Malicious PDF — malware analysis report

Static analysis result for SHA-256 5382413b9098fce4…

MALICIOUS

PDF

65.3 KB Created: 2020-12-19 12:05:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd004e49d663a2245d5db5beddb435b6 SHA-1: b7657507a1531ce218b38c0dee1b58f4c9246be4 SHA-256: 5382413b9098fce403820bd0b7cc58fc48f33034e0ff5a4ecfc5cde36f2a402d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, indicative of a link farm or SEO manipulation. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or hosting further malware. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic point towards an attempt to drive traffic to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=lagu+brynn+cartelli+walk+my+way
    • https://wunanowadile.weebly.com/uploads/1/3/4/6/134600652/1e81ecaa5.pdf
    • https://wanovupejofo.weebly.com/uploads/1/3/4/5/134580977/tevog.pdf
    • https://natizupasa.weebly.com/uploads/1/3/1/4/131437725/6229122.pdf
    • https://totapige.weebly.com/uploads/1/3/1/4/131483287/c10a2d20d91fc.pdf
    • https://pufetebad.weebly.com/uploads/1/3/4/7/134711346/rarivotunopizos-julomuduzozof-maleminuvixaka-daserasamujowat.pdf
    • https://xufidevudog.weebly.com/uploads/1/3/4/3/134389214/ziloxemumak.pdf
    • https://mozosuroje.weebly.com/uploads/1/3/4/4/134456199/a6eedd4c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf57c64e98326c0207a472/1606375368537/5961831313.pdf
    • https://s3.amazonaws.com/visagogijulep/89618093171.pdf
    • https://uploads.strikinglycdn.com/files/ad3e9dc8-9f2b-4e9c-be12-ea40ae7a2f19/pikmin_2_gamecube_rom.pdf
    • https://static1.squarespace.com/static/5fc07dde27a199023ab34438/t/5fca8359a08b9342fa9d8450/1607107418329/gps_tracker_for_car_buy_here_pay_here.pdf
    • https://static1.squarespace.com/static/5fc777f5a3ccef3526eb9256/t/5fc81663d6e0cc37e32ea97a/1606948453200/99078849035.pdf
    • https://s3.amazonaws.com/tugumeb/sew_and_sew_sewing_machine_manual.pdf
    • https://uploads.strikinglycdn.com/files/6d986f01-0fc7-4c57-8384-a3844b5f4283/23038708171.pdf
    • https://static1.squarespace.com/static/5fdc7d42ec98190d8a5337c0/t/5fdd2a62e64f5703150b4d92/1608329826579/15727420549.pdf
    • https://static1.squarespace.com/static/5fc4e694085bf90c0e16c363/t/5fcc30fafe657040d5833cd7/1607217402953/20093411918.pdf
    • https://s3.amazonaws.com/domegagowevag/solving_right_triangles_using_trigonometry_worksheet_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c3bc.bin
32a00073d72aaf69ac1760b82c1b97efcf68494d3f9d41b7d5b5457f81e01e54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC3BC 5280 bytes
font_01_sfnt_off0000d5c4.bin
abbde8778e1ae28e7528bbaf479c0c0443b1d619d8e642b73d27e9cb6523f8ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5C4 10048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.