Malicious PDF — malware analysis report

Static analysis result for SHA-256 2acf0e4cd4667efa…

MALICIOUS

PDF

77.7 KB Created: 2021-03-28 14:53:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a4d5345a5330de31845ceeedd0d7145 SHA-1: 521e28432011fbc6f01cc8e22b18eddf38234f0f SHA-256: 2acf0e4cd4667efa14c446a5962291b868be4413a5ad8be84730439eac7304e6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file identified as malicious by ClamAV and a machine learning classifier. It contains a large number of external links, suggesting it functions as a link farm or SEO spam document. The presence of external URIs and a PDF link farm heuristic indicates an attempt to redirect users to potentially malicious or unwanted content. No scripts were extracted, but the PDF structure itself is indicative of a malicious intent to manipulate search results or distribute links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=pdf+de+antigona+velez+gratis
    • http://samelike.site/sunuremua8xa.pdf
    • https://zegasapazenavu.weebly.com/uploads/1/3/5/3/135326880/zijebemidudi.pdf
    • https://zubotovilep.weebly.com/uploads/1/3/4/5/134581484/tejotim.pdf
    • https://zukutalemuz.weebly.com/uploads/1/3/4/5/134582669/gefezo-xutupubib-fivuzebe.pdf
    • https://pinafizupefed.weebly.com/uploads/1/3/1/3/131380591/nafidina_nemejisezurebe_jurexo.pdf
    • http://proba7.xyz/golfstar_transcendence_guidechsmb.pdf
    • http://blue-tick-central.com/catalogo_mary_kay_septiembre_2020_mexicoo440r.pdf
    • http://world-wild-shop.com/how_to_drain_a_sundance_optima_spaedq9p.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/womirofop/69589375840.pdf
    • https://s3.amazonaws.com/pavujiniz/parwal_bechea_jaieb_bhagalpur_video_song.pdf
    • https://s3.amazonaws.com/pavujiniz/red_harvest_top_kindle_books_2018.pdf
    • https://uploads.strikinglycdn.com/files/42b42383-c0d9-486e-b4ea-4f9d28a30fb3/desktop_support_interview_questions_and_answers_free_download.pdf
    • https://uploads.strikinglycdn.com/files/b4a2c39d-dc15-4cb1-bdaf-b54f1f67da9c/56568814842.pdf
    • https://s3.amazonaws.com/bakoloj/85791784236.pdf
    • https://435a888a-8f80-410d-aa77-77edd6e4491d.filesusr.com/ugd/51fec0_31b8ffd04c51445a823537a2b717b24e.pdf?index=true
    • https://s3.amazonaws.com/paxivogedewilu/nidona.pdf
    • https://uploads.strikinglycdn.com/files/6c12b500-b080-4454-9a0c-9e8d323178b7/best_late_night_bars_atlanta.pdf
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_088df475a2bb4d37bc0fb7beb0298080.pdf?index=true
    • https://47a25507-5c4f-4e73-9b7c-0c49514c8174.filesusr.com/ugd/e00bd3_209d1db175924ddaa63602be2574b734.pdf?index=true
    • https://uploads.strikinglycdn.com/files/00db888e-f1d6-4d58-a7d6-05474e2b2c91/tisaz.pdf
    • https://uploads.strikinglycdn.com/files/b72c3632-ef6f-4b15-af58-edbb80121a9d/1_de_novembro_feriado_em_que_paises.pdf
    • https://s3.amazonaws.com/nevowimo/latuvizesunozax.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef33.bin
11b2aecac0ded58af625c42a3e3768b652090f49f9ac37a9543f016007837c71		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF33 5184 bytes
font_01_sfnt_off000100fe.bin
d1e08bfee668a8801a0b415afeb98d49a5d3802450189fe9976dd7c828c606f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100FE 12008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.