Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ebcca6a7e8fffae…

MALICIOUS

PDF

85.2 KB Created: 2021-03-24 03:31:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d742857b20bbbb1be7f569947a07864e SHA-1: 36cb047e1b0b0a781f7ee72e935e3eae34cab70f SHA-256: 3ebcca6a7e8fffaed842c9eda3e46bf8fdc4a118538fb72c73349ee07e5c884d
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm designed to improve search engine rankings, a common tactic for phishing or malware distribution. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may be instructing users to decrypt an archive, further indicating a malicious intent to bypass security measures. While no scripts were explicitly extracted, the presence of external URIs and the overall structure point towards a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=como+ser+un+latin+lover+descargar
    • http://mabay.fun/199935928076suw1.pdf
    • https://cdn-cms.f-static.net/uploads/4450724/normal_60111b5ac5fed.pdf
    • http://secureappeal.com/battle_chasers_legendary_weapons4xs80.pdf
    • https://cdn-cms.f-static.net/uploads/4501364/normal_60351c7722f5b.pdf
    • http://igme.site/how_does_glucose_affect_yeast_respirationlgfn3.pdf
    • https://cdn-cms.f-static.net/uploads/4453329/normal_604460ed552a6.pdf
    • http://winoorama.site/94193218098vd2ci.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pazerogasarinu/scallop_report_crystal_river.pdf
    • https://s3.amazonaws.com/loxopudizus/21745143746.pdf
    • https://s3.amazonaws.com/wupagivoz/atmos_vape_manual.pdf
    • https://ad858f6a-7bbb-416d-9365-e04d7986ed9b.filesusr.com/ugd/3c9ac1_db1d0d4d6be349f984a726745ab7c79d.pdf?index=true
    • http://wufajin.rf.gd/60104759536.pdf
    • http://pomewegipezu.rf.gd/sutalazavisinel.pdf
    • https://6632aaff-1fe9-4f1d-acb3-7d444e457837.filesusr.com/ugd/ce4b7c_f9570fd76b67473bbc8a934ceeef4ba8.pdf?index=true
    • http://savewimaxanuf.rf.gd/70869670085.pdf
    • https://fd7a53fe-11c1-4e60-83ad-ac1bb997268f.filesusr.com/ugd/5cf23b_49541f634dcb42a68dad270e61f10182.pdf?index=true
    • https://s3.amazonaws.com/rebesudanolo/catacombs_guided_tour_paris.pdf
    • http://duxurajixi.rf.gd/dawixevugexokitaxib.pdf
    • https://s3.amazonaws.com/pegozegi/purexegetukazusasowab.pdf
    • https://s3.amazonaws.com/gewuwasi/belt_meme_template.pdf
    • https://s3.amazonaws.com/sezewu/test_power_supply_without_pc.pdf
    • https://s3.amazonaws.com/dibedamoka/autodwg_to_dwg_converter_pro_2019.pdf
    • https://s3.amazonaws.com/tamobalasu/voruler.pdf
    • https://d4a58959-25bc-41ae-a48c-99f47e3c4711.filesusr.com/ugd/4dab1e_2ad7e47018cd4d14ba3e96678aabe295.pdf?index=true
    • https://aca292c6-a3ee-4c96-b4c9-db15c8eca1b9.filesusr.com/ugd/cd1d52_1b2d7f2c018e4a3098c2131f3e6d5be2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e852.bin
471525a192a7804a5cd24ad0beace6e09c68bb1be7d648ffcb408a936b91fad8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE852 4608 bytes
font_01_sfnt_off0000f865.bin
656aa485edf11e3a0039760c2bb645e4e09e5b37ee96fd2917f2c5ed84612b46		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF865 5224 bytes
font_02_sfnt_off00010a15.bin
8684621e2b68044f3fee6133ece8287415c609bb155b8a6b0c9a2fe85a546821		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A15 11564 bytes
font_03_sfnt_off00012fbb.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FBB 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.