Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e399dadcceb3618…

MALICIOUS

PDF

82.7 KB Created: 2021-04-03 23:45:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a7f4553a5675e3f0527db1178e27276 SHA-1: 7500ab51544b28afc5b4ecb64297c282623b4bd4 SHA-256: 4e399dadcceb3618b0c9f555b75ce924bc9bd308f313a566b9a64bbdf82f16c0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-themed, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic point towards the document being used to drive traffic to malicious or deceptive websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=panasonic+toughbook+cf+31+service+manual
    • http://begdas.space/how_to_draw_with_oil_pastels_easy_for_beginnersmwtjo.pdf
    • https://ditaluli.weebly.com/uploads/1/3/5/3/135325413/gelogebib.pdf
    • https://keboxineb.weebly.com/uploads/1/3/0/9/130969034/247963.pdf
    • https://rixodinek.weebly.com/uploads/1/3/5/3/135392020/debegemixexarif-nifetefurejibam-xijusedewome.pdf
    • https://gudemulu.weebly.com/uploads/1/3/4/3/134387893/b10c82fd86.pdf
    • http://cupe1.ru/assassination_classroom_knifeoiojc.pdf
    • http://tixshopclub.fun/gusitubatorekeseviwoubh8m.pdf
    • https://vurejubi.weebly.com/uploads/1/3/1/4/131454114/4437346.pdf
    • https://sulewonabesonu.weebly.com/uploads/1/3/2/6/132682327/b52840.pdf
    • http://medakijizu.22web.org/treasurers_report_template_excel.pdf
    • http://oneitshop.pro/xaxarekuxupidawgkj3k.pdf
    • http://alteramaks.world/86557427110wuk42.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://geperazal.epizy.com/snow_flower_and_the_secret_fan_film_review.pdf
    • https://s3.amazonaws.com/wazorixekunafob/canonet_ql17_giii_lens_cap.pdf
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_9b4b8e133aa44820912314c3555fc788.pdf?index=true
    • https://0633afab-057d-4448-85e1-ac1a97571725.filesusr.com/ugd/66920c_23d0ae5215724594a26c8ddcf2134662.pdf?index=true
    • http://kunubuxeduw.epizy.com/xuwonod.pdf
    • http://wokoziguroron.rf.gd/physiologie_de_l_appareil_respiratoire.pdf
    • https://2903667b-e544-4972-ac7f-e5855aaa9b37.filesusr.com/ugd/2cc660_91d3890e6d4f4b50997369d843eab91a.pdf?index=true
    • https://557345b1-98c6-442d-b460-9e357c178e5b.filesusr.com/ugd/dfb5f8_3b17dafcad3c4cc6880ede24fab542df.pdf?index=true
    • https://s3.amazonaws.com/mupukesunobaga/navy_ia_eval_instruction.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4ad.bin
f9ba88009b010baa5a4f05691d3a613397e48c7175a8fbe1baae3ec6a2ff9f54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4AD 5656 bytes
font_01_sfnt_off000107c8.bin
c619a9a802328e4b6543d550b24fc07e1020d042dcc1d49830c68dac7839f2c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107C8 11492 bytes
font_02_sfnt_off00012eda.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EDA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.