Malicious PDF — malware analysis report

Static analysis result for SHA-256 35df379ce0a3d460…

MALICIOUS

PDF

79.6 KB Created: 2021-03-31 15:46:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ac88d8354209fc1b54ef721377efcf70 SHA-1: 74917e5ca844cc91740cd3634bde6b088246b14d SHA-256: 35df379ce0a3d4604758eb906caf975c578d50be6fc7a1f21f7957fc819091f9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO spam or phishing campaigns. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, and the 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' firings confirm its malicious nature. The document body's content is garbled, but the presence of URLs suggests a redirection or download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=terraform+data+template_file+depends_on
    • http://jesiwufap.iblogger.org/korixelubisolefila.pdf
    • https://bapepewemeg.weebly.com/uploads/1/3/4/7/134702997/pipupug.pdf
    • https://momekefu.weebly.com/uploads/1/3/4/8/134850451/gumafojugadupopelu.pdf
    • https://dupomosukafe.weebly.com/uploads/1/3/5/3/135387566/kigubirisob_witobi_xedeverilexo_tuvuxozen.pdf
    • https://lojexidipiwakif.weebly.com/uploads/1/3/4/0/134041559/lisebulawepuw.pdf
    • https://jifosibupegexuv.weebly.com/uploads/1/3/4/6/134692258/bc66b4b1be8d87.pdf
    • https://rusokupos.weebly.com/uploads/1/3/4/4/134468665/8738e61.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vexosafugunu/wajapise.pdf
    • https://s3.amazonaws.com/lofese/36520017152.pdf
    • https://uploads.strikinglycdn.com/files/854f54fd-3c5e-464c-a821-1c11df91aa6d/blodgett_convection_oven_reviews.pdf
    • https://uploads.strikinglycdn.com/files/969b9174-04d8-4907-ae94-775bb3b3fdf4/gulubiwusufiwirewifolaga.pdf
    • https://uploads.strikinglycdn.com/files/53f976a5-d8bb-44bf-87b4-9bb941d213fd/68313418324.pdf
    • http://xixovunutev.epizy.com/mulobimu.pdf
    • https://uploads.strikinglycdn.com/files/13c56439-d648-46df-afcd-06a0ef2d1889/42142365698.pdf
    • http://kasupetaderimit.rf.gd/zoom_g5n_specs.pdf
    • https://uploads.strikinglycdn.com/files/3c903c71-1b2a-41fc-a522-f1670a715d73/the_art_and_science_of_leadership_7th_edition_free_download.pdf
    • https://s3.amazonaws.com/jolituzoji/gevetekejutag.pdf
    • https://uploads.strikinglycdn.com/files/f75f3a96-141c-449f-ac09-d15cdc611cbe/how_does_a_mechanical_pencil_sharpener_work.pdf
    • http://xegiseko.epizy.com/bufitajotize.pdf
    • https://uploads.strikinglycdn.com/files/ea70b509-7747-41a8-94a5-bd0c2d5457da/87198465311.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8d5.bin
b11600a647fb2e5d787d4f30144a9f83db36d9e37e1c3d3b9ca97d7461b6e436		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8D5 5164 bytes
font_01_sfnt_off00010a5c.bin
5e671ecad6a7af2e72e7657eace2e355fb38e0e522ff967df161b791ab1a57ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A5C 11412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.