Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fc31f5fb643b828…

MALICIOUS

PDF

98.3 KB Created: 2021-05-12 01:52:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a559055ac2a2c8021b490a5c7d63b26 SHA-1: 767139122ab991d0b481e52193d46e76bfa1224c SHA-256: 5fc31f5fb643b8284788e7a0f29033d021e826e9070df1840679b071119c5216
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms and phishing sites, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URLs point to suspicious domains, likely serving as lures or hosting malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=what+are+the+living+room+colors+for+2020
    • http://pasetbs.xyz/mujuxasiborerinexujukur4uq8.pdf
    • http://erogan-columbia.site/singer_handy_stitch_model_cex300k_manualixh9j.pdf
    • https://nozirokopen.weebly.com/uploads/1/3/4/6/134613575/xovalisu_zisegijugabo_fuguzanebitex_towezofunul.pdf
    • http://lnstagram-blue-badge-form.com/nonenokiahfzr.pdf
    • http://lanejaselisipu.22web.org/shakespearean_sonnet_form.pdf
    • http://springwin.space/draw_the_flag_of_malaysiakxq75.pdf
    • https://wowiwega.weebly.com/uploads/1/3/1/4/131453904/supidiparufif_xemesitumu_posuginoge.pdf
    • http://forkidsshop.online/what_does_a_moca_score_of_13_meandb7s4.pdf
    • https://tunivarururi.weebly.com/uploads/1/3/4/0/134041149/vagot.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://biragexakulutaj.rf.gd/action_for_continuous_school_improvement_plan_shaala_siddhi.pdf
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_401fb300221e493a9733dc04c5eee0b1.pdf?index=true
    • https://c4a5d104-04f9-44e6-b03f-1f5edac3680f.filesusr.com/ugd/f23921_43ef00728d924ebdbab263a70ab14565.pdf?index=true
    • https://18cceff7-6d50-42ec-9d85-67184b61345e.filesusr.com/ugd/8c2e83_e9fec2c705c4426e8930b5db53be3fc1.pdf?index=true
    • http://zozikidifalov.epizy.com/ataxic_cp.pdf
    • https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_899afada8a924169b223ea05340c4ad7.pdf?index=true
    • https://51bf459c-6b46-41b0-863f-532cf8a77e0d.filesusr.com/ugd/2eedf1_24bced33f7f444c2bfea68299b0cde78.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001431b.bin
d0821cc3dd888bc5e1428a15ec46fd8b222a75954f73c88c11a26c18245346c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1431B 5644 bytes
font_01_sfnt_off00015638.bin
372a286401473ed86a768f751af6a1ab7395e60bb370bfda655fb64b717ea388		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15638 11224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.