Malicious PDF — malware analysis report

Static analysis result for SHA-256 4517ce8c9002f78f…

MALICIOUS

PDF

80.4 KB Created: 2021-03-24 04:47:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dfd8d81e2318a4e7a4f28189acc8d4fa SHA-1: 654b94fe88843162941314ae52eefa02bcefa80c SHA-256: 4517ce8c9002f78fa6769ff28ab23a103bfb267788907dde2233da09cf809b09
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to redirect users. The ClamAV detection and ML classifier strongly indicate maliciousness. While no scripts were directly extracted, the PDF structure and embedded URLs point towards a phishing or SEO manipulation scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=google+maps+street+view+change+year+iphone
    • https://jukonejidar.weebly.com/uploads/1/3/4/8/134876273/pilomob-laranivez-fakamebatav-zisamibubuso.pdf
    • https://cdn.sqhk.co/fofateze/agiJyie/ribiturafa.pdf
    • https://wekuvakeg.weebly.com/uploads/1/3/4/3/134397775/5715409.pdf
    • https://dowamodugepaxa.weebly.com/uploads/1/3/0/7/130739159/torusowosukewoz.pdf
    • https://buseziji.weebly.com/uploads/1/3/1/3/131398529/sasumamux.pdf
    • https://cdn.sqhk.co/defisepeniba/bjgidMN/monkey_king_cast.pdf
    • https://diwamelebo.weebly.com/uploads/1/3/4/1/134108813/8728078.pdf
    • https://cdn.sqhk.co/jerowerar/4ghjjaC/duvidiwubaterevenazuler.pdf
    • https://cdn.sqhk.co/baluwofuk/oqgjggi/uncertainty_avoidance_index_china.pdf
    • https://pudasebedizut.weebly.com/uploads/1/3/4/5/134587980/bogedutujunabipad.pdf
    • https://weduparazibad.weebly.com/uploads/1/3/4/7/134710999/a702a261b9a4268.pdf
    • https://silixumofabu.weebly.com/uploads/1/3/2/7/132712413/notipibuvigoxo_repozejigibo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/e9fc8604-8455-4594-8d45-fd117fa56d70/the_shining_cast_1980.pdf
    • https://uploads.strikinglycdn.com/files/2b37f4a6-09f3-4e83-bfe8-206f331cfe86/minimimig.pdf
    • https://uploads.strikinglycdn.com/files/97c1ac9d-fdf1-4faf-9abd-9f5023380360/meximagabaxikaxete.pdf
    • https://uploads.strikinglycdn.com/files/13c0b243-7dc3-4331-a42e-8e020e735f55/mazedupozaxovixeg.pdf
    • https://uploads.strikinglycdn.com/files/98c4897c-2b55-453d-a974-c5200aa6e9e0/coleman_mobile_home_furnace_model_7656.pdf
    • https://s3.amazonaws.com/wupuxus/android_os_versions_list.pdf
    • https://uploads.strikinglycdn.com/files/f0d08396-5c78-434c-bf31-3e057b681ea4/todap.pdf
    • https://uploads.strikinglycdn.com/files/482d8745-7ac2-432b-a1bc-fe58f563926f/tapenikanejoraderid.pdf
    • https://s3.amazonaws.com/gajabedafot/23528494437.pdf
    • https://uploads.strikinglycdn.com/files/dfb69c5d-ab6f-467e-9691-889c0b44218a/wabutafolo.pdf
    • https://uploads.strikinglycdn.com/files/14af4876-f375-44de-b5c2-480d0d48b7f2/dozugo.pdf
    • https://s3.amazonaws.com/wufujudisu/magisterium_book_5_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eecf.bin
68c8b91a8225aea2c8cd0db75c5fd1009f68648aa5445bab436e405a2488c2c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEECF 5420 bytes
font_01_sfnt_off00010132.bin
dfe25bf04ebad0c4c1e82284323689fc83a75a94e104a7e0c6f74fa6947f98ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10132 10752 bytes
font_02_sfnt_off000125bb.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125BB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.