Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b5b2973df7940c9…

MALICIOUS

PDF

74.9 KB Created: 2021-03-11 22:18:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb82e901d63572061d928b41c85e62bb SHA-1: d49d26e0a15d952d63f724c1e819239c61b2ffbe SHA-256: 3b5b2973df7940c96baacad04b11b75ac9216a0fbf9248ce34c4fe6342a901b9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, indicating it is part of an SEO link farm designed to drive traffic to various websites. The ClamAV detection and ML classifier strongly suggest malicious intent, likely for phishing or distributing further malware. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=modelo+canvas+pdf+en+blanco
    • https://dokerawu.weebly.com/uploads/1/3/4/3/134313580/a5ce2.pdf
    • https://vuxupiwiruxip.weebly.com/uploads/1/3/0/9/130969000/017a7.pdf
    • https://todilotifobaw.weebly.com/uploads/1/3/2/7/132712516/zabasaj.pdf
    • https://cdn.sqhk.co/lukedivibeb/vDjdgc3/past_participle_spanish_future_perfect.pdf
    • https://kupuluxipopanan.weebly.com/uploads/1/3/3/9/133999353/xugexivumipebukutumo.pdf
    • https://cdn-cms.f-static.net/uploads/4377377/normal_6040796c0fcf4.pdf
    • https://cdn-cms.f-static.net/uploads/4403822/normal_6029b1ec83114.pdf
    • https://nopiwevupemaro.weebly.com/uploads/1/3/4/6/134653234/5a8a78cc14.pdf
    • https://cdn.sqhk.co/melipetoluf/ihmBLhe/download_rally_racing_evo_mod_apk.pdf
    • https://lufuneliza.weebly.com/uploads/1/3/2/6/132682735/gibixebodako.pdf
    • https://barijenevedi.weebly.com/uploads/1/3/1/4/131438420/muzawab.pdf
    • https://cdn.sqhk.co/porosobof/lhi6Axd/degudepeg.pdf
    • https://cdn.sqhk.co/gimexigerub/hjMjchS/amazon_music_app_crashing_2020.pdf
    • https://cdn.sqhk.co/jumupebuvi/jTyOjc4/does_not_commute_premium_mod_apk.pdf
    • https://cdn.sqhk.co/nukunudakiju/Cjd6XpN/79652854169.pdf
    • https://cdn.sqhk.co/giwumazusew/hiljchh/old_snake_toy.pdf
    • https://cdn.sqhk.co/motanunika/idjdjaC/34316972166.pdf
    • https://static.s123-cdn-static.com/uploads/4381104/normal_5fdeb89883a27.pdf
    • https://cdn.sqhk.co/ketalidukepi/gcie4gh/didanajuvotibin.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5457524e-bace-410a-9ce7-c8d8bc0eedea.filesusr.com/ugd/f0ffd0_a1cf27130c574641a42fbe7b6d9e3dcc.pdf?index=true
    • https://e924225a-aa46-4bfc-8e56-7341551e1833.filesusr.com/ugd/54dfea_6ffd376a25bc4f81b139628a27c612c9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e97c.bin
b088e74b91598ea85518b1d2cc95c72367faf9cafd1136f55740a8270bcd8eb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE97C 5256 bytes
font_01_sfnt_off0000fb82.bin
7439fa716731fe50633c3dd51236609be0ca87df20463aaa3f6eca5f81366618		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB82 10288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.