Malicious PDF — malware analysis report

Static analysis result for SHA-256 49c99dd6fb5dc3f1…

MALICIOUS

PDF

78.9 KB Created: 2021-03-10 10:56:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: a2202ab8edc179d85e03377d01a3bcd1 SHA-1: 5be7c8a70afbbdda5bee01d53f19cb62695dec1f SHA-256: 49c99dd6fb5dc3f131578343e7bd230660dda93e4c7040ba002f773fa1c66961
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. One of these links, https://vilenefex.ru/award?keyword=arboles+de+decision+mineria+de+datos+pdf, is flagged as suspicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or distributing further malware via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=arboles+de+decision+mineria+de+datos+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4409122/normal_600d5ee46ceca.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471095/normal_6008b83a57b39.pdfIn PDF document text
    • https://cdn.sqhk.co/vumulevezuf/6cPieu6/31827753621.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418984/normal_5fe182793ff49.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383470/normal_5fdebbe788bd1.pdfIn PDF document text
    • https://cdn.sqhk.co/loganidob/jhhbVif/zombie_derby_1.pdfIn PDF document text
    • https://cdn.sqhk.co/pemofirojez/SihTggC/89907293428.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446642/normal_6022e1c571844.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452621/normal_5ffa048ce5dfc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417037/normal_604850451530b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_cfc6fc0b28324d118e3ee66380b9f99c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wutogugej/genki_1_workbook_answer_key.pdfIn PDF document text
    • https://5ee0d2ad-6486-47ce-ab7d-0e7b2bae4193.filesusr.com/ugd/bc0d1e_01dc041f95044cc0b45487223bbc7db6.pdf?index=trueIn PDF document text
    • https://8641c524-1fb5-4292-87ed-dd72f64d6c22.filesusr.com/ugd/9b7d8a_90d3c39e2e0d4f85b836e4ce7f5a5b17.pdf?index=trueIn PDF document text
    • https://fea67d75-dd3b-4bdd-af05-748e92ec8a52.filesusr.com/ugd/05900a_c43dbb3dfe6c4cf58b52cf634f4ddd2c.pdf?index=trueIn PDF document text
    • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_e284f48f9b3f46cdb529f796aae9a858.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/doxifuba/how_to_use_machine_learning_algorithms_in_python.pdfIn PDF document text
    • https://s3.amazonaws.com/ganubifirigevi/animal_crossing_happy_home_designer_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3E7 5432 bytes
SHA-256: 4cb6fa9b72ddfbed8d2649a319d1a5d0e14a2872ada8211cce75e00100f797ce
font_01_sfnt_off00010640.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10640 11812 bytes
SHA-256: cf52420534843d78dd89cefc540517024baf7c0b771a016b1826ac28d368b00b

Open this report in the interactive analyzer, or submit your own file for analysis.