Malicious PDF — malware analysis report

Static analysis result for SHA-256 49887358fdc1bfeb…

MALICIOUS

PDF

78.2 KB Created: 2021-05-12 06:11:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 61a6e1269079c4a75e71aa4eab9c496e SHA-1: 9bb04a160e8fce6fce960f68752bad7f079f31af SHA-256: 49887358fdc1bfebaba068721ea0984d07cd05bb9b86f5f609a7cda6c52155c1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, and contains a large number of external links, indicating a link farm or phishing attempt. The document body, though heavily obfuscated, suggests a lure related to 'building android app'. The presence of external URIs and a PDF link farm heuristic strongly suggests an attempt to redirect users to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=simple+way+to+build+android+app
    • http://rerupebe.iblogger.org/current_trends_and_technologies_in_computer_science.pdf
    • https://cdn-cms.f-static.net/uploads/4494648/normal_600eb62e27529.pdf
    • http://nemeloru.66ghz.com/google_chrome_plugins_viewer.pdf
    • https://cdn-cms.f-static.net/uploads/4484380/normal_605580daaeb7b.pdf
    • https://cdn-cms.f-static.net/uploads/4374704/normal_6067a55d404f3.pdf
    • https://static.s123-cdn-static.com/uploads/4374520/normal_60067f022db28.pdf
    • https://cdn-cms.f-static.net/uploads/4471988/normal_5fd267bb40742.pdf
    • https://static.s123-cdn-static.com/uploads/4366405/normal_5fcd15e21d800.pdf
    • http://funomixukipiv.iblogger.org/87131167009.pdf
    • http://xufadaxedi.22web.org/oromiffa_amharic_dictionary.pdf
    • https://static.s123-cdn-static.com/uploads/4421207/normal_5ff42b9a848e6.pdf
    • https://cdn-cms.f-static.net/uploads/4408188/normal_60296eb70d166.pdf
    • https://cdn-cms.f-static.net/uploads/4500911/normal_604311dc56045.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a9b72ff8-ed6f-4212-96c6-d467cc4e2332.filesusr.com/ugd/7f5649_c6c3721404bd49d1a6a3993f5e35dd39.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4ee85103-1a80-4ffe-b269-177328e908de/7601914780.pdf
    • https://uploads.strikinglycdn.com/files/6e97730a-fed3-450e-ab7e-b32dad4a8041/3850011935.pdf
    • https://13fad4bf-7224-44b3-802b-16842e97d241.filesusr.com/ugd/b14664_8d2247c12a7a4a63b7527c1eb39b7172.pdf?index=true
    • http://nidikofuwovi.rf.gd/sheet_metal_forming_process_slideshare.pdf
    • https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_e8fa16efcebe4331b35d560dbbf4550b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e4ee5144-2e24-4794-8f3b-ff4a94779cde/vince_gironda_book.pdf
    • http://wupojonik.epizy.com/49165840114.pdf
    • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_6a485c79929d4d46b2677773c087ac6a.pdf?index=true
    • http://nusagimedejaj.rf.gd/tifukerofolafowafokup.pdf
    • http://notufexunu.rf.gd/petolugupariselobeke.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f423.bin
861f4d3a17c1349aa0f04070774b30ddcd3627573d0b1667b890a5cc6c81c593		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF423 5364 bytes
font_01_sfnt_off00010659.bin
da65d5717134701298655b71d21e321d4773483140c2a0f42fd59598de344ee3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10659 10952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.