Malicious PDF — malware analysis report

Static analysis result for SHA-256 340e0b534ac91df6…

MALICIOUS

PDF

89.6 KB Created: 2021-01-20 00:49:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 2b1a4b5444d085c372c6b99710477682 SHA-1: 23fbb7858c6e6ea5f7d9c694e96c04a7620407e9 SHA-256: 340e0b534ac91df630d9a253a455ec103c5335b76117e27553f7daaaf3e5ce6a
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.007 JavaScript

The PDF document contains a large number of external links, many of which are likely part of a link farm designed to improve search engine rankings. The heuristic 'SE_REMOTE_SUPPORT_LURE' indicates the document's content is designed to trick users into installing remote support tools. The presence of ClamAV detection and ML classification further supports its malicious nature, likely as a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=tekkit+lite+server+jar PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4367920/normal_5fed9e3cdbe6b.pdfIn PDF document text
    • https://sovanomi.weebly.com/uploads/1/3/5/3/135337195/wezupesip.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403121/normal_5fe8068916ce7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443344/normal_60036f9970a9e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dukavunivifa/asrb_ldc_syllabus_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/webipejonavuv/gov_of_canada_ei_reporting.pdfIn PDF document text
    • https://s3.amazonaws.com/mukutud/camus_selected_essays_and_notebooks.pdfIn PDF document text
    • https://s3.amazonaws.com/welutizenop/cooling_curve_definition_science.pdfIn PDF document text
    • https://s3.amazonaws.com/wanalovum/backup_whatsapp_android_su_icloud.pdfIn PDF document text
    • https://s3.amazonaws.com/xefejevife/bootstrap_3_table_template.pdfIn PDF document text
    • https://s3.amazonaws.com/patotale/mini_camera_sq11_hd_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/laradusa/gounod_ave_maria_piano_sheet_music.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010aa3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA3 4828 bytes
SHA-256: 74eb75a64ba11402f67b7d04cb97db362ed0df9a5681f02bc5a4cae4bcf5b9a9
font_01_sfnt_off00011b26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B26 12208 bytes
SHA-256: b7889e1f19e2194b7db89d18502216682eb10fe9398a05e1a3008add939560c6
font_02_sfnt_off000143e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143E4 16188 bytes
SHA-256: ac331ff209e496a545000daa6c22a418664ce8bb09dd9fd1314a38219ce2e6a2

Open this report in the interactive analyzer, or submit your own file for analysis.