Malicious PDF — malware analysis report

Static analysis result for SHA-256 56a51b3183eaa3e4…

MALICIOUS

PDF

77.8 KB Created: 2021-04-04 17:23:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3d04ae0a57807acec6d2b12bd2bf062a SHA-1: 21d24506f5782583ab0b1a76c2714edd94daea34 SHA-256: 56a51b3183eaa3e43ec3c17648f45c35a96f6890a035b90dc9c07952988cbd01
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, many of which are SEO-optimized, suggesting a link farm or phishing attempt. The document body, though heavily obfuscated, appears to reference a 'Nate certification study guide pdf', likely a lure to encourage users to click on the embedded malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=nate+certification+study+guide+pdf
    • https://nokojuponamipi.weebly.com/uploads/1/3/4/8/134891784/mewavodariroga.pdf
    • https://dokakuzod.weebly.com/uploads/1/3/4/8/134884054/temiga.pdf
    • https://netaterosani.weebly.com/uploads/1/3/4/4/134438803/letiziwita-nupenusifimodi.pdf
    • https://kirorasonosa.weebly.com/uploads/1/3/4/7/134743937/5609343.pdf
    • https://wavurujubatebar.weebly.com/uploads/1/3/2/6/132682053/9f81a0eb33.pdf
    • https://nezopubetuw.weebly.com/uploads/1/3/2/6/132681339/dalaxexipeluz.pdf
    • https://rikawoxazedopet.weebly.com/uploads/1/3/4/7/134772555/gofigutavewal-reboketizimiroj-rapovije.pdf
    • https://ruxunomitebapat.weebly.com/uploads/1/3/1/6/131606858/1979878.pdf
    • https://tunorikiwevog.weebly.com/uploads/1/3/4/0/134097136/755070.pdf
    • https://zoladikadaxupaj.weebly.com/uploads/1/3/4/6/134635808/medivunegekokigaweru.pdf
    • https://maviwodoke.weebly.com/uploads/1/3/1/6/131606431/8676cdee9141f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_a97adc5ff44d452b85bc092456042132.pdf?index=true
    • https://s3.amazonaws.com/pekatikisuruki/what_is_the_difference_between_plot_and_storyline.pdf
    • https://uploads.strikinglycdn.com/files/8d10eac7-c029-45db-90ac-d3bc7a39ad51/99495137908.pdf
    • https://s3.amazonaws.com/tapelu/59360221038.pdf
    • https://s3.amazonaws.com/zuguvoxoki/diffusion_and_osmosis_worksheet_answers_page_3.pdf
    • https://s3.amazonaws.com/pusixa/bahubali_3_full_movie_2019_free.pdf
    • https://uploads.strikinglycdn.com/files/a0455649-5cc3-436c-9600-210b7c7971b1/86993449006.pdf
    • https://cc968bdf-8a18-4a65-a72d-893c706ef441.filesusr.com/ugd/bae363_2eb9a58f691e4800aa2470ec3e87a0ff.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9bd009b6-c60e-4e43-9950-c408e8cc7421/example_of_a_written_research_proposal_in_chemistry.pdf
    • https://s3.amazonaws.com/rokuwapesu/wasekabusix.pdf
    • https://uploads.strikinglycdn.com/files/b6477254-5af8-45f8-876b-7a8c89effddf/50545482079.pdf
    • https://8b83d164-5e56-46cc-b941-48f48810ddf3.filesusr.com/ugd/76ce43_7aa4e76517e144b2a20a17b73dc2d012.pdf?index=true
    • https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_71860a1cc8864527b9cf3039863daa7d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/674ec058-af2c-41b8-b358-277052bdf432/how_to_change_last_name_on_drivers_license_after_marriage.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef05.bin
489d1bd159c991bf52f6297eb5c56435b6ddcd19acfef2a8464e0b12aea518e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF05 5360 bytes
font_01_sfnt_off00010166.bin
a959f40ca2195d100c3b6d1e91eb64bf1bf4ad74c4e95888b3f94662591f05a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10166 11364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.