Malicious PDF — malware analysis report

Static analysis result for SHA-256 26e1d3de82ddb8dd…

MALICIOUS

PDF

91.5 KB Created: 2021-03-17 07:22:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b69c31e03dc73ffc7ab1f3e5afbea03b SHA-1: d55468bbbb2d4eece08baebc6d25efb0a0be0430 SHA-256: 26e1d3de82ddb8dda5ce7352cb5bc2d1208e756a0a2936586e4a5c9a7b63f0aa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files. The primary URL, 'https://seumenha.ru/wix?keyword=heats+of+reaction+and+hess%2527s+law+pre+lab+answers', suggests a keyword-based lure. ClamAV detection and ML classification strongly indicate malicious intent, likely for phishing or distributing further malicious content. No scripts were extracted, but the structure implies a link farm designed to host or redirect to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=heats+of+reaction+and+hess%2527s+law+pre+lab+answers
    • https://cdn-cms.f-static.net/uploads/4487399/normal_5fd262ab263b3.pdf
    • https://cdn-cms.f-static.net/uploads/4449421/normal_600e8c24bf7ad.pdf
    • https://cdn-cms.f-static.net/uploads/4470028/normal_60409cca239b1.pdf
    • http://copyrighthelpcentral.com/how_to_set_a_citizen_skyhawk_watchu9rw3.pdf
    • http://tacfitproducts.com/robocopy_orden_para_copiar_archivos2cj0k.pdf
    • https://cdn-cms.f-static.net/uploads/4366354/normal_603e6fd671a71.pdf
    • http://sdorovie-sustavi.xyz/zizipapeluziia9s0.pdf
    • https://static.s123-cdn-static.com/uploads/4387566/normal_5feb5a8d48709.pdf
    • http://top-agent.ru/rezosixawenugekadamibikuaxkvh.pdf
    • http://supsun-aero.com/44344302812regyv.pdf
    • https://cdn-cms.f-static.net/uploads/4388598/normal_5fd693d2c803e.pdf
    • https://static.s123-cdn-static.com/uploads/4372354/normal_5fe5750d5abb5.pdf
    • https://static.s123-cdn-static.com/uploads/4392451/normal_600256345c1f7.pdf
    • https://static.s123-cdn-static.com/uploads/4411512/normal_5ffdb123761af.pdf
    • https://cdn-cms.f-static.net/uploads/4366344/normal_604d7ebcadbb0.pdf
    • http://de-bewertung-889562.icu/sportline_pedometer_4406_instructionspjndv.pdf
    • https://cdn-cms.f-static.net/uploads/4384030/normal_60225c0ebb6b2.pdf
    • http://indonesia2health.online/do_movies_get_removed_from_amazon_primemspv9.pdf
    • http://thedopemarketing.com/raranizi8iqwe.pdf
    • https://cdn-cms.f-static.net/uploads/4407793/normal_5fd22747d9a0f.pdf
    • http://copyrighthelpptteam.com/public_relations_degreeajche.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://54570836-76ea-4100-b78f-d1ba4c3cc0d1.filesusr.com/ugd/21ac59_0f66ada000dd4a65ad5908e20d2caf72.pdf?index=true
    • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_49013d9d81784e37abf8d53f20d58fba.pdf?index=true
    • https://08b4a39d-fa16-4eaa-91be-ae90003cacb9.filesusr.com/ugd/237bf7_640c03d591cb4a1bae4b0f8e782cdb71.pdf?index=true
    • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_3ff5f2858eb5466fb4e675ed814261ad.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000119c2.bin
7445f822fb405c41bce45fba3f5e723a81713cfbd16989273d69bf387cebb365		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119C2 5260 bytes
font_01_sfnt_off00012ba1.bin
6d384e07d84bae1cb37a0ad65f64d01398ee45d0bb20edbae96f8c161c32a490		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BA1 11440 bytes
font_02_sfnt_off00015216.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15216 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.