Malicious PDF — malware analysis report

Static analysis result for SHA-256 51cb91faa2fdd2cf…

MALICIOUS

PDF

88.3 KB Created: 2021-04-07 17:45:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 229eb4c3d2804d612fa0acf859361e92 SHA-1: 7835d219204442d6882487de5e686df11183147c SHA-256: 51cb91faa2fdd2cf9859bef7866485e8c02e26e6bfd9a4398b5d1e47982fca63
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and numerous external URIs suggest an attempt to leverage web content for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=where+to+watch+the+secret+movie+2020
    • http://gunofixe.medianewsonline.com/feligumojifo.pdf
    • https://cdn-cms.f-static.net/uploads/4459162/normal_606806aad0e83.pdf
    • https://wakejowedab.weebly.com/uploads/1/3/4/5/134599651/xiwogumunesa.pdf
    • https://cdn.sqhk.co/zidexamuwela/8zhjWjg/vazonig.pdf
    • https://zapizurur.weebly.com/uploads/1/3/4/9/134900478/nadimulufoziminaber.pdf
    • https://cdn-cms.f-static.net/uploads/4454047/normal_603a83d32cf3d.pdf
    • https://cdn.sqhk.co/jitolado/aLGgjg2/58148142622.pdf
    • https://cdn.sqhk.co/sirijunubi/ggijjhb/rexuvepatit.pdf
    • https://cdn.sqhk.co/xusarukave/uihlihK/63926000991.pdf
    • https://cdn-cms.f-static.net/uploads/4371783/normal_6059525618377.pdf
    • https://kadorupadidugi.weebly.com/uploads/1/3/1/6/131636929/volitebarasarowen.pdf
    • https://cdn.sqhk.co/tunixomaj/gdjhgeR/gozomuzujegulepejafaz.pdf
    • https://cdn.sqhk.co/zijigemeworu/FggKgib/react_bootstrap_form_control_select_default_value.pdf
    • http://dodajavux.scienceontheweb.net/91711385541.pdf
    • https://manuxemewawi.weebly.com/uploads/1/3/4/4/134443751/9133297.pdf
    • https://cdn.sqhk.co/gobuwovuv/eghj0xz/tudejorulumapewin.pdf
    • https://gevivakeje.weebly.com/uploads/1/3/0/7/130775257/9a296b415de.pdf
    • http://ladujose.sportsontheweb.net/wordly_wise_3000_book_7_lesson_20.pdf
    • https://dodafuwunolig.weebly.com/uploads/1/3/4/0/134016835/gogara_firusar_guvog_xotusunif.pdf
    • https://giwirakixa.weebly.com/uploads/1/3/3/9/133999144/3743123.pdf
    • https://viwomesaw.weebly.com/uploads/1/3/4/4/134472777/jejetumezoxozenu.pdf
    • https://dakewamegiru.weebly.com/uploads/1/3/5/3/135305658/zojasoberu-xumuxamigugewa-lenidadejowaw-doragiwaguvu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zapusov.atwebpages.com/english_vocabulary_with_urdu_meaning_and_sentences.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011cb4.bin
6196343b12d6a063d92d09734e6de3a1bf63a1396824a361067f79716c4eb395		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB4 5448 bytes
font_01_sfnt_off00012f2b.bin
9e870f8c209823fed081e770be25e4abdade2477e18f1a78fae1fa540f1040b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F2B 10832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.