Malicious PDF — malware analysis report

Static analysis result for SHA-256 32f39499625c7986…

MALICIOUS

PDF

79.8 KB Created: 2021-05-20 16:06:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bbba46be2a632a513b86e872a4f481cd SHA-1: bff24f2294206a78767a22b9599adb68d1a0eeb3 SHA-256: 32f39499625c798617f12ac93572c11f6e5b958f4de753a6cdff9a26ae868c52
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a significant number pointing to potentially malicious domains, indicative of a link farm or phishing campaign. The ClamAV detection and ML classifier strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or scam attempt designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=cuantos+ejes+de+simetria+tiene+un+trapecio+isosceles
    • https://funogefoxareso.weebly.com/uploads/1/3/4/0/134041001/b85143f9.pdf
    • https://wudatoguji.weebly.com/uploads/1/3/4/8/134885495/630578.pdf
    • https://fitisasituwag.weebly.com/uploads/1/3/4/8/134846324/mavekasu.pdf
    • https://letazofuwukuge.weebly.com/uploads/1/3/4/8/134869061/2963080.pdf
    • https://fitejajozifidom.weebly.com/uploads/1/3/0/7/130775998/xunape.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lorifumofelu/gipumoxusopezigarozowa.pdf
    • https://uploads.strikinglycdn.com/files/c97ec0a4-566e-4106-93dc-949fa9d6c779/22685221032.pdf
    • https://uploads.strikinglycdn.com/files/479c174f-5119-46eb-a5ea-156a3f08b2a3/76436076234.pdf
    • https://uploads.strikinglycdn.com/files/dfcff6db-fbe6-4044-9a7a-9afc23bf3936/99436951600.pdf
    • https://s3.amazonaws.com/jefobexapulow/guideline_value_for_land_in_chengalpattu.pdf
    • https://uploads.strikinglycdn.com/files/9974cf4b-7eb2-47d8-990c-7610852bd302/87617209392.pdf
    • https://uploads.strikinglycdn.com/files/aa154c5e-6d1a-4d6d-8fa3-81900feaa89c/jijusebobob.pdf
    • https://uploads.strikinglycdn.com/files/e0622b6e-c567-49b4-8c7d-8c994ff2462c/talk_to_me_in_korean_worksheets.pdf
    • https://s3.amazonaws.com/musoxifuvitalo/how_to_use_ifb_convection_microwave_for_baking.pdf
    • https://uploads.strikinglycdn.com/files/73acde08-5405-46c7-8d33-0138f07197c2/asus_p7p55d-e_pro.pdf
    • https://uploads.strikinglycdn.com/files/a91002ce-3eec-4847-8ef4-9d7c44c286cb/48894744302.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbbc.bin
ff97edce40234b4c2bfd8bfc780daf75de14d6a56149135bf38348175f5a534c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBBC 5200 bytes
font_01_sfnt_off0000ed4f.bin
62dbb351c96af6dabcb8d9d50508a52e04f2fde39a90d6bd4024604ddd236f77		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED4F 14320 bytes
font_02_sfnt_off00011b2c.bin
3da9309f7c28e01a20d15285b754fad9116e6eb7744d168a0fff2950d6122081		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B2C 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.