Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c9599c3a38e7930…

MALICIOUS

PDF

81.0 KB Created: 2021-06-07 19:59:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fc89eafb84d016e1468a59219821d77e SHA-1: ecc2fd187187cc1d860d760185de5caa02f645f7 SHA-256: 3c9599c3a38e7930de7c5f701e8720d3302c835d9a25c4af34bc08448ae4b8d8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, with the primary malicious URL being https://irlanc.ru/pbw. This heuristic, combined with ClamAV and ML detections, strongly suggests a phishing or malware distribution attempt. No scripts were extracted, but the PDF structure itself facilitates the attack by directing users to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=ben+10+omniverse+2+apk+%252B+obb+download
    • https://fibakuguzisenib.weebly.com/uploads/1/3/4/5/134594550/2be08f31870.pdf
    • https://xodozevonewoze.weebly.com/uploads/1/3/1/3/131384462/zawafikunemubox.pdf
    • https://bometupipi.weebly.com/uploads/1/3/0/8/130874633/nazonaj.pdf
    • https://cdn-cms.f-static.net/uploads/4378852/normal_5fd869026f024.pdf
    • https://ladofozaser.weebly.com/uploads/1/3/4/3/134334290/46fd9d880.pdf
    • https://firerokuk.weebly.com/uploads/1/3/1/1/131164187/7669262.pdf
    • https://static.s123-cdn-static.com/uploads/4417040/normal_5fe1a4ea89f74.pdf
    • https://cdn-cms.f-static.net/uploads/4479435/normal_602de048bd4be.pdf
    • https://cdn-cms.f-static.net/uploads/4379485/normal_600d6343a685e.pdf
    • https://cdn-cms.f-static.net/uploads/4471109/normal_603390725dc46.pdf
    • https://static.s123-cdn-static-d.com/uploads/4388177/normal_60b1aa8bc5d81.pdf
    • https://cdn-cms.f-static.net/uploads/4366625/normal_603b178e2b33d.pdf
    • https://cdn-cms.f-static.net/uploads/4453719/normal_5fd66205bfb76.pdf
    • https://nubugudapo.weebly.com/uploads/1/3/2/8/132814946/786867.pdf
    • https://static.s123-cdn-static.com/uploads/4418970/normal_5ff1afb7803fa.pdf
    • https://fasosizive.weebly.com/uploads/1/3/4/3/134351581/ratigik_wiluzubod.pdf
    • https://cdn-cms.f-static.net/uploads/4468537/normal_6066ff1010f47.pdf
    • https://vadazexo.weebly.com/uploads/1/3/4/6/134646317/64052b9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/dc744e5d-d67f-4742-9e36-2b483bfa650e/komodo_dragon_special_adaptations.pdf
    • https://uploads.strikinglycdn.com/files/8d2eda37-e31b-459e-bb29-489e7dec799f/40545323830.pdf
    • https://uploads.strikinglycdn.com/files/f94075ab-06e0-499c-b1bf-b9ea23e37bb6/section_4_linear_equations_functions_and_inequalities_answer_key_algebra_nation.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e68a.bin
460e03f28ba9d793b123bfd61d3980d1f1e5c4747422dd8626d1255b5baa807c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE68A 5836 bytes
font_01_sfnt_off0000fa67.bin
7752695e51489c9f46abe10c6d6fdcf10ee9f6ca1d4a44173f35c594c221c425		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA67 11120 bytes
font_02_sfnt_off00012089.bin
aad9bc0f36eadc3314e08670b59090120051e308b357201f134af3d0b781b2b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12089 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.