Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c2eee84018459d4…

MALICIOUS

PDF

90.0 KB Created: 2021-03-17 05:29:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 99432245e6ccd3b5d131af6cfea56000 SHA-1: 6df78db3338579408243af77e7d28c956227e5e8 SHA-256: 4c2eee84018459d4a0269db123d4126bc1b3666fc7eaa1457343fb921615fe56
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML_NYX_PDF_MALICIOUS and ClamAV detections confirm its malicious nature. The embedded URLs suggest an attempt to redirect users to potentially malicious or phishing sites, aligning with a spearphishing attachment tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6897

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=busonid+50+bula+pdf
    • http://helpcenterbusiness.xyz/what_is_the_average_setting_for_the_heaterphcrk.pdf
    • https://cdn-cms.f-static.net/uploads/4445871/normal_5fe8bfe8bc2a3.pdf
    • https://cdn-cms.f-static.net/uploads/4366015/normal_601b21f4abf0b.pdf
    • http://smartcreditus.info/noromimulodadkta9t.pdf
    • http://jenuxijaf.mygamesonline.org/costing_and_estimation_book.pdf
    • http://mudixefibewab.mywebcommunity.org/wisakinosijigujezubari.pdf
    • http://vixitatevejiwo.getenjoyment.net/purine_biosynthesis.pdf
    • http://kuzexamipapoxip.medianewsonline.com/jimivex.pdf
    • https://cdn-cms.f-static.net/uploads/4486363/normal_6024943f34db2.pdf
    • https://cdn-cms.f-static.net/uploads/4474170/normal_6023f76c1fcf8.pdf
    • http://select-get.top/kosipikovizijopizujajoretzx9s.pdf
    • https://cdn-cms.f-static.net/uploads/4473044/normal_60108f3ac21f4.pdf
    • https://cdn-cms.f-static.net/uploads/4500677/normal_603c16f36655a.pdf
    • https://cdn-cms.f-static.net/uploads/4426066/normal_5fd62fef1eedd.pdf
    • https://static.s123-cdn-static.com/uploads/4471275/normal_5fcaf5b49b816.pdf
    • https://cdn-cms.f-static.net/uploads/4481173/normal_6019a634be31e.pdf
    • http://kamini33.ru/cavalcadepublishing_com_balancing_chsj0u5.pdf
    • http://vowuzemiru.medianewsonline.com/xefuwaviboxos.pdf
    • http://freshnatur.fun/3176039974hvl8r.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7920a853-f458-4dfc-a893-f50c3ed6f780.filesusr.com/ugd/fe7850_86e1c57c476249168a688ce101e4517b.pdf?index=true
    • https://s3.amazonaws.com/tikofaketonub/trend_imsva_admin_guide.pdf
    • https://s3.amazonaws.com/sorogamat/mla_format_citation_bibme.pdf
    • https://s3.amazonaws.com/xupimaral/48682882295.pdf
    • https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_489dff64fd174cf789bc8efcfb307cf4.pdf?index=true
    • https://3dcfbd4a-ef33-49dc-a04a-0aaf5307c30d.filesusr.com/ugd/b47706_a94e192e0a5f45baa1e17f42a0b2936e.pdf?index=true
    • https://s3.amazonaws.com/zumezeviwakiz/rikitibejabupuzidi.pdf
    • https://cb705b04-a904-4f11-a6d0-9d7e2b1ae5cb.filesusr.com/ugd/53498d_e491881cdfcc467ba16fec9271f120c6.pdf?index=true
    • https://184d393c-d2ff-49e5-bbcb-48626b1dbf88.filesusr.com/ugd/49be48_d95e844eabaf4d1c9d7a5721fd510353.pdf?index=true
    • https://s3.amazonaws.com/ropuba/tuwalisobixuva.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012f3c.bin
db483bd7073b91615b301a14f34c0fd15e862ae7f9b6c5a1a0e0d2e878716e78		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F3C 5392 bytes
font_01_sfnt_off000141a7.bin
98bed7b3768f4d503256a2aa9f5ab02377cc8e414d1872a948e50482215223b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141A7 13004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.