Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b2e0aebbd276b80…

MALICIOUS

PDF

75.5 KB Created: 2021-04-24 00:12:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9f5824ab9fb3303c4975bb2464802a19 SHA-1: 36b589811cb63efd16f366cbd94fcd0506b5c95b SHA-256: 4b2e0aebbd276b8054df9458d2c801d237f87d90eba806825f1e5caf464495d3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that leverages a search result lure for "the expanse season 5 cast list". It contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=the+expanse+season+5+cast+list
    • https://static.s123-cdn-static.com/uploads/4446651/normal_5fe40f23dcbb3.pdf
    • https://cdn-cms.f-static.net/uploads/4452845/normal_601588cf0fd53.pdf
    • http://svoytrylend.xyz/282150213301orc8.pdf
    • http://trenketo.buzz/pivirerosepewuboxalwxxl1.pdf
    • https://cdn.sqhk.co/xefilelo/iLjaljj/ludus_gladiator_school_apk_hile.pdf
    • https://cdn.sqhk.co/tamenotu/XgfiaQL/54024565082.pdf
    • https://cdn-cms.f-static.net/uploads/4453909/normal_604792951fedd.pdf
    • https://cdn.sqhk.co/vozevadijut/Zifidn9/49430901389.pdf
    • https://cdn.sqhk.co/fapetemiji/cqiijiX/agar._io_play_on_poki.pdf
    • http://a1metromovers.com/10972546768ov6af.pdf
    • https://cdn.sqhk.co/nivunufozub/iejajai/ball_bounce_2_apk_download.pdf
    • http://myfoxing.online/98138083687nn6g8.pdf
    • https://cdn-cms.f-static.net/uploads/4425487/normal_6057e62d45962.pdf
    • https://cdn-cms.f-static.net/uploads/4453551/normal_6028b69e452a7.pdf
    • https://cdn-cms.f-static.net/uploads/4415077/normal_5fd8effb0ab5d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5ccda086-29c7-4024-8a93-689df1f3b89c.filesusr.com/ugd/ed8107_0ae8fbb4849e48d19749eccff726984c.pdf?index=true
    • https://543e2b4d-9699-46d2-9656-875e860b8e63.filesusr.com/ugd/fb32d0_d99a624a9fe64c0da1115b5fd0ebdc64.pdf?index=true
    • https://4f640d82-8365-4c22-93d6-dbd3427c3fb0.filesusr.com/ugd/55e8b7_dbb16117bf454f37836816a0e079711e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3c4aec44-3d9e-4fbb-b91d-6f1b68dd3e04/59227375201.pdf
    • https://uploads.strikinglycdn.com/files/544c927b-dbf1-42d7-9fe4-e9210e4fe3d7/does_amazon_prime_censor_movies.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebca.bin
5e27629084d922642771050f44e5ce9284247e4adcdfd68d2deb8552fd4fdd88		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBCA 5068 bytes
font_01_sfnt_off0000fd0e.bin
684db362829f6d8af974fb2b87b6eb391fec94fc3d508524da9a717cae7d6708		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0E 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.