Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b74ed245765e150…

MALICIOUS

PDF

88.2 KB Created: 2021-03-18 17:39:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07bf3416d170adfa4c23e2c048e60c55 SHA-1: 6fcb814e39f842e018a96b533d3d990baec52539 SHA-256: 2b74ed245765e150c6d64c0a7ede2411230d2fc08d721db7a2240bcee8fdbfa8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are benign, but one URL, https://midufefew.ru/wix?keyword=sant+nirankari+mission, is flagged as unknown and is associated with a critical heuristic firing for a PDF link farm. ClamAV also detected this file as Pdf.Phishing.Trojan. This suggests the document is designed to redirect users to malicious sites, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=sant+nirankari+mission
    • http://creamwalls.space/ambala_video_song10plj.pdf
    • http://itgermany.net/sixibomapefeposilitiwaliv7fjg.pdf
    • http://geniusenglish.space/73358506116chvzx.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1af7b9b6-d102-45ca-9fa7-44c21bf579a5/hamlet_act_4_scene_2_quizlet.pdf
    • http://janalusexisowa.epizy.com/recorder_sheet_music.pdf
    • https://s3.amazonaws.com/somamere/62585440370.pdf
    • http://zoluwupaxefiv.rf.gd/geometry_chapter_8_assessment_book_answers.pdf
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_c72d4b306c4c40fd884fc400d05c792c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e23e5e6f-af18-4750-b3f9-f9d8064fa33f/beginner_piano_books_free.pdf
    • http://wawaxibog.rf.gd/arduino_step_by_step_your_complete_guide.pdf
    • https://s3.amazonaws.com/dupula/4066177693.pdf
    • https://c4cd0dbc-23d7-4f11-b65f-2561cec8abe5.filesusr.com/ugd/516793_16de463ae9954c6e8b2b39b1215c9581.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8259b022-33b2-4764-9322-1d552c082c78/17035175942.pdf
    • https://0a497e50-07dd-462d-832d-d8678f741a8e.filesusr.com/ugd/5f857b_7104cdc12d114c22b35330f525ca3fb6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/377a81c6-0cb5-4a3e-b7b2-973d17435d9d/black_and_decker_cordless_drill_with_2_batteries.pdf
    • https://s3.amazonaws.com/lovetijif/bookmark_design_template_photoshop.pdf
    • https://s3.amazonaws.com/dowesitobuga/buxebewete.pdf
    • https://uploads.strikinglycdn.com/files/cc5d64cd-8201-42e5-904f-ac2fd0a0e3e7/ganimizeta.pdf
    • https://uploads.strikinglycdn.com/files/f9ba5815-43a7-4516-83e7-7575ff453dfe/how_to_merge_files_with_foxit_reader.pdf
    • http://tetexabe.epizy.com/boxijebamovizudifukexad.pdf
    • https://9d76d0c6-5807-43ac-a2ba-7b4112d1a20a.filesusr.com/ugd/5cd33b_9bf0ed095b644f028589fe39a262652d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b94e3c65-9804-498d-8fa5-cb35d527a1c3/30203239083.pdf
    • https://ec75ba9f-29a7-4b73-bb51-4c951d20089f.filesusr.com/ugd/17cde0_716e6b86d9004bb2b812c28b95edbf95.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011cf4.bin
206516f95bee2f1d81566402d475b420bf50bd0d24ce8480d34bfccd2d1ddb10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF4 4964 bytes
font_01_sfnt_off00012dbe.bin
9dcfcafe2824c4d28b9654202d7287a6f3aaaa7265cb64498f1f50a108c307f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DBE 10892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.