Malicious PDF — malware analysis report

Static analysis result for SHA-256 2040e6f92804bcf8…

MALICIOUS

PDF

75.6 KB Created: 2021-04-01 06:08:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 49e4ca6da36e746163521f15c3829644 SHA-1: dbe60033712b926ad816ef869cbea3f45c3c3a35 SHA-256: 2040e6f92804bcf8fc44127dce82a662542ee90f5cb9e6da2426b347a483c1c5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a link farm, directing users to a suspicious URL. Additionally, ClamAV detected the file as 'Pdf.Phishing.Trojan', and ML classification strongly indicated maliciousness. The embedded URL suggests an attempt to redirect users to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=runecrafting+guide+melvor+idle
    • http://wiwalubezit.22web.org/bulova_precisionist_96b175_manual.pdf
    • http://dolekil.22web.org/bojutatujisomopu.pdf
    • http://jefuvodavi.iblogger.org/62766711796.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vizegemawokaxe/blocking_calls_on_android_phones.pdf
    • https://s3.amazonaws.com/wuwabobujasivor/56857749339.pdf
    • https://uploads.strikinglycdn.com/files/975d233f-fee8-430e-97ac-c8d1273cbe32/87523042616.pdf
    • http://wafepugi.rf.gd/22512326474.pdf
    • http://kozolamo.rf.gd/how_to_use_zojirushi_rice_cooker_timer.pdf
    • http://jakezijaredu.epizy.com/dirazut.pdf
    • https://uploads.strikinglycdn.com/files/a167d78c-3d67-4519-8b75-805044e58837/31557278576.pdf
    • https://bc5ba30c-e427-49eb-abc4-9677f18f04c1.filesusr.com/ugd/bcd086_e5617ec25e2a4e2387f1a0de3887bc46.pdf?index=true
    • http://mafozebowuveb.epizy.com/sonda_vesical_femenina.pdf
    • https://uploads.strikinglycdn.com/files/d6bddcd6-8dbf-4e78-8d12-c06c52dfca8f/toro_ultra_blower_vac_manual.pdf
    • https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_3c1d3cbfc81749dcb6edb09c6791807b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3cb9138d-4308-4a14-b32e-6d15ab859fdb/kanaja.pdf
    • https://s3.amazonaws.com/banula/menamobev.pdf
    • https://uploads.strikinglycdn.com/files/5ea11ea4-3673-4c55-a1b3-047ac024dcd7/is_mcdonalds_iced_coffee_keto.pdf
    • https://uploads.strikinglycdn.com/files/ed1121fa-4211-4e3b-8506-c6e7a5f672a1/how_to_dress_at_a_wedding_as_guest.pdf
    • http://kigizeme.epizy.com/first_grade_english_worksheets_free_printables.pdf
    • https://acfc0e76-311d-46af-9c13-f46c112eb424.filesusr.com/ugd/f90bad_c6e536ef47bc4c4189929b5dd6c83fa9.pdf?index=true
    • https://76f5a3e5-08d8-4581-9975-6c1b933a1845.filesusr.com/ugd/dbbd16_de5e65b5784a49f088a7f7395e1cc61a.pdf?index=true
    • https://s3.amazonaws.com/filidabut/round_to_the_nearest_hundred_thousand_89_659.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e83e.bin
6c5db85c1bdddc3c9317d07846e5ea590a16fb0f1cc37aea73446b5148fd72ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE83E 5228 bytes
font_01_sfnt_off0000fa06.bin
601f502279f3c85b0bfb2b1e04b15fe9c2e4adae3e329799055ab8c70747abc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA06 11456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.