Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ba330dcec4ace33…

MALICIOUS

PDF

66.6 KB Created: 2021-06-02 21:31:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55e07c0eb9355f11f394bedf39575b2f SHA-1: e3090e78a9cc8da104ba8af3ebbdc4ca830d8ac4 SHA-256: 3ba330dcec4ace33c104dcfc5199dbbd42857a3616b7fef29d6a9d0ca3b7e1e0
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for PDF_SEO_LINK_FARM, indicating a large number of external links, one of which is a suspicious URL related to a 'Windows 7 loader'. The SE_PASSWORD_ARCHIVE_LURE heuristic suggests the document is designed to trick users into downloading a password-protected archive, a common tactic to bypass security filters. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=windows+7+loader+by+daz+rar+password
    • https://cdn-cms.f-static.net/uploads/4379851/normal_606c07f30db27.pdf
    • https://topizamo.weebly.com/uploads/1/3/4/4/134435864/9677410.pdf
    • https://cdn-cms.f-static.net/uploads/4459641/normal_60b7c88f89f28.pdf
    • https://static.s123-cdn-static.com/uploads/4503035/normal_5fe5363e0d832.pdf
    • https://cdn-cms.f-static.net/uploads/4369915/normal_6025d0e783868.pdf
    • https://kujadivenudeku.weebly.com/uploads/1/3/5/3/135324903/3846799.pdf
    • https://cdn-cms.f-static.net/uploads/4454550/normal_603d2ba2d3a1e.pdf
    • https://jibogikufojubu.weebly.com/uploads/1/3/1/4/131438018/lazizulanumuguwikuna.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/29a729e6-8d5e-44ba-9fce-ed679742bbe0/12153014728.pdf
    • https://uploads.strikinglycdn.com/files/f45b5e1a-6209-451d-95c7-45e84f3faa6c/the_complete_paladins_handbook.pdf
    • https://uploads.strikinglycdn.com/files/3bceaa01-ad34-4221-b245-7c1128ff8da1/how_do_you_fix_a_gas_stove_that_wont_light.pdf
    • https://uploads.strikinglycdn.com/files/7fcacb03-429b-43ae-aeae-3a921b21737e/lurela.pdf
    • https://uploads.strikinglycdn.com/files/13b1e4c7-cf2d-4703-9d89-6e8bd3ee4b6a/what_does_drawing_on_the_right_side_of_the_brain_mean.pdf
    • https://uploads.strikinglycdn.com/files/e9239c64-9230-40ce-b26b-b615176c67ee/b.ed_cet_maharashtra_sample_question_papers_in_marathi.pdf
    • https://uploads.strikinglycdn.com/files/f60d6035-ee94-4137-b7c8-4bb6e03aa800/bobepiveguxufag.pdf
    • https://uploads.strikinglycdn.com/files/a42e6aaf-3fbd-4587-84d2-c58fa84b804b/el_mundo_de_sofia_pelicula_completa_en_espaol_hd.pdf
    • https://uploads.strikinglycdn.com/files/9726145d-c2a5-4c11-be5a-f07c703cc7e1/rakokusomi.pdf
    • https://uploads.strikinglycdn.com/files/886c3995-a240-482b-a1c3-65723728f4cd/korean_actors_and_actresses_latest_news_2020.pdf
    • https://uploads.strikinglycdn.com/files/174b71f4-e0b0-4b65-8357-04b51f83c21c/ademco_vista_48_manual_de_usuario.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e86e.bin
0851a7fa7fbf2f0cbae06e5af10df1218e10a8f056804c2d5d5f238f95ec096b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE86E 5428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.