Malicious PDF — malware analysis report

Static analysis result for SHA-256 393bf41cb204c61a…

MALICIOUS

PDF

80.7 KB Created: 2021-03-25 21:08:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 931ff9db7e6a56943a68971cf0a45895 SHA-1: 37604daab244d1d41c1fe18293de60f2c7f21b91 SHA-256: 393bf41cb204c61ad57016d0d6c42039cdeccffa7dad74cb82ad43b6cd02ec73
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms or phishing campaigns. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a malicious intent to redirect users. The ClamAV detection and ML classifier also strongly indicate maliciousness, likely related to phishing or malware distribution via the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=wb+sc+st+obc+application+form+pdf
    • https://cdn-cms.f-static.net/uploads/4413564/normal_60589680d6c75.pdf
    • https://static.s123-cdn-static.com/uploads/4386094/normal_5ff85d251f72a.pdf
    • https://labimatejodo.weebly.com/uploads/1/3/2/3/132302966/dixufokodit_libixalewawoji_navadiko.pdf
    • https://lasomuvexovip.weebly.com/uploads/1/3/0/8/130813571/5d7e2933861.pdf
    • https://lefexaro.weebly.com/uploads/1/3/5/3/135324439/bumujigotikanovedodu.pdf
    • http://tejowigasinafu.getenjoyment.net/9986386435.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/155052b8-c607-4f72-af51-64f2ddbdd8b9/new_twilight_series_book_2020.pdf
    • https://uploads.strikinglycdn.com/files/864fcc04-9dd0-44ba-8017-d54fc3e9e256/what_does_the_snake_mean_on_the_dont_tread_on_me_flag.pdf
    • https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_eb8c90f33fa04e2280e4c7c945341aaf.pdf?index=true
    • https://4ad55601-b8ab-4ae0-bc0e-e90069072326.filesusr.com/ugd/3aca14_4e2b31d7409240309e9a11b4e8cbf90f.pdf?index=true
    • http://pavabiza.atwebpages.com/list_of_diagnostic_tests.pdf
    • http://lojubefogugiku.onlinewebshop.net/50979802213.pdf
    • https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_0c2ef948bd6d425693b1bae2dd5de144.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5006a36e-633c-43d6-8302-b55ad0edf1b5/77094373097.pdf
    • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_d62aa0eeaa4f4fd49ffd6c63f765bc08.pdf?index=true
    • http://donijexufenu.onlinewebshop.net/why_is_cronbach_alpha_important.pdf
    • https://eb72eaa1-ef55-40a3-a653-f6d21bccf295.filesusr.com/ugd/54913d_53ed76f7d3a446ba90895a25469e263c.pdf?index=true
    • https://ebcfae26-b4e4-4f1a-a5b2-c5bdbddc1bdf.filesusr.com/ugd/259f90_d2b8cbb56115404386842a17cd67590b.pdf?index=true
    • https://5a8aee2d-3d68-4c09-98ed-743c9c56d6fd.filesusr.com/ugd/460efe_b20037d24f4e4c679c6a1b8ea9b606b9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9c6.bin
52b7d0545f9b64828f76b60185d3a36bd5dd0fc7c37c6e381ef029139b775c50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9C6 5456 bytes
font_01_sfnt_off0000fc45.bin
dec69640eaa2b962e12f6faf83b88e613a9b4f3df0f769061e2698af58afc7df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC45 10416 bytes
font_02_sfnt_off00012009.bin
b6a6ca5d1ececf9b8f85cf34f243a5152d852bd6c46ff1fd844468d100e5349c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12009 16172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.