Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e5b2abd9b65c00d…

MALICIOUS

PDF

78.9 KB Created: 2021-04-01 15:22:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 098dea3fbae335aea316a688dd58ce14 SHA-1: 14f3c912b7d4437b94885c6d7a6b93009e1d3c8d SHA-256: 3e5b2abd9b65c00dd6da6e884a8173298653ddb7c50babaa488cb34d34feb8e1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are disguised as legitimate resources like diet books or drivers. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, suggesting a phishing or malware distribution scheme. The presence of embedded URLs and the ML classifier's high confidence score further support a malicious classification. No scripts were extracted, but the overall structure points to a phishing or content-luring attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=the+two+week+diet+book+pdf
    • https://cdn.sqhk.co/bojowagawire/e1AIWjg/18206717472.pdf
    • https://cdn.sqhk.co/joninopi/cMifgjS/masonite_sheets_for_sale.pdf
    • https://cdn.sqhk.co/nexetifosam/hd5MiiG/island_experiment_game_play_online.pdf
    • https://cdn.sqhk.co/kolazapikib/hhTiabs/knighthood_lost_sands_riddle_hunter_of_astellan.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4d518e49-c816-4cf9-b489-c15122520603/hp_deskjet_6540_driver_for_windows_10.pdf
    • https://s3.amazonaws.com/zerepuzuze/gabapif.pdf
    • https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_1995805c02374abbba57f425a493b620.pdf?index=true
    • https://s3.amazonaws.com/davolazupivowi/google_data_studio_conditional_formatting.pdf
    • https://s3.amazonaws.com/lunojol/xuwubibutifijo.pdf
    • https://s3.amazonaws.com/gisujubolidine/60068973559.pdf
    • https://uploads.strikinglycdn.com/files/f09c168f-1602-4922-bbe2-2434fa34b3e8/safety_glasses_over_glasses_3m.pdf
    • https://s3.amazonaws.com/dosipive/gujorawigazijuzetafowata.pdf
    • https://uploads.strikinglycdn.com/files/51dcb37f-ca58-4845-bee0-faa341079b70/taxasosujiza.pdf
    • https://uploads.strikinglycdn.com/files/135ffda9-a6f6-49e1-84a9-dd4d7412e50e/how_do_you_cite_a_person_in_an_essay.pdf
    • https://07f52280-50dc-49c2-beec-a2e30bf849d0.filesusr.com/ugd/7b8f90_29f1196602b0473ea3e384e9c3d712f1.pdf?index=true
    • https://s3.amazonaws.com/kudowo/how_much_does_navy_pay_for_college.pdf
    • https://s3.amazonaws.com/xoguwavosuje/joolz_pram_sheets.pdf
    • https://uploads.strikinglycdn.com/files/69e8caa6-9511-46c3-9fa9-f9bab301a2a6/wadojokuzu.pdf
    • https://s3.amazonaws.com/jolunenafobuw/austria_schengen_visa_application_form.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9d6.bin
e0f2da8f05d8835c00cc2b59309772b0e55b69e4cbef2c28eecccf78195a6d75		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D6 4856 bytes
font_01_sfnt_off00010a6a.bin
19493913e9b241a0f7ecbb47322b3565ddc62c656f9e91b8500d00d5f9db32a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A6A 10720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.