Malicious PDF — malware analysis report

Static analysis result for SHA-256 37e9526ce5ae223c…

MALICIOUS

PDF

75.3 KB Created: 2021-06-08 20:42:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 158985798e90d7bc754c0395ca5d1fbc SHA-1: ca720976ebd81e97331e51e9025fd6f3a0fe8269 SHA-256: 37e9526ce5ae223c455fe3dadcdb475b3c4a98a15b175012d3e8ee31f72b0fd4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ClamAV and an ML classifier, with multiple heuristics indicating it is a link farm designed to redirect users to external sites. The PDF contains numerous external URIs, including a primary URL pointing to a potential phishing or malware download page. While no scripts were explicitly extracted, the PDF structure and the presence of external links suggest an attempt to lead the user to a malicious resource, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=naruto+the+last+fixed+apk
    • https://guxuxudisulazo.weebly.com/uploads/1/3/7/5/137504262/puminamizuwox.pdf
    • https://gisidamuxifa.weebly.com/uploads/1/3/0/7/130775495/4796400.pdf
    • https://vudexugir.weebly.com/uploads/1/3/2/7/132710723/1518775.pdf
    • https://xudowiwigikit.weebly.com/uploads/1/3/4/4/134462868/6410597.pdf
    • https://gevabebixufusaf.weebly.com/uploads/1/3/4/6/134689319/zimen.pdf
    • https://vumevomuw.weebly.com/uploads/1/3/4/3/134335884/6914752.pdf
    • https://menuvudojowakap.weebly.com/uploads/1/3/4/5/134594867/bowusimomenul.pdf
    • https://mofafodoler.weebly.com/uploads/1/3/0/8/130874416/e8e127706c5ca.pdf
    • https://turumokapitaka.weebly.com/uploads/1/3/4/6/134613572/metowijilozego-bovoteze-lokurasejepobu.pdf
    • https://somusepuxe.weebly.com/uploads/1/3/1/0/131070447/jeredogolapi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kiletejude.pbworks.com/w/file/fetch/144425679/firurugejalim.pdf
    • http://rimogeto.pbworks.com/w/file/fetch/144427779/33285906033.pdf
    • http://wojipag.pbworks.com/f/zekokiriloxoribizakix.pdf
    • https://uploads.strikinglycdn.com/files/6643f373-4df9-465d-9799-b1b7605ead40/how_to_use_exercise_rubber_bands.pdf
    • http://jadubunid.pbworks.com/f/43010617378.pdf
    • https://uploads.strikinglycdn.com/files/bace2758-2d67-4f1e-ba76-ad1e9762a16b/fexufujoluzilagon.pdf
    • https://uploads.strikinglycdn.com/files/d1f0cc71-c2e5-4ccf-8642-e51bee4065d9/makers_mark_grill_cleaner.pdf
    • https://uploads.strikinglycdn.com/files/941a5cce-09d4-4000-9619-59babe10d366/63713643269.pdf
    • https://uploads.strikinglycdn.com/files/dd14ac51-866b-4716-b5f9-17d6b7023ec0/zedapajoxalokub.pdf
    • https://uploads.strikinglycdn.com/files/bb34e02d-63a4-4b90-8bab-d46122e5cf5d/85545336929.pdf
    • https://uploads.strikinglycdn.com/files/500373e6-ee80-407d-82fa-70f8e30f859e/fewewu.pdf
    • https://uploads.strikinglycdn.com/files/195dbfa9-4afc-4507-b0f9-fb01220739f6/60844654726.pdf
    • https://uploads.strikinglycdn.com/files/c80d9aee-229f-40ef-9e49-adde9ffca055/kovitivawalujozujuxubez.pdf
    • https://uploads.strikinglycdn.com/files/28d63e0d-6f98-46d2-824b-947b9c9603c5/polk_audio_3000_subwoofer_not_working.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e795.bin
4e01c8578fe0005ac2ef7309a4d37dbe6222f0345d87a875e9885ba9c722a8e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE795 5232 bytes
font_01_sfnt_off0000f965.bin
e3694aa50acdf76a58c38fd9f6bbb8cf34333f422d228cacafd885cdffbbcd1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF965 11536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.