Malicious PDF — malware analysis report

Static analysis result for SHA-256 31e0a505368ce83e…

MALICIOUS

PDF

80.0 KB Created: 2021-03-31 13:37:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 57292997dd2b7be1ec15a4dab1e883ad SHA-1: e545efb790cb4574f0a453a72997d6009dbbd37b SHA-256: 31e0a505368ce83ee5b98fee9ff3bfe96101119d84245a94d3d0ee6c80c77b92
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it's part of a link farm designed to direct users to potentially harmful websites. The embedded URI and the document body, though heavily obfuscated, point towards a lure related to "people of the lie pdf", likely a phishing or malware distribution tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=people+of+the+lie+pdf
    • http://laura-egorova.ru/lutasewilelutiwifireduts3c6n.pdf
    • https://galixasuja.weebly.com/uploads/1/3/4/5/134518214/3020488.pdf
    • http://cashtanks.fun/44141166092yq0gu.pdf
    • https://joponavo.weebly.com/uploads/1/3/4/2/134234964/4822984.pdf
    • http://cheeronthemove.store/zoom_g1on_manuale_italiano0pash.pdf
    • http://hushseo.online/pentair_easy_touch_remote_no_comm1c1a8.pdf
    • http://cadenalia.com/c_programming_book_in_tamil86woj.pdf
    • http://wordsidepost.top/basic_accounting_journal_entries_practicefa9ws.pdf
    • https://maxedojose.weebly.com/uploads/1/3/1/4/131452800/rodov.pdf
    • https://nutomejeti.weebly.com/uploads/1/3/4/7/134702699/7487714.pdf
    • http://canonsburglake.com/29770354818ia6hi.pdf
    • http://foyou.store/vobifojosoln6ovb.pdf
    • http://wowitaly.pro/foxudup4l6y.pdf
    • https://cdn-cms.f-static.net/uploads/4403407/normal_605969d1652b3.pdf
    • https://moxuronanupew.weebly.com/uploads/1/3/4/5/134597487/lesuzesojep.pdf
    • https://cdn-cms.f-static.net/uploads/4462096/normal_6050e11c58381.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dajovufozimok.epizy.com/hymenolepis_nana.pdf
    • https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_4c24110d14304bdd8e6b4170e0a3aef5.pdf?index=true
    • http://fegubitexore.rf.gd/chrome_os_android_development.pdf
    • https://7fca5364-97a1-4441-b76e-d2c429a59218.filesusr.com/ugd/735424_c205924a72674e1e88c28a967bb9998b.pdf?index=true
    • https://15e12281-0fef-4bb1-b284-2b61ddec1698.filesusr.com/ugd/6c5390_9cf4d6e1b0554fb6bef556fa726fd4e5.pdf?index=true
    • https://5ce19dfa-329f-495d-88d1-e1e7834d9072.filesusr.com/ugd/d902bb_05234f370f5c48d5ac6027e76b38402b.pdf?index=true
    • http://zepaxawom.rf.gd/calculus_ap_review_outline_and_problems_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd70.bin
1acd706a888bf51fc48f5052c47afe242daae69c863d0e142c5f25579cfce55f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD70 4644 bytes
font_01_sfnt_off00010d41.bin
e66bf8074b8055e252316ff2bbd4c93733c7b97d67544ea0a1f664028dde4128		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D41 11020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.