Malicious PDF — malware analysis report

Static analysis result for SHA-256 46b95e04c99a8009…

MALICIOUS

PDF

83.6 KB Created: 2021-06-12 23:58:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aa9484649abe6a6b7d8d8dc53bf5b323 SHA-1: 03e2f3af449d31c1b191583c989dde7ac10fd1ec SHA-256: 46b95e04c99a80097cadb45638996af0f69516a86ef572f773ff77365e7a5272
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, which is a common tactic for SEO manipulation or directing users to malicious sites. ClamAV detection and ML classification strongly indicate malicious intent, likely phishing or malware distribution. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/pbw?utm_term=how+to+install+an+enb+skyrim
    • https://vewenaloviriwu.weebly.com/uploads/1/3/2/8/132816087/9555875.pdf
    • https://derixajulinam.weebly.com/uploads/1/3/4/3/134356287/7713852bb43d.pdf
    • https://wivexisi.weebly.com/uploads/1/3/1/0/131070498/1ced2e1e46b6b7.pdf
    • https://static.s123-cdn-static-d.com/uploads/4411691/normal_60b4599bc9cc2.pdf
    • https://cdn-cms.f-static.net/uploads/4421641/normal_603c44f9afa56.pdf
    • https://cdn-cms.f-static.net/uploads/4426541/normal_6046eb2d27571.pdf
    • https://cdn-cms.f-static.net/uploads/4367007/normal_6036762af2318.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zikasamu.pbworks.com/f/bodybuilding_training_program.pdf
    • https://uploads.strikinglycdn.com/files/5bb9d7b8-ba42-4bfa-85ed-ac1d2f687be3/85342570983.pdf
    • http://wekibivu.pbworks.com/w/file/fetch/145016562/71417377152.pdf
    • http://geviwesizar.pbworks.com/w/file/fetch/145050387/vofegolesazamav.pdf
    • https://uploads.strikinglycdn.com/files/a31c85b3-4f4c-4919-a130-26e7ee5425e0/course_20764_administering_a_sql_database_infrastructure.pdf
    • https://uploads.strikinglycdn.com/files/0443bcd2-3b9c-4dfc-b97e-dff424a75f5a/garuvupajoxomu.pdf
    • https://uploads.strikinglycdn.com/files/b2f36c0b-808c-4a68-9f7a-752134cfd181/altec_lansing_boom_jacket_2_charging.pdf
    • https://uploads.strikinglycdn.com/files/faeb976e-790a-44bb-8119-418130914652/tezogigevadozoxajatira.pdf
    • https://uploads.strikinglycdn.com/files/b9418285-9a4c-46b5-afa6-2507ef654e5f/19505997558.pdf
    • https://uploads.strikinglycdn.com/files/8365639e-0c99-4221-81a3-b6b48a657ad8/como_crear_un_archivo_xml_en_bloc_de_notas.pdf
    • https://uploads.strikinglycdn.com/files/08904448-e493-472f-b089-5216140afa5d/36492395718.pdf
    • https://uploads.strikinglycdn.com/files/ce95b7b0-30f4-4478-8396-f80b49276757/91232248186.pdf
    • https://uploads.strikinglycdn.com/files/72b2eb9f-38a4-43ec-92e5-2d1dd8b94cf5/bomomu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c48.bin
7d353bb1ac624492c933208ca1c49f26b9f4a8075a4f903ed9cff3e00d66cd71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C48 5188 bytes
font_01_sfnt_off00011deb.bin
fe38fad85a8f3d06f7159e887e61da0b6525ec479c8a716452c92c17a1d4a5b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DEB 10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.