Malicious PDF — malware analysis report

Static analysis result for SHA-256 3951b54848a464eb…

MALICIOUS

PDF

70.6 KB Created: 2021-06-03 05:52:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 48ebf42ac736612126f3b2584ad49b56 SHA-1: 9c1cb969070abc5a3ddcabc68f7dc4493b77eae2 SHA-256: 3951b54848a464eb8210a30ac6494d4715295227a1f646361b2eac12266ab93d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a mass external link farm, with one prominent URL pointing to a suspicious domain. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or distributing further malware. The document's content, though obfuscated, suggests a lure related to 'Ashburn farm association'. No scripts were extracted, but the PDF structure itself facilitates the malicious linking.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=ashburn+farm+association
    • https://cdn-cms.f-static.net/uploads/4459324/normal_600e5a11912c2.pdf
    • https://gugebizibepowe.weebly.com/uploads/1/3/4/3/134364706/ae06aca972.pdf
    • https://cdn-cms.f-static.net/uploads/4420239/normal_5fd5f02a4a318.pdf
    • https://wasexakenisopi.weebly.com/uploads/1/3/5/9/135982815/lofavebebivulaga.pdf
    • https://fukagopesuzidad.weebly.com/uploads/1/3/1/3/131381553/1726936.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wudiwiligis.pbworks.com/f/95816367546.pdf
    • https://uploads.strikinglycdn.com/files/34b4b564-7e57-4c4c-9942-bc2b85d74622/the_art_of_kissing_1936.pdf
    • http://lagawiwefe.pbworks.com/w/file/fetch/144529698/27063257770.pdf
    • http://gudotoxej.pbworks.com/f/mijumutewobojinakejupeso.pdf
    • https://uploads.strikinglycdn.com/files/d90c3390-7bb5-4e84-898b-824dd3057987/nosidix.pdf
    • https://uploads.strikinglycdn.com/files/b9da4592-cc52-4498-b9c4-fb05f68b1e27/what_games_can_acer_aspire_e15_run.pdf
    • https://uploads.strikinglycdn.com/files/f0a2121f-5e4e-47e7-9a74-c1c36ab864e0/resolucion_de_ecuaciones_de_primer_grado_con_denominadores_compuestos.pdf
    • http://noxiwako.pbworks.com/w/file/fetch/144525222/2.pdf
    • https://uploads.strikinglycdn.com/files/ce5bd34e-6555-4898-b852-4a341fcf2987/dark_souls_2_scholar_of_the_first_sin_bosses_in_order.pdf
    • https://uploads.strikinglycdn.com/files/c741afb5-5d5f-46e1-b7ab-53447885f6b9/82420740691.pdf
    • https://uploads.strikinglycdn.com/files/de252114-2e05-424c-8f43-06d59d7a8a6c/werenagonupav.pdf
    • https://uploads.strikinglycdn.com/files/007c9e9e-f2c1-4a1f-a51e-b0f4208b230b/aamc_practice_test_1_score_conversion.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d540.bin
38680ceb2495c6d87936efd95bbae2d25c06de930a7f79e46f15802e5d99186e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD540 5220 bytes
font_01_sfnt_off0000e6da.bin
c53df23c09e5919f72de077baaa806aa346a2917b5172e8d3369a5e06aef6c06		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6DA 10964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.