Malicious PDF — malware analysis report

Static analysis result for SHA-256 3eba955a2e25bcd1…

MALICIOUS

PDF

84.5 KB Created: 2021-04-05 07:27:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 1fb77fc6959bd96a447fbb2dd64ae82b SHA-1: e37ac4f8af16e8acb773f7f35a352b37ed43bf86 SHA-256: 3eba955a2e25bcd103676b911b98b2657a2d778954ad0122b30385a0d0e28e86
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are designed to appear as legitimate document titles, indicating a link farm for SEO manipulation. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly suggests the document's purpose is to trick users into believing they are receiving a prize or parcel, a common advance-fee fraud tactic. The presence of external URIs and the ML classifier's high confidence score further support this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=slavery+and+social+death+amazon PDF link annotation
    • http://vugijow.iblogger.org/black_and_decker_jigsaw_blade_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/tuzevawu/gujihig/1016609456.pdfIn PDF document text
    • https://cdn.sqhk.co/tazuxalana/gtXibXv/red_ball_2019.pdfIn PDF document text
    • https://cdn.sqhk.co/xovepejegosi/gidjeKl/bosowoxud.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mojivikapeti/resumen_del_libro_un_grito_desesperado.pdfIn PDF document text
    • https://s3.amazonaws.com/loneminovu/33121110310.pdfIn PDF document text
    • http://mukukukeban.rf.gd/85574621155.pdfIn PDF document text
    • http://zujofogu.epizy.com/tilobign_amharic_music.pdfIn PDF document text
    • https://2a1457bb-a4d2-449b-8914-d784a503a6da.filesusr.com/ugd/c0fca2_a6365bee9d704801a41d80d50ff28286.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dovulavavo/canine_castration.pdfIn PDF document text
    • https://s3.amazonaws.com/liluvad/morse_4300_sewing_machine_manual.pdfIn PDF document text
    • https://f78a7b13-e75c-4ddc-9f3c-03cd83736f6c.filesusr.com/ugd/90c53f_eb354e833390445faadd62071ec1ada9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tibitexil/ranutifovu.pdfIn PDF document text
    • https://bf6af823-cb0d-4ee8-9d5b-4f0b1de5ed24.filesusr.com/ugd/9eb187_6ac6aff4dbd04f90b0723c0a8aa46a93.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xapota/82935944432.pdfIn PDF document text
    • https://ad177677-9664-42cd-9bf2-17a10eef6e1d.filesusr.com/ugd/f8915e_c20ab13b51d144d59a8095222d0736c6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wupixufekijax/bedtime_stories_for_adults_books.pdfIn PDF document text
    • https://s3.amazonaws.com/desenaz/we_look_forward_to_your_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/kukupunopedon/conair_hair_clippers_costco.pdfIn PDF document text
    • http://zixoridepub.rf.gd/aircraft_maintenance_manual_a380.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010aa3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA3 5492 bytes
SHA-256: d99861ed98b6058e286767199469012eea917f4f39d505cca3378c9ded7c5546
font_01_sfnt_off00011d38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D38 11568 bytes
SHA-256: d3f9ba5d9bc3ae5b63f73f4a9639f0fcb78357d7d9f78867d3b79861073627a5

Open this report in the interactive analyzer, or submit your own file for analysis.