Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ae32baf33efdb71…

MALICIOUS

PDF

100.0 KB Created: 2021-05-08 20:54:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 465ece2b15fa401857a97f2efde5a74f SHA-1: 83ec58e59758067fab3f68c570e7c01f78ccc9ae SHA-256: 5ae32baf33efdb71dba3c4bdcfdac6f39dcb90fcd2e77a684cacc9f92fb6734c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a significant number pointing to potentially malicious domains, indicative of a link farm or SEO poisoning attack. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. The embedded URLs suggest an attempt to redirect users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=mercruiser+4.3+intake+manifold+removal
    • http://foxiwirilavisan.22web.org/libogejejixapubukulaw.pdf
    • http://reactivaperu-viabcpi.com/85505504800hehsl.pdf
    • http://igcopyrightclient.com/lekogewogobibaz4iws5.pdf
    • http://xozonline.ru/what_type_of_oil_does_a_2015_chevy_traverse_takegf65a.pdf
    • http://zarabatyivat.ru/how_to_find_out_business_credit_scorehjqpl.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://9e0ebcba-7e04-41ac-afc6-cfc574163c15.filesusr.com/ugd/6725b5_62d4fe87e5e34a11ac71bb16a6376f38.pdf?index=true
    • https://s3.amazonaws.com/wujanozo/work_completion_report_format.pdf
    • https://s3.amazonaws.com/metubevozisul/89950708017.pdf
    • https://s3.amazonaws.com/meludav/kizodelaxawobazixososadu.pdf
    • https://9cf5cc10-3c2e-4e30-ae6b-73ed7beed88a.filesusr.com/ugd/5c2b46_82d9db96737f46349154289f0f9b7138.pdf?index=true
    • https://s3.amazonaws.com/popilo/why_measure_absorbance_at_lambda_max.pdf
    • https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_6b478182475e4c4a90f66d6d7bd00353.pdf?index=true
    • https://43fe4710-460a-4ad3-90dc-2dd795c51528.filesusr.com/ugd/a32c20_5f9d057e311a4e0793470d24d1de7d0e.pdf?index=true
    • https://s3.amazonaws.com/tojabixefova/84660643985.pdf
    • http://puligop.epizy.com/47824651017.pdf
    • https://d0aee4dd-c5bf-4c29-adcf-3aa844f59ef3.filesusr.com/ugd/193d13_6a0596f7d04845c8a2aa7fd81f036321.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a44eda14-d187-4bb1-abe3-88925f115c21/tijuradodatatekopanekifon.pdf
    • https://uploads.strikinglycdn.com/files/6ab2d495-2282-47aa-8db4-9da2f7fdb600/butema.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012340.bin
e5e96b108822db364416855a708edf3232cf3cddc7b951de274d85cfc75d7021		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12340 5464 bytes
font_01_sfnt_off000135d6.bin
f3a9089844f82dd3442214eff116d06658b1fef03e66dffac9866c166d596ca0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135D6 11656 bytes
font_02_sfnt_off00015dd1.bin
84d5bd19c210eb3b73ecc14096ab1e56fdfb5b80ce7ba4f0052c67c0c2b02727		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DD1 16060 bytes
font_03_sfnt_off00017264.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17264 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.