Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c639ca52788a297…

MALICIOUS

PDF

76.5 KB Created: 2021-03-15 18:42:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f8012bc2369c2ed899979141d1a5c9a4 SHA-1: e14840d9daf17f06300aa4bbe82aa890883edeb8 SHA-256: 2c639ca52788a297e980ecb9336a7ad24797d7c93e8bde91f2b7630376b6707c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms and phishing sites, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically related to phishing. The embedded URLs point to suspicious domains, likely serving as lures for users seeking free Asian TV series content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=asian+tv+series+free
    • http://support-copyrighthelpservice-about.com/vebexenarofaped6rz2p.pdf
    • http://instacopyrightcenter.com/how_to_clean_print_head_on_epson_workforce_wf-26307l2za.pdf
    • https://cdn-cms.f-static.net/uploads/4498702/normal_5fd82a4ea9d36.pdf
    • http://rbqjkwklnd.xyz/breville_breville_compact_smart_oven_toaster_ovendhal4.pdf
    • https://cdn-cms.f-static.net/uploads/4529149/normal_6038912d5257c.pdf
    • https://cdn.sqhk.co/libobivole/hEcjjUe/fotatovupokozusite.pdf
    • https://cdn.sqhk.co/muvotugi/wgKjawp/netimafojobi.pdf
    • http://biomaniks.website/3933122171czeg7.pdf
    • https://cdn-cms.f-static.net/uploads/4469378/normal_5fd6cc6baa3a7.pdf
    • https://cdn-cms.f-static.net/uploads/4426823/normal_5fd1fb7d71feb.pdf
    • https://cdn-cms.f-static.net/uploads/4366335/normal_6022dc2a075b4.pdf
    • https://cdn-cms.f-static.net/uploads/4366384/normal_6011229806efb.pdf
    • http://santand-es.com/75248109029w4j04.pdf
    • https://cdn-cms.f-static.net/uploads/4412606/normal_60393a15a65c6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://77bac38d-831a-46d6-8f22-d7743fcadc58.filesusr.com/ugd/5b9a87_231f3a5e63f04984980752915b2dad63.pdf?index=true
    • https://s3.amazonaws.com/jemazejodep/diablo_3_botting_guide.pdf
    • https://s3.amazonaws.com/zategafozasiru/dominoes_online_game_apk.pdf
    • https://s3.amazonaws.com/podawakumepewez/gitaraxuxivuxoposux.pdf
    • https://34e51215-b586-4e01-b3ea-a219475a7b91.filesusr.com/ugd/46481b_be82b35cdead4c549636b892996a0605.pdf?index=true
    • https://s3.amazonaws.com/kosipefojaw/tilugukufe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eddd.bin
52fde5959811db7a9117c676e907a72594e42b4795c3d9c90d6627a91adea8d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDDD 4776 bytes
font_01_sfnt_off0000fe2e.bin
0228d190332c03b3d7c5c33baf7eb315bc606f0fc052f68c2a99e5828832d9d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE2E 11648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.