Malicious PDF — malware analysis report

Static analysis result for SHA-256 24d87f988e93aa8a…

MALICIOUS

PDF

74.0 KB Created: 2021-03-11 23:45:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8a5c730c69f0a4ce68992d6fc942280d SHA-1: e7e1f1bec164d1e6bdb5dbc6cdfc6578407d3c9f SHA-256: 24d87f988e93aa8a352d8246557fe9b76cde3f75fda1cb3a3bc9fbe2e52df2f9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking PDF files, but one URL points to a suspicious domain. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm. ClamAV detection and ML classification confirm the malicious nature of the file, suggesting it's a phishing or trojan distribution mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=o+saki+saki+song+dj++pagalworld
    • https://fumewalifo.weebly.com/uploads/1/3/4/8/134884483/xomekow.pdf
    • https://kazirevuteguzug.weebly.com/uploads/1/3/2/6/132681824/e5cf33312c.pdf
    • http://disesomudo.22web.org/pediatric_cardiac_surgery_book_free.pdf
    • https://luxaxila.weebly.com/uploads/1/3/0/8/130814132/3295962.pdf
    • https://dizalojowu.weebly.com/uploads/1/3/4/8/134866254/88672e2dddea9a.pdf
    • https://lovapunosarimol.weebly.com/uploads/1/3/5/4/135401421/wuxudiro.pdf
    • http://mebosopevux.iblogger.org/vixomitasomemogadirod.pdf
    • https://pivatebovuwize.weebly.com/uploads/1/3/0/7/130775292/dikukurapobas.pdf
    • https://xuwowazasoko.weebly.com/uploads/1/3/4/0/134041707/6122193.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/99789d1a-011f-4f33-9f0a-1d42c54cc3a3/memrias_pstumas_de_brs_cubas_filme_download_dublado.pdf
    • https://s3.amazonaws.com/bomupi/christmas_tree_wallpaper_for_android.pdf
    • http://vawutalakomu.epizy.com/coordinate_transformation_from_cartesian_to_polar.pdf
    • https://uploads.strikinglycdn.com/files/d665ca86-ec9a-4203-85fa-86a294c4b12e/how_do_you_call_a_person_who_is_not_straightforward.pdf
    • https://uploads.strikinglycdn.com/files/5957f398-e10c-44fc-b008-4676dc3cf912/noco_g15000_review.pdf
    • https://uploads.strikinglycdn.com/files/0233c275-38a8-4f9e-a3c3-fb20595ebb82/libros_de_mitologia_griega_gratis_en_espaol.pdf
    • http://dawobamam.epizy.com/geometra_trigonometra_y_geometra_analtica_conamat.pdf
    • http://pojafuda.rf.gd/beautiful_flowers_good_morning.pdf
    • https://s3.amazonaws.com/dugibabafod/aldi_job_application_questions_answers.pdf
    • https://uploads.strikinglycdn.com/files/43fc8d0e-7ad1-423e-a5a2-d5c51a8f6823/in_search_of_respect_chapter_4_summary.pdf
    • https://s3.amazonaws.com/gajabedafot/official_business_letterhead_format.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0ff.bin
db4d168d2046dd7be0dc4d440c981a13a16114560650ce3621fb3f842315d66d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0FF 5388 bytes
font_01_sfnt_off0000f372.bin
8ffde7ad7a1c1f0f8be3c6a20f2356dd4956fa684617d8271bbe7153219069be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF372 12144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.