Malicious PDF — malware analysis report

Static analysis result for SHA-256 28063fc46f3cd0f8…

MALICIOUS

PDF

86.6 KB Created: 2021-03-13 22:53:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b62717ca4f361974841aea285bee391d SHA-1: 36f549cc4d15393b4da9412d24951e501121df66 SHA-256: 28063fc46f3cd0f8f300a1a8c96a7b126bfb769dad2472136ed43b7627179bd1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are disguised as legitimate resources, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external links point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=guide+to+intrusion+detection+and+prevention+systems
    • http://tanubujurutemut.scienceontheweb.net/arabic_language_proficiency_test.pdf
    • https://static.s123-cdn-static.com/uploads/4423453/normal_5fe4b4487484e.pdf
    • https://static.s123-cdn-static.com/uploads/4393019/normal_6000c360e254e.pdf
    • https://static.s123-cdn-static.com/uploads/4463006/normal_5fddba44169a2.pdf
    • https://cdn-cms.f-static.net/uploads/4427795/normal_602e60bfd514c.pdf
    • http://luxibenuguk.getenjoyment.net/96269134576.pdf
    • https://static.s123-cdn-static.com/uploads/4368488/normal_5ff3214a03d2a.pdf
    • https://cdn-cms.f-static.net/uploads/4451365/normal_60210bd15a256.pdf
    • https://static.s123-cdn-static.com/uploads/4526930/normal_5ff310f672ba6.pdf
    • https://cdn-cms.f-static.net/uploads/4465263/normal_6043977df120e.pdf
    • https://static.s123-cdn-static.com/uploads/4423462/normal_5ffff606dfce5.pdf
    • https://static.s123-cdn-static.com/uploads/4415068/normal_5fe3afe41babe.pdf
    • http://puveputado.sportsontheweb.net/myers_briggs_personality_types_of_brooklyn_nine-nine_characters.pdf
    • https://static.s123-cdn-static.com/uploads/4426815/normal_5fefee0a1ebd9.pdf
    • https://cdn-cms.f-static.net/uploads/4500425/normal_602a209299d40.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2eeb51df-07ba-4372-80d9-1ef4646fc7f7.filesusr.com/ugd/6af210_f8c460df56dd47e8b6261ce11aa66a20.pdf?index=true
    • https://52c77544-2eb8-427c-ad0e-a8a7e2ea9366.filesusr.com/ugd/93288f_d3fca3ae1ae64113be64d64e1830fb83.pdf?index=true
    • https://8eeb1f0a-0cdd-4c66-98a4-83777b49fb54.filesusr.com/ugd/64f9d2_eafd5b3bba894bfea20a6ba17475adc1.pdf?index=true
    • https://2ddedb0e-b7b0-41c9-a8bc-c018bd0e6e4c.filesusr.com/ugd/70094d_6257b5dce5a14c95bc9a72b69f475678.pdf?index=true
    • https://972af30b-04c2-4618-b911-83ba0b7fef9e.filesusr.com/ugd/84a5c6_82ad55e355a34306a24e9203c0bbe620.pdf?index=true
    • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_4739710d55b74aacb41f7a427fc723b2.pdf?index=true
    • https://ede8a7a3-2377-4e09-926a-401222b31c25.filesusr.com/ugd/81c89d_d444d78e8fa841048ce81b25958ddb34.pdf?index=true
    • https://bf9f0237-f3ce-436f-b14e-f961c1e3b1b1.filesusr.com/ugd/12745a_b75a59d54db7494a9e0490e4caefb5cf.pdf?index=true
    • https://18d8f76e-0bdd-4b96-b744-fee987eed1b0.filesusr.com/ugd/1486c8_d58aa7236eb041ac89b8637ff6501e38.pdf?index=true
    • http://xabudavadeguvo.myartsonline.com/4963315038.pdf
    • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_cb820fbf281645148a38437315e912c4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011420.bin
9693c8a7e6ed58495617074d53b9335d4412030a6d19dab559ed7ffe874141d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11420 5380 bytes
font_01_sfnt_off00012668.bin
2c5f85f5e227f2a04fb302a5208ecda1421458710ffffb3512368922894efa6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12668 11076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.