Malicious PDF — malware analysis report

Static analysis result for SHA-256 260a54190ebf0535…

MALICIOUS

PDF

75.7 KB Created: 2021-03-16 23:25:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c022c3f19071033b6ded11443226369 SHA-1: 7f79240bfc4d57844eb07a35ad8973f089cbff2a SHA-256: 260a54190ebf0535a2abecfce9244ffc617667783c73e844bbc7935916859d3f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or link farming. While no scripts were explicitly extracted, the nature of the PDF and the numerous external links suggest it's designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=reading+comprehension+worksheets+pdf+7th+grade
    • http://bowemesuzot.iblogger.org/when_to_use_smart_pointers.pdf
    • http://lemixop.iblogger.org/13872754586.pdf
    • https://gojatoxemoniro.weebly.com/uploads/1/3/4/8/134894745/pobikowawuzakizafozo.pdf
    • https://welabelodaset.weebly.com/uploads/1/3/5/3/135399274/xajitar-regunidozabem-xibimizosexew.pdf
    • https://lizuxafemow.weebly.com/uploads/1/3/0/7/130776517/xodawedusela.pdf
    • http://pifavobiju.iblogger.org/bibujusilixotogatixi.pdf
    • https://dotimozenut.weebly.com/uploads/1/3/5/4/135400211/04d6cdcbf.pdf
    • https://vixevugipun.weebly.com/uploads/1/3/5/3/135327752/bopam-sosafosimitiw-naraf.pdf
    • https://gatimosuxanad.weebly.com/uploads/1/3/2/8/132814295/lalowaxotojose-sufif-bidosevo-datinubenaje.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_536cdbcbf1eb497ba15ef293f1886e31.pdf?index=true
    • https://s3.amazonaws.com/jolunenafobuw/hand_gesture_controlled_robot_project_report.pdf
    • http://zepurudevivo.rf.gd/android_bitmap_auto_recycle.pdf
    • https://s3.amazonaws.com/damerirazib/97125925881.pdf
    • https://bad3f395-1638-4667-b349-d6f934eeab49.filesusr.com/ugd/ed2d23_f48e2ec4a3a740fdaafcd6aa19d51486.pdf?index=true
    • https://s3.amazonaws.com/wetevali/7082620686.pdf
    • https://c30b87d5-e38e-4f4c-8f61-e356d9eaafe8.filesusr.com/ugd/347120_109648dd36ce489eab9ccd166c562775.pdf?index=true
    • http://tuwuxadifire.rf.gd/25918039066.pdf
    • http://fofiwufawiparug.epizy.com/balance_sheet_cash_flow_income_statement_relationship.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7e4.bin
5e947f9fbcef4db9a95adb05a5c000b9deb8a414358e673a1c21732a40be46a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7E4 5780 bytes
font_01_sfnt_off0000fb91.bin
957bc0e7d22f42cb515a9da58152c5dbd06b579794c5bd0ff3b7a188c04bfee8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB91 10712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.