Malicious PDF — malware analysis report

Static analysis result for SHA-256 2561e21ad34eb13d…

MALICIOUS

PDF

77.5 KB Created: 2021-05-16 09:25:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a7ed68bb47f553c8eeb463bf40feac7d SHA-1: 1c7fc7de43b2e34f5f7c8fa7563e5295760281d4 SHA-256: 2561e21ad34eb13dec0e62a9fc137e5f59572de243f39153ca9a7efa83479051
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to direct users to potentially harmful websites. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing or trojan variant. While no scripts were directly extracted, the PDF structure and embedded URIs are indicative of a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=que+significa+el+estilo+de+vida+sedentario
    • https://ronizozobofer.weebly.com/uploads/1/3/4/6/134654069/4bff5e80.pdf
    • https://cdn.sqhk.co/tiviluluje/shbVpWH/accpac_plus_user_manual.pdf
    • https://boleturem.weebly.com/uploads/1/3/4/3/134398498/dedojorisukiviro.pdf
    • https://malugula.weebly.com/uploads/1/3/2/6/132695531/ramurenomirafe.pdf
    • https://cdn.sqhk.co/nowonipewo/jfg98By/bipixejodudupebuladibe.pdf
    • http://sepoxudozixo.sportsontheweb.net/wordly_wise_book_7_lesson_18.pdf
    • https://cdn.sqhk.co/xalesikozip/aKjejb9/latarowimododinonu.pdf
    • http://kutatit.getenjoyment.net/black_diamond_headlamp_red_light.pdf
    • https://tikedamo.weebly.com/uploads/1/3/1/4/131453682/6841849.pdf
    • https://dawemewi.weebly.com/uploads/1/3/4/7/134747996/8839806.pdf
    • https://xuniwinasifobip.weebly.com/uploads/1/3/5/3/135302293/xibur-wipuris-gabozez-tuluf.pdf
    • https://cdn.sqhk.co/zuxosutuku/gfAjgjg/12529847573.pdf
    • https://bagirarivevi.weebly.com/uploads/1/3/1/3/131384609/0ace6d31736b5e2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/02674328-1094-48b2-8404-eb8d78bf7213/sharp_air_conditioner_cv-p10mc_parts.pdf
    • https://uploads.strikinglycdn.com/files/5e5fa998-2dfc-4401-86e4-3df7ad039d2c/in_the_mood_for_love_full_hd_movie_download.pdf
    • https://uploads.strikinglycdn.com/files/a8a246a1-24d9-4249-92c5-742d766122dc/bodivebafutolakig.pdf
    • https://uploads.strikinglycdn.com/files/34817cfa-c2a4-44ae-a942-64e61b6a9361/95673633452.pdf
    • http://tapoloferazuziw.atwebpages.com/wakunexosoder.pdf
    • https://uploads.strikinglycdn.com/files/f29a3d98-c47c-45a4-b3e2-6d126f2d6b04/63512355162.pdf
    • https://uploads.strikinglycdn.com/files/6502b8b9-f533-4424-84c1-780ff32e0705/xunojawasaxewelanew.pdf
    • https://uploads.strikinglycdn.com/files/2dd8bd2b-6d3e-4964-aab0-ebd190ec2486/how_to_set_time_on_tissot_1853_touch.pdf
    • https://uploads.strikinglycdn.com/files/0aab4299-d468-4ebb-b4d3-1e5c8d45a054/47285079656.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef2d.bin
7c520f7fa6a6742e9abc309e77a7334b3d48d0ae7ae3e157f34f6df1f3756fdf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF2D 5308 bytes
font_01_sfnt_off00010159.bin
501fd59a9848b481227b99fb11f358f5abbf156df15105f32add6cd632ab0028		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10159 11636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.