b2f501ae0e7.filesusr.com/ugd/e87294_9705c62522fe461aa65a803c789d6c57.pdf?index=true
    • http://buzanone.epizy.com/kulivemibusotixug.pdf
    • https://d0a6b1b1-1773-4622-8b5e-0ab5990a7ed3.filesusr.com/ugd/b90ba1_cb214330800b486e80bf7890c6c5dadb.pdf?index=true
    • http://zororeka.rf.gd/73064278658.pdf
    • http://bekogufepe.rf.gd/thyroid_eye_disease_treatment_guidelines.pdf
    • https://070488ba-e3d9-4c74-834b-445551f5513c.filesusr.com/ugd/fb83f1_aafe078d0fc24efd8c79e20cf7394b2f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9d7.bin
a603d44d473eed6c388e1e8313a159d389e780ceec73fe38e75ec583918ddbb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D7 4992 bytes
font_01_sfnt_off00010aac.bin
a2cd13c83daf3497e1d799ea041320286ea6e7b66b2a10b674f264a322c45621		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AAC 12396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.