Malicious PDF — malware analysis report

Static analysis result for SHA-256 35cb2b4824f6762c…

MALICIOUS

PDF

74.2 KB Created: 2021-05-24 04:53:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb8dba923efa0e479921312b4ba2df0c SHA-1: b16fef2b1e4c3aed94dada57405fd615fe6d7448 SHA-256: 35cb2b4824f6762c61cb35f750026a0f8966f9fa06748b897539810154b1b694
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains a large number of external links, suggesting it may be part of a link farm or used to distribute further payloads. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest an attempt to manipulate search engine results or redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=mods+para+minecraft+pe+1.16+pc
    • https://vusipesokos.weebly.com/uploads/1/3/4/5/134585271/a22963.pdf
    • https://sanijala.weebly.com/uploads/1/3/4/8/134889677/pofokinatin.pdf
    • https://lelamibi.weebly.com/uploads/1/3/0/7/130738841/a1a55048.pdf
    • https://cdn-cms.f-static.net/uploads/4369904/normal_6068c9395bb79.pdf
    • https://cdn-cms.f-static.net/uploads/4369150/normal_60679e82cbf58.pdf
    • https://popivuzumozula.weebly.com/uploads/1/3/4/5/134500063/rilixex.pdf
    • https://wivilunox.weebly.com/uploads/1/3/1/4/131453894/7747924.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xovekolamoxe/19438172614.pdf
    • https://s3.amazonaws.com/donukadizolin/95884748506.pdf
    • https://s3.amazonaws.com/dozore/sabibebudo.pdf
    • https://s3.amazonaws.com/belopudevuzuza/miller_xmt_304_cc_cv_mig_setup.pdf
    • https://uploads.strikinglycdn.com/files/36694d58-4ed4-49df-a96a-5ead0dda05db/besul.pdf
    • https://s3.amazonaws.com/wulotugadag/sexowerenebu.pdf
    • https://uploads.strikinglycdn.com/files/69ea9ec1-6e46-4075-aac9-3ac13f763295/cuisinart_2_quart_ice_cream_maker_reviews.pdf
    • https://uploads.strikinglycdn.com/files/cedf2b7a-25c2-48eb-8f35-c53440441014/75249908244.pdf
    • https://s3.amazonaws.com/vipuxafol/what_is_place_in_geography.pdf
    • https://uploads.strikinglycdn.com/files/89f42de9-9511-4103-a832-3b507d47b963/2600026492.pdf
    • https://s3.amazonaws.com/muvemasoxaji/22716179004.pdf
    • https://uploads.strikinglycdn.com/files/c268a86a-508a-48af-aa9a-ee99c4263e31/sex_education_3_temporada_netflix.pdf
    • https://s3.amazonaws.com/tonemakopinibem/75539317269.pdf
    • https://uploads.strikinglycdn.com/files/8c579c49-6b55-4ed9-a033-e126dc68d3a6/felatikorakilagabu.pdf
    • https://s3.amazonaws.com/pibajuwi/62355097278.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3c2.bin
318931b5f274cd0bc6a95123461a528b23f3cdb9344a3367000a0af1eec8df9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3C2 5512 bytes
font_01_sfnt_off0000f683.bin
99c3a434cea845e1135385e892c69adc741a698fed798e100fbdb05432dda0e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF683 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.