Malicious PDF — malware analysis report

Static analysis result for SHA-256 57e0b41cff868ac6…

MALICIOUS

PDF

75.7 KB Created: 2021-03-14 19:04:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d07ed515f339094cf5d25b110a37f98f SHA-1: e25a309c84c726b105a80e93c15b8ad3cdaa6fca SHA-256: 57e0b41cff868ac67d602959d8a673dfe80608fb60ff62c58cbced5aa666b437
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a phishing attempt. The document body, though heavily obfuscated, contains references to 'Covergirl queen collection discontinued' and is associated with a large number of external links, suggesting a link farm or redirection to malicious sites. The presence of embedded URLs and the overall structure point towards an attempt to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=covergirl+queen+collection+discontinued
    • https://cdn.sqhk.co/pajijolabalu/CggeuBu/jet_ball_pe_game.pdf
    • http://gvidilon.ru/what_are_the_principal_reasons_for_health_and_safety_in_the_workplaceariom.pdf
    • https://cdn.sqhk.co/kadefowuvun/hgiXfgI/pugexikuz.pdf
    • http://nyvelsets.online/21913382805joh6r.pdf
    • http://goodxday.xyz/fatherland_robert_harris_quotesst7l6.pdf
    • http://stat-index-co.com/202984496395p163.pdf
    • https://cdn.sqhk.co/xiruregexibe/cy80Pgi/kijavavesofinekesawa.pdf
    • http://copyright-central-media.com/75802877744scahg.pdf
    • https://cdn.sqhk.co/lozuzupadis/Eid3ihw/world_war_heroes_mod_apk_rexdl.pdf
    • https://cdn.sqhk.co/motanunika/bjfCJif/uae_exchange_online_transfer_review.pdf
    • http://ch-bewertung-2888.xyz/bluebook_citation_online_sourceshhe2w.pdf
    • http://save50it.info/56791543415tk3nt.pdf
    • http://cz-nitrof.website/81302105875x8ge.pdf
    • https://cdn.sqhk.co/kirovuwuvo/ja2A7gf/cognos_report_studio_add_calculated_column.pdf
    • http://steblin.pro/how_to_do_stocks_and_trades3cbnu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_2822d8ea89344302b2d058dbe2e31477.pdf?index=true
    • https://s3.amazonaws.com/damerirazib/45549842790.pdf
    • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_945d706ade404aa4ad55d59abdf1d487.pdf?index=true
    • https://s3.amazonaws.com/tixeligufokup/gabata.pdf
    • https://s3.amazonaws.com/nilafafakem/jarogekulijufaxiruvaronut.pdf
    • https://s3.amazonaws.com/bejikefowu/fuzikipumodixi.pdf
    • https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_343c1f4212954aabbf98e182c57e6fa1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd33.bin
eb0734c075ffa4291bebab72ff4cd0765f06a6f66b5d6b212065f0c47ea734cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD33 4988 bytes
font_01_sfnt_off0000ee36.bin
7745fc0b8ed9c53863f4f600bfa67b66f7b28a24aecd2451da614dbbde6c5b5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE36 10900 bytes
font_02_sfnt_off00011363.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11363 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.