Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c02e89c3b693654…

MALICIOUS

PDF

136.3 KB Created: 2021-03-22 04:40:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f828f96f2f721a2087e36912516e58c SHA-1: 4f6d8a8e8d7e2d139c65b5444e2ee31c31a7c633 SHA-256: 4c02e89c3b6936541f4b9d15ee673a096966438183bac6388fcab98017f59dd7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by multiple heuristics and a machine learning classifier as malicious. It contains a large number of external links, indicating a link farm or phishing attempt. The embedded URLs suggest the document is intended to redirect users to potentially malicious websites for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=molybdenum+properties+pdf
    • https://tuledekubixa.weebly.com/uploads/1/3/4/7/134722649/bagixivodew-golonuzofa-xitimof-folatav.pdf
    • https://zipadufemawosep.weebly.com/uploads/1/3/1/3/131398243/1879900.pdf
    • https://koxewujinam.weebly.com/uploads/1/3/3/9/133986689/gamiva_zoxomof_rarijuxugib_nebamanug.pdf
    • https://sopazavevorud.weebly.com/uploads/1/3/4/3/134370644/698672.pdf
    • https://cdn.sqhk.co/sozivowemin/DOjiPcd/accession_agreement_template.pdf
    • https://waweviruwupo.weebly.com/uploads/1/3/5/3/135311422/pitaromu_giwusuwi_lezetinel_bepenuleve.pdf
    • https://vurejubi.weebly.com/uploads/1/3/1/4/131454114/1d63443.pdf
    • https://rixafewokeget.weebly.com/uploads/1/3/0/7/130739987/punebozanojawor.pdf
    • http://powerhdniy.space/98161777522qs20d.pdf
    • http://electrumwallet.buzz/seesaw_class_vs_family_appirxmb.pdf
    • https://cdn.sqhk.co/wofosavafiju/idhagc1/pirate_craft_template.pdf
    • https://cdn.sqhk.co/femokuxajuz/fZie9N4/ludo_the_king_of_dice_earning_app.pdf
    • https://guxiwuwo.weebly.com/uploads/1/3/1/0/131070036/5162108.pdf
    • https://wupupuredizuso.weebly.com/uploads/1/3/4/8/134894828/330a22435.pdf
    • https://cdn.sqhk.co/tokafumotebi/iRinjjg/51533457237.pdf
    • https://wavinibavuma.weebly.com/uploads/1/3/1/3/131398010/rilez.pdf
    • https://cdn.sqhk.co/xugiwatokax/OifPJ6X/aruba_wireless_controller_7030_datasheet.pdf
    • https://static.s123-cdn-static.com/uploads/4451377/normal_5fce942b82e7c.pdf
    • https://static.s123-cdn-static.com/uploads/4459788/normal_5fff4d64b3e83.pdf
    • https://bulejoge.weebly.com/uploads/1/3/0/7/130775594/9445550.pdf
    • http://devlp.design/mavovesonivosufuvenuda0ma.pdf
    • https://jadivamanug.weebly.com/uploads/1/3/4/8/134868371/94eab.pdf
    • https://dulipitigisol.weebly.com/uploads/1/3/4/7/134717891/rikif.pdf
    • http://ergors.space/60413230769e1nh7.pdf
    • http://sallehq.xyz/jefagipedpfoki.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001bafc.bin
0db4327c2ce5035b64f7362b05ff4c2d951df83c24a8e972537fa424d0ffcaa2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BAFC 5224 bytes
font_01_sfnt_off0001ccb7.bin
3aa9a29e0425ddfb7c0b1090c11cc6ecc60ea361f6defffe926e683ed3261d9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CCB7 15424 bytes
font_02_sfnt_off0001fe66.bin
e8a2a40c81204f68d188656ee186563bb41cec9665ac8bf1c139965098426a80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FE66 16080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.