Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e0d4ff0a56738d8…

MALICIOUS

PDF

74.9 KB Created: 2021-04-02 05:52:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81f7ac67392b876682847c7b49fc3f92 SHA-1: e05724c3d7d6e629146bf7f993aca3cf778b3cc9 SHA-256: 5e0d4ff0a56738d8031e0cf3446c8e4df8564b18d836d3342e3f4cf9cfcd0f6b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or malicious intent. It contains a large number of external links, suggesting it's part of a link farm designed to drive traffic to potentially malicious sites. The document body, though heavily obfuscated, contains metadata related to its creation, and the presence of embedded URLs points towards an attempt to redirect users. No scripts were extracted, but the heuristic firings strongly suggest a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=effective+communication+barriers+pdf
    • https://cdn.sqhk.co/vofepubot/1jbidgc/suara_burung_cucak_ijo_juara_dunia.pdf
    • http://fofuxan.iblogger.org/2386909657.pdf
    • https://cdn.sqhk.co/minamojazi/gcOhhwG/savifokowokukitu.pdf
    • http://pycnidwzxc.info/31466608264xvdbs.pdf
    • https://zasawebisev.weebly.com/uploads/1/3/4/8/134865024/biwadefosusigimojere.pdf
    • https://cdn.sqhk.co/fewibefanid/bibrjeF/41488636497.pdf
    • https://xogunepole.weebly.com/uploads/1/3/4/5/134529021/9aab0b1.pdf
    • http://helper-badges.com/what_is_gum_pocket0x0xq.pdf
    • https://cdn.sqhk.co/jomonufo/ichhggd/2h_sword_build_toram_online.pdf
    • https://cdn.sqhk.co/zanotunuzi/jhhjcic/gebalagofonoxutaz.pdf
    • http://greatholl.com/84366459151pb72j.pdf
    • https://cdn.sqhk.co/fezusife/shf151q/pet_shop_story_game.pdf
    • https://cdn.sqhk.co/dagidomu/3oqjfHW/refebewaxebinizom.pdf
    • https://cdn.sqhk.co/numovasovev/nhcEfcB/62552666787.pdf
    • http://copyrightsupporteds.com/tevalotolegoxikip8lzyc.pdf
    • https://kojezuduw.weebly.com/uploads/1/3/5/3/135326104/rijeporobikelof.pdf
    • https://cdn.sqhk.co/rutesawir/jdifjgf/bapifowexibajija.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bda5083a-a4a7-401e-ae8b-94b904dd7543/wurowiloluvegatakufovukig.pdf
    • http://dumavibir.rf.gd/que_es_el_adultocentrismo.pdf
    • https://uploads.strikinglycdn.com/files/fae1c4e7-f1d2-414c-86b4-3be71d59e234/64608265025.pdf
    • https://uploads.strikinglycdn.com/files/21bbaf24-729c-44ff-a25b-5f6ad7340ca0/64911578140.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea9b.bin
bc692befe62adacffb5b598ab7fe4c8dcfc389a8f77678b7c69d92f00e415ded		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA9B 5428 bytes
font_01_sfnt_off0000fcfc.bin
2ede48aab4e370c9b7c8a0042e2ae5393fc5ba8c91fa6886713caacdb3d72440		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCFC 9740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.