Malicious PDF — malware analysis report

Static analysis result for SHA-256 57e117b28de5a117…

MALICIOUS

PDF

69.9 KB Created: 2021-03-25 02:57:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1cb8f7c07bca132c9c4efb8c91e9a1a0 SHA-1: b74c195545f2d8a3ddec5c1a67acf8cb9e8fd106 SHA-256: 57e117b28de5a117829c9cc90ca8939bf1b96db39f6a75797396a96d04dd8f51
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link farm designed to redirect users to numerous other PDF files, masquerading as search results for a clinical guide. This technique is commonly used to distribute malware or facilitate phishing attacks. The presence of external URIs and a high ML score strongly indicate malicious intent, likely for distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=ortho+notes+clinical+examination+pocket+guide+pdf
    • https://jajonugofetafis.weebly.com/uploads/1/3/0/7/130776034/2268459.pdf
    • https://xomunulozesini.weebly.com/uploads/1/3/4/0/134018183/2581511.pdf
    • https://xovosoze.weebly.com/uploads/1/3/4/3/134370725/zulotadekigi_nadejudu.pdf
    • https://wagemerefav.weebly.com/uploads/1/3/2/7/132712282/4219a30a92.pdf
    • https://degexaxi.weebly.com/uploads/1/3/1/4/131406510/bimavirijopil.pdf
    • https://cdn-cms.f-static.net/uploads/4421215/normal_600cb8a2c9bc1.pdf
    • https://resagivet.weebly.com/uploads/1/3/1/3/131383325/bf9e60791a1a7.pdf
    • https://simokodopegaliw.weebly.com/uploads/1/3/0/7/130776428/jufuzusebagiwofuzo.pdf
    • https://cdn.sqhk.co/luwesefizi/ggNz1he/94080250826.pdf
    • https://cdn.sqhk.co/nisugewameru/OSJpRic/66027788205.pdf
    • https://lotopunukulel.weebly.com/uploads/1/3/4/4/134473418/ropifutoratemoret.pdf
    • https://derebadinexito.weebly.com/uploads/1/3/4/0/134012579/fccc90d816.pdf
    • https://cdn-cms.f-static.net/uploads/4502563/normal_600e31d34e01e.pdf
    • https://guxuxexor.weebly.com/uploads/1/3/0/7/130775085/vowede-miwenituwipa.pdf
    • https://cdn.sqhk.co/pepupiribojo/gN44giy/guzuzepezutuzatoporate.pdf
    • https://cdn-cms.f-static.net/uploads/4471711/normal_604d39d7b8b60.pdf
    • https://static.s123-cdn-static.com/uploads/4387821/normal_5fcf142560587.pdf
    • https://cdn-cms.f-static.net/uploads/4488806/normal_5fdb1839c1e61.pdf
    • https://cdn.sqhk.co/nepofigiper/jgghjjK/rally_racer_dirt_apk_hile.pdf
    • https://cdn.sqhk.co/nalawanuxa/ohg5kK6/apple_notification_ringtone_zedge.pdf
    • https://watagejikifawup.weebly.com/uploads/1/3/4/5/134589749/zusinetiwobe-miwiva-wodiniwidav-dolizomapal.pdf
    • https://govoxarenaja.weebly.com/uploads/1/3/4/8/134874143/e5fa48332b2d6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d079.bin
9e794da6cfc5944195d3ec5874b1aee3567ce2b00773e22708931d3766a8dbe1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD079 5728 bytes
font_01_sfnt_off0000e3d9.bin
a06365f30c7645982cd3c480d8da68aa6ffe6d592cb5430d5d76f2b5be9a1fd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D9 11152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.