Malicious PDF — malware analysis report

Static analysis result for SHA-256 48959b03de1007c8…

MALICIOUS

PDF

71.7 KB Created: 2021-06-01 11:36:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bd7c999f258e1ece69eb2719ea94195e SHA-1: 80e9469dd2d7909ddcad70db70378c4729f337c5 SHA-256: 48959b03de1007c80dd523b86f63de8f181c961c60b88b196312be2331e7307c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics and an ML classifier, specifically flagged as a phishing trojan. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, https://philabc.ru/pbw?utm_term=veneer+used+negative+command, is likely a lure to a malicious site or further download. No scripts were extracted, but the PDF structure itself is indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/pbw?utm_term=veneer+used+negative+command
    • https://vozutububedem.weebly.com/uploads/1/3/4/3/134372478/ef89147e.pdf
    • https://static.s123-cdn-static.com/uploads/4390999/normal_5fddaa73ef44f.pdf
    • https://kobuwejen.weebly.com/uploads/1/3/0/8/130873730/dipovojawipodelur.pdf
    • https://static.s123-cdn-static.com/uploads/4379489/normal_5ff23053889d9.pdf
    • https://zarokosa.weebly.com/uploads/1/3/5/3/135300057/df2adb4ec.pdf
    • https://static.s123-cdn-static.com/uploads/4382429/normal_5ffd5a2e9ebb8.pdf
    • https://vadugoza.weebly.com/uploads/1/3/4/5/134599956/1975239.pdf
    • https://xovesoxak.weebly.com/uploads/1/3/0/8/130813458/264149.pdf
    • https://rorefogalo.weebly.com/uploads/1/3/0/7/130776605/7602806.pdf
    • https://bevowodawalejap.weebly.com/uploads/1/3/4/3/134363876/vexoxepu.pdf
    • https://lonamoki.weebly.com/uploads/1/3/5/9/135964194/24c3bfc07ec8.pdf
    • https://gunosevibo.weebly.com/uploads/1/3/4/7/134716368/4985995.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ee8585b4-a06b-4a7b-b6b7-32b98627950f/wabitisodejeselavo.pdf
    • http://mefijunov.pbworks.com/f/53181496414.pdf
    • http://sizolasipape.pbworks.com/f/42246010898.pdf
    • https://uploads.strikinglycdn.com/files/99f0bf25-7813-4fd1-9ab7-4a04a5bb2c13/porolanutosi.pdf
    • https://uploads.strikinglycdn.com/files/762f3855-1d50-4c79-b883-f69dfd0d0a24/a_christmas_carol_play_by_charles_dickens.pdf
    • http://lekipirunezi.pbworks.com/f/my_boy_emulator_apk_ios.pdf
    • https://uploads.strikinglycdn.com/files/23bacd57-3a5c-4b80-be46-62c23debd8f2/najawa.pdf
    • https://uploads.strikinglycdn.com/files/f7544e50-625e-4d00-b9db-8dfe31295c61/siraras.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbf7.bin
9208a691794d999acf47c976e258b5b608d4c31db4978a11529d30faf1bc9ced		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBF7 5252 bytes
font_01_sfnt_off0000edcc.bin
ccb2aafad0927c07aa842999b1dae05a02a8b72568e9cc93c2ca164d5415d2d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDCC 10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.