Malicious PDF — malware analysis report

Static analysis result for SHA-256 31f8ef9e7cc492a0…

MALICIOUS

PDF

75.9 KB Created: 2021-06-06 03:48:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 819df1fd16185cbde883736aad541419 SHA-1: e907a11c850082668cc678c4f20da5546c820139 SHA-256: 31f8ef9e7cc492a011c026faafc2b804e0154fbb39b19bebeefe8cd664b484c4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, forming a link farm, and is flagged by ML classifiers and ClamAV as malicious. The document body, though heavily obfuscated, appears to be a lure related to a movie search query, suggesting a phishing or redirection attempt. The presence of external URIs indicates the likely intent to redirect the user to malicious content hosted on external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=chhota+bheem+aur+krishna+movie++mp4
    • https://movamapipimopi.weebly.com/uploads/1/3/5/3/135303402/nisaf.pdf
    • https://lonaxixa.weebly.com/uploads/1/3/1/4/131413275/5923851.pdf
    • https://danolanefute.weebly.com/uploads/1/3/4/8/134873411/afedd427.pdf
    • https://lilafigofuku.weebly.com/uploads/1/3/1/3/131398347/legofojibiradab-fegupunura-lekowun-nemesanelusi.pdf
    • https://jaxapinaxet.weebly.com/uploads/1/3/1/4/131406361/9322531.pdf
    • https://mabiredozex.weebly.com/uploads/1/3/4/4/134482212/5a17e4d5820b186.pdf
    • https://baresifesej.weebly.com/uploads/1/3/4/1/134131831/116cbb485c7ef12.pdf
    • https://kosulegi.weebly.com/uploads/1/3/7/5/137509808/fuwimetopedetog-gurive.pdf
    • https://nosodelutota.weebly.com/uploads/1/3/1/8/131857544/b67011a.pdf
    • https://wujuzuvetawi.weebly.com/uploads/1/3/1/3/131379059/duwidexukogew.pdf
    • https://makesagesuli.weebly.com/uploads/1/3/0/7/130740055/vuzujim.pdf
    • https://baresifesej.weebly.com/uploads/1/3/4/1/134131831/4618038.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e125803c-20cf-42ea-b70a-e944614d75b3/jexefafibakuwabezetub.pdf
    • https://uploads.strikinglycdn.com/files/5ecbf904-a5f6-4934-a582-3dc812b3ee68/tuwawumizetoraboresawafeb.pdf
    • https://uploads.strikinglycdn.com/files/05298974-ad33-433f-86c6-97b1a63ea9fb/80210484853.pdf
    • https://uploads.strikinglycdn.com/files/d56bb910-0da0-44bf-9d25-b8ca9995a2ec/diwurivuje.pdf
    • https://uploads.strikinglycdn.com/files/aa3013f6-9709-44f7-8217-8e91d304d663/el_mundo_de_sofia_pelicula_completa_pelisplus.pdf
    • https://uploads.strikinglycdn.com/files/90e4b1fe-3909-4279-8c05-43587c0b3b6a/8583975048.pdf
    • https://uploads.strikinglycdn.com/files/f29e558a-3b0d-41fb-a120-edfbec4a5a51/relative_clauses_exercises_11o_ano.pdf
    • https://uploads.strikinglycdn.com/files/0a7039a3-30a9-402e-a0c6-4c001e26a6d0/bible_quiz_questions_and_answers_from_the_book_of_acts_in_telugu.pdf
    • https://uploads.strikinglycdn.com/files/4c276150-32d1-4c1f-95cc-707fa901cefb/brother_ce5500prw_project_runway_limited_edition_sewing_machine.pdf
    • https://uploads.strikinglycdn.com/files/8eb7e97f-a8b1-4b36-9727-a1062b94be02/the_body_electric_athletic_company.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebc5.bin
4ffc3867bcbff74793515c428a3083c9251c7fb16aeffa65eef0698cab7664b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBC5 5284 bytes
font_01_sfnt_off0000fd94.bin
de45ba444c8e34e064676fc082e85afca5211a75522c3fd22bbe767ceaf21ee9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD94 10636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.