Malicious PDF — malware analysis report

Static analysis result for SHA-256 49835067ab1f018c…

MALICIOUS

PDF

122.7 KB Created: 2021-04-27 06:23:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: f8133b9054a68791e2485c848d3ee90b SHA-1: 037a610ea58cbda3ce2e7e3ef9f7e781beda6aa3 SHA-256: 49835067ab1f018cc935298b99ea00eff7b102f9de4f233061fa6164c831bd06
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a link farm. One of the primary links, 'https://pelibifir.ru/strik?utm_term=what+are+the+different+theories+of+truth', suggests a potential phishing or malicious redirection attempt. The ClamAV detection and ML classifier further indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=what+are+the+different+theories+of+truth PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4467036/normal_5fd2ae407689e.pdfIn PDF document text
    • https://pudogujapoveg.weebly.com/uploads/1/3/6/0/136090910/geborewulum-zoworazin-patalajafa-fekomug.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4375509/normal_5ff116f358869.pdfIn PDF document text
    • https://tumipipap.weebly.com/uploads/1/3/4/5/134598024/22085a8bfd0f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481830/normal_5fe5333d4f82e.pdfIn PDF document text
    • https://wawodupalise.weebly.com/uploads/1/3/4/6/134621762/ac202ba546d.pdfIn PDF document text
    • https://fumasidabufip.weebly.com/uploads/1/3/0/7/130775820/c44a18.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453901/normal_602f426a640e8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413374/normal_6019986c14425.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/latufenaw/buroxadasaworenaja.pdfIn PDF document text
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_fd34f128e4094cc3af5d6cec9ea67b50.pdf?index=trueIn PDF document text
    • https://c183b790-cb34-49aa-848e-1a9f2b14dda3.filesusr.com/ugd/d8966e_808b984b1fbd422aab0e8aae7685ab61.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lemerisinivum/apprendre_l_anglais_niveau_dbutants-_a2.pdfIn PDF document text
    • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_ec2de835920842b8a2bd419c65f1e01c.pdf?index=trueIn PDF document text
    • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_dc25c8ba99ff4f2e8b71f5f3ddc37b7d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/benuka/beethoven_piano_sonata_no_18.pdfIn PDF document text
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_e8527063c4974d5a86cf77a70b35b3a2.pdf?index=trueIn PDF document text
    • https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_e4418387d93f4b8890582132560f3a3a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bidurudilidujug/apa_itu_independent_sample_t_test.pdfIn PDF document text
    • https://3c86e5df-9a55-47dd-9d5b-c207b25ec6cd.filesusr.com/ugd/72bf36_2c3fa022e94a4512abc8cd138d6e6203.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/luxaduzimase/bahia_grass_seed_planting_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019631.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19631 4856 bytes
SHA-256: 1f992ca2b4f6e49adcb0f4b892016a508bde9e2d5e57ea7e415b2de5bdaa3248
font_01_sfnt_off0001a6ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A6BA 12288 bytes
SHA-256: e2ea7ba0bc006bfa85aba1c3283d7eb5203275c8701fe846ad0b9b5ed9267207
font_02_sfnt_off0001cea5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CEA5 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.