Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a8423257387e965…

MALICIOUS

PDF

79.6 KB Created: 2021-03-14 13:25:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5b953422a5b66829ab79eb4e94a7f3a SHA-1: dff4a56da2422121afc0031c6d5548180d2bd9db SHA-256: 3a8423257387e9658965f4f7a7c729c9951ecd2607d1cee56dea83a6c4d8b0b2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a large number of external links, characteristic of a link farm or SEO spam, with one prominent URL being https://maypoin.ru/wix?keyword=is+salt+a+nonrenewable+resource. The document body, though heavily obfuscated, appears to be related to the search query "is salt a nonrenewable resource", suggesting a phishing or SEO manipulation tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=is+salt+a+nonrenewable+resource
    • https://xevibobi.weebly.com/uploads/1/3/4/6/134683071/resotaloze.pdf
    • https://kilizilefepik.weebly.com/uploads/1/3/0/7/130775254/0b9e7dc815a.pdf
    • https://nazisedisan.weebly.com/uploads/1/3/1/8/131871674/336c48988154f4b.pdf
    • http://fb-ig-violation.com/pufanorarifr3wdp.pdf
    • https://cdn.sqhk.co/gafisasiwu/hb7jboC/survival_man_vs_wild_island_escape_mod.pdf
    • https://cdn.sqhk.co/vemoderama/ehjdhbc/73920392752.pdf
    • https://napokepuwaju.weebly.com/uploads/1/3/1/1/131164128/2563863.pdf
    • https://lipemegovaw.weebly.com/uploads/1/3/4/7/134766771/lumorok.pdf
    • https://powotatetodo.weebly.com/uploads/1/3/0/7/130738650/zuzidase.pdf
    • https://fotelosalif.weebly.com/uploads/1/3/4/4/134463398/petudokogejosonuki.pdf
    • https://xomadugazulu.weebly.com/uploads/1/3/4/5/134597447/tabikuroti_xulopu.pdf
    • http://complect-tech.ru/543662712529u5ys.pdf
    • https://tezifotunojoke.weebly.com/uploads/1/3/0/7/130776805/09e1ca.pdf
    • https://cdn.sqhk.co/falupuvevore/gjgDjxr/best_mountain_bike_pedals_and_shoes.pdf
    • http://hellochildren.online/jijadulitivimuzzdx5r.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/ropidadegaxut/invisible_man_kevin_bacon_cast.pdf
    • https://s3.amazonaws.com/mexijegedakol/80651662747.pdf
    • https://s3.amazonaws.com/sorogamat/aavesham_movie_telugu_songs.pdf
    • https://s3.amazonaws.com/petuzutemixuvod/wosig.pdf
    • https://s3.amazonaws.com/libeganot/if_activesheet._protect_true_then.pdf
    • https://s3.amazonaws.com/rijaliwiguvex/mathematics_syllabus_for_waec_2019.pdf
    • https://s3.amazonaws.com/legipalofi/13599145329.pdf
    • https://s3.amazonaws.com/dozore/91587241922.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbb2.bin
7ad7525d3d1df2f90486deef86e0201e7766a13384961ae07acb913a2e48f77c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBB2 4960 bytes
font_01_sfnt_off00010cb4.bin
b432f8ad221be7abc7bdb7f6431560f6a4464b804996643d3ec0953e4c984189		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CB4 10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.