Malicious PDF — malware analysis report

Static analysis result for SHA-256 476b8c72bd47eccb…

MALICIOUS

PDF

76.3 KB Created: 2021-03-23 05:06:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cdb0983ee0b7bf5c632cc3af15478a3f SHA-1: 6db91f937890d01a7481653ef339f4ecf4fc7496 SHA-256: 476b8c72bd47eccb3d2926e6bebc7ab4e3981cb73625b2a0403a9060e20bfc49
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a link farm and has been flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a site that appears to be a lure, disguised as a PDF related to decision making. While no scripts were explicitly extracted, the PDF structure and URL suggest an attempt to redirect the user to a malicious site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9524

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=decision+making+and+problem+solving+pdf+ias
    • https://lobovalosidim.weebly.com/uploads/1/3/1/4/131437181/kilomirixegisaresu.pdf
    • https://vobudogekatobef.weebly.com/uploads/1/3/0/8/130874620/wenawuwi-vanonogekusogen-dozibonosu-gadezepokin.pdf
    • https://furamakivagoj.weebly.com/uploads/1/3/0/8/130814247/4751074.pdf
    • https://besajiti.weebly.com/uploads/1/3/1/8/131856076/japexewuvupo_kuvezuxev_gemuregivu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mawabubobiniz.rf.gd/83975417396.pdf
    • https://s3.amazonaws.com/kizugokofo/toyota_camry_seat_covers_walmart.pdf
    • https://s3.amazonaws.com/lemefofutomapox/android_auto_mazda_cx3_2017.pdf
    • https://s3.amazonaws.com/setaxilitozuko/lapilopataleto.pdf
    • http://puwomuf.rf.gd/bose_qc35_ii_firmware.pdf
    • https://s3.amazonaws.com/wakuzidi/dark_souls_3_dlc_walkthrough.pdf
    • https://uploads.strikinglycdn.com/files/30c70ab1-b946-4b41-8672-588ba9fed3a9/how_to_test_gm_oil_pressure_sensor.pdf
    • https://s3.amazonaws.com/dazinibonofobi/best_family_calendar_app_for_android.pdf
    • https://s3.amazonaws.com/midipes/xezegatupedosemapetirap.pdf
    • https://uploads.strikinglycdn.com/files/82624297-566c-437f-8c20-0ba79651b9fd/zapixusupik.pdf
    • https://s3.amazonaws.com/gadumagabusodel/manual_qa_analyst_jobs_near_me.pdf
    • http://xakarukuneki.rf.gd/kozukikosefuvi.pdf
    • http://natunolujekusi.epizy.com/ruzukojegexani.pdf
    • https://s3.amazonaws.com/fefurorobumi/scienze_degli_studi_umanistici_e_della_formazione.pdf
    • https://uploads.strikinglycdn.com/files/0791b1c0-6857-4262-9297-e84a3b8efead/what_are_the_trending_songs_right_now.pdf
    • https://s3.amazonaws.com/foneniz/avadh_university_ma_private_form_online.pdf
    • https://uploads.strikinglycdn.com/files/bb9a43f8-2171-4cdb-bed6-93bee086d3d0/tone_of_poem_if_i_were_lord_of_tartary.pdf
    • https://s3.amazonaws.com/jajuzasalikirut/ap_biology_chapter_24_easy_notecards.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ffe2.bin
6987b17b8c171ff58ad74421a2643466b8abe32284664ac911d6fcf103d958ef
pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE2 5736 bytes