Malicious PDF — malware analysis report

Static analysis result for SHA-256 41b91039bd05edde…

MALICIOUS

PDF

97.7 KB Created: 2021-05-22 12:27:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: a981ed11bcaae80140585e105794c440 SHA-1: cf5fff663295dbd55e0f753d0e53f76881899bb1 SHA-256: 41b91039bd05edde27d3176f2a747342169616aa0d6cb610901e259d21fdae96
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to other PDF documents, suggesting a link farm or a method to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' indicates a malicious intent, likely to trick users into downloading further malware or engaging in phishing activities. The embedded URLs are used to host or redirect to these potentially malicious documents.

Machine Learning

  • Nyx PDF Classifier clean score 0.0555

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=biodata+format+for+marriage+for+boy+in+marathi+word+file PDF link annotation
    • https://vonemiwez.weebly.com/uploads/1/3/0/7/130776812/vanebivojetajepuj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450047/normal_602539beacaa9.pdfIn PDF document text
    • https://xaroduzorosu.weebly.com/uploads/1/3/1/3/131398324/daxogadiz_wuwududezibes.pdfIn PDF document text
    • https://fafenerukore.weebly.com/uploads/1/3/1/3/131398145/044c4a2c86b3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420907/normal_5fd6545491cce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452863/normal_605a4973962f9.pdfIn PDF document text
    • https://vebavorosufate.weebly.com/uploads/1/3/4/7/134742301/lowumezata_japupegaxedi_xugiz_vaxazoxezow.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9cb1170-c655-43b3-af2f-2f8413dbd879/saxon_math_algebra_1_2_test_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/wupuxus/jobuwomumukevaligoguxuwo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01e1704d-d58e-4c5a-b3b6-00d011fd89a3/52623110140.pdfIn PDF document text
    • https://s3.amazonaws.com/warapagefasovi/emulator_ps1_untuk_ios.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44135da6-282a-4698-a167-26915278564b/85590861150.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4786f552-d7d2-4928-9aa9-852846d88bb2/two_long_parallel_wires_carry_currents_of_i1_3.00_a_and_i2_5.00_a.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f89ec8de-9458-4546-8fd3-68a9f283e8ff/rumewe.pdfIn PDF document text
    • https://s3.amazonaws.com/bidurudilidujug/87478270544.pdfIn PDF document text
    • https://s3.amazonaws.com/vexeliku/10803042165.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94a3bca8-4250-4493-8800-6c05c2e8f9e1/speed_queen_washer_cheapest.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5c17a6c-9da4-4288-9dfe-06e0bdfda9f6/zimesakamibosegusidisa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3027ccd0-5a9d-42b4-8cde-4af2ff3b37fe/how_to_write_a_conclusion_of_a_persuasive_essay.pdfIn PDF document text
    • https://s3.amazonaws.com/xovekolamoxe/how_to_sync_summer_infant_monitor.pdfIn PDF document text
    • https://s3.amazonaws.com/pazovugal/2290132842.pdfIn PDF document text
    • https://s3.amazonaws.com/batoragubukepo/sosesizaxorilogezimolo.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/tremco_acoustical_sealant.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/535d813b-26f0-47bb-9b7d-9969764b72e4/sedodogupudebivefusob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b105e16f-a253-488f-9904-5aca1599ad85/75928606159.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00015a78.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15A78 12624 bytes
SHA-256: a31042791a77f199e9816374e0a87a2c7908a79f5ff1a774beca71874c90b672
font_00_sfnt_off000120c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120C9 5524 bytes
SHA-256: 4d4e09659c9de1ece91a17bc414a2232eeef20723ed5c0bae88a69fc5bcbd32f
font_01_sfnt_off00013385.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13385 11308 bytes
SHA-256: c79bc07dd68cf487ce8720fe8056be68319a27678bbbe7c47192d8ce6cfdc6fc

Open this report in the interactive analyzer, or submit your own file for analysis.