Malicious PDF — malware analysis report

Static analysis result for SHA-256 51c739ede50c2d37…

MALICIOUS

PDF

78.8 KB Created: 2021-04-17 18:10:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d56c27a0032565dbf1defdbec9501295 SHA-1: d057a5837d46522a197168730c14ebe470ee2fe0 SHA-256: 51c739ede50c2d37c1f864b03eb60a8a0c90e388525aa9e4e9f8520ecd80c641
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to manipulate search engine results or redirect users to malicious sites. One such link, 'https://ponafet.ru/strik?utm_term=showtime+rotisserie+%2526+bbq+turkey', is flagged as an external URI. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=showtime+rotisserie+%2526+bbq+turkey
    • https://pigudoxuwupif.weebly.com/uploads/1/3/1/4/131437670/libulakifojanijadam.pdf
    • http://upsbox.ru/lokezowomigelkc785.pdf
    • https://nulasexojexof.weebly.com/uploads/1/3/4/0/134012614/8994107.pdf
    • http://reestr.site/5792701721rwjv8.pdf
    • http://sk-anker.ru/craftsman_wet_dry_vac_filter_17816ramqs.pdf
    • http://jakor.pro/noam_chomsky_major_contributions_to_psychologygybsi.pdf
    • http://copyright-notice-ig.com/gadawagopozosifef8165.pdf
    • https://wusuritod.weebly.com/uploads/1/3/0/7/130739885/pusisufam.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c5d5faf8-0fb5-443f-aacf-17d3fe1aaed0/traduttore_inglese_italiano.pdf
    • https://uploads.strikinglycdn.com/files/eb8caf0d-fad3-4ebf-ba11-8787b1feba27/71401990920.pdf
    • https://uploads.strikinglycdn.com/files/afaf02d1-cd41-48a9-bfa4-f26925878562/namawojegim.pdf
    • https://uploads.strikinglycdn.com/files/b530c7bd-0bde-4183-a41a-061443b0d933/english_speaking_practice_test_online_free.pdf
    • https://4541bc1c-e35c-4de3-bb44-1f53c3e1a56d.filesusr.com/ugd/68f66e_9ef7f8c03bc04d7895af61d76341b568.pdf?index=true
    • https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_d15e06f9b18843539024f13041bc3e33.pdf?index=true
    • http://fojupejededoto.epizy.com/reading_ielts_general.pdf
    • https://uploads.strikinglycdn.com/files/16f6b020-8989-4156-9583-f22e6c7d1e03/ideas_para_decorar_corona_de_adviento.pdf
    • https://uploads.strikinglycdn.com/files/c403cdb8-9f6d-4c9a-874b-12254de549a9/is_the_bible_show_accurate.pdf
    • http://zavimefetemif.epizy.com/the_science_of_black_hair.pdf
    • http://pirafabitibabik.rf.gd/the_7_bridges_of_konigsberg_answer.pdf
    • https://uploads.strikinglycdn.com/files/f8d26c56-6672-4c40-b716-e0781e2ac5dd/41546174849.pdf
    • https://38aad9b5-7a72-45b8-ac81-9fe73ce82000.filesusr.com/ugd/08338c_8839bb9720c84b808cf32026f6ec685b.pdf?index=true
    • http://bezukovopobav.epizy.com/fepetona.pdf
    • https://uploads.strikinglycdn.com/files/37b8ce28-c53a-4eae-9b13-0863f80e35fc/without_you_rent_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/6706d114-5631-4bfa-8c06-37f0fb0b4199/southwest_insurance_agency_grundy_va.pdf
    • https://uploads.strikinglycdn.com/files/4644b1e1-4032-40f6-a27f-b4a54cd43b66/stand_by_me_cast_now.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4c8.bin
6071396d4b97ccd5730fe6c723034164dd27d3bb12c0ec52cfe73f514c8efce1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C8 4876 bytes
font_01_sfnt_off00010544.bin
95f13e1c028f3a8ca6d4359ed452e4f121a53f10f295193909575998c005b5f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10544 11800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.