Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e9d77046c68558e…

MALICIOUS

PDF

86.6 KB Created: 2021-06-01 03:24:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a76f18ad4baeaeaf5b7abd1c62033ec1 SHA-1: 70b2d6f8d1d63dc38f7238666ed9ba7504168388 SHA-256: 3e9d77046c68558e5a7bb7b29abcdbd1831d03daa83a263fea5f63b75403dcb1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, appears to be related to 'chemistry empirical formula questions', likely a lure to encourage clicks on the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/pbw?utm_term=class+11+chemistry+empirical+formula+questions
    • https://daxodewime.weebly.com/uploads/1/3/1/3/131398188/femixusutava-gabasavufe-geligire.pdf
    • https://wasafigazepez.weebly.com/uploads/1/3/4/5/134586721/pudoboxefafifugota.pdf
    • https://nitagupivef.weebly.com/uploads/1/3/4/3/134342099/zagakiw.pdf
    • https://wazexusevawixi.weebly.com/uploads/1/3/0/7/130776334/tugitofogonisapolu.pdf
    • https://xoxomupufolud.weebly.com/uploads/1/3/0/9/130969418/3875231.pdf
    • https://guvoxokogavi.weebly.com/uploads/1/3/4/3/134374443/67824b59.pdf
    • https://malosana.weebly.com/uploads/1/3/5/3/135323031/cd934ad707ff8.pdf
    • https://zojunakalej.weebly.com/uploads/1/3/2/6/132682915/tulabekogaginero.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zepupifob.pbworks.com/w/file/fetch/144426390/wevixinakoduruwapexegomi.pdf
    • http://nefusim.pbworks.com/f/how_to_write_joining_report_after_earned_leave.pdf
    • https://uploads.strikinglycdn.com/files/7edd0856-854e-4e28-b740-2433d72f9157/lixurerebonupimaribilup.pdf
    • https://uploads.strikinglycdn.com/files/835fe0e9-51cb-49b6-a7ce-3698add5411c/handwriting_analysis_personality_type.pdf
    • http://kolasotosexu.pbworks.com/w/file/fetch/144415746/free_presets_for_lightroom_pro_apk.pdf
    • http://xedidovetaw.pbworks.com/w/file/fetch/144428556/86181190102.pdf
    • http://tazijebep.pbworks.com/w/file/fetch/144419616/21294455551.pdf
    • https://uploads.strikinglycdn.com/files/5b70e506-18f7-4c17-a98b-bae1676c8cf5/a_orillas_del_rio_piedra_me_sente_y_llore_personajes_secundarios.pdf
    • http://natizasex.pbworks.com/f/multivariate_normal_distribution_mean_and_standard_deviation.pdf
    • https://uploads.strikinglycdn.com/files/9a5bf46e-10de-4123-8c0b-bef694c0a1df/79779931220.pdf
    • https://uploads.strikinglycdn.com/files/269ba42e-ab98-405d-90a3-6b9cd249aea5/89379170360.pdf
    • http://godekazonigi.pbworks.com/w/file/fetch/144431301/adobe_reader_install_for_windows_8.1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010394.bin
cfde17d0ddcc71579cbbd544420402c7d7f12e99cca4abe8bdf04bba451b3576		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10394 5440 bytes
font_01_sfnt_off000115fe.bin
b9337a6694f5537c2ec32e542615048ead58910d24e6544291902a2f5b63125a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115FE 12368 bytes
font_02_sfnt_off00013ecb.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13ECB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.