Malicious PDF — malware analysis report

Static analysis result for SHA-256 6242e4c6e2cfd042…

MALICIOUS

PDF

80.6 KB Created: 2021-03-18 03:05:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f320d57f75ddb26685d5a2220704cab SHA-1: 71f69aa269f476c6e7db18a80baeb013b816d83e SHA-256: 6242e4c6e2cfd0420f5d8661edf8d4797a559edc5d55751f63941c5fc78f510d
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, suggesting a link farm or SEO poisoning attack. The ClamAV detection and ML classifier further indicate malicious intent. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest this document is designed to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=keurig+k45+elite+brewer
    • https://debozapo.weebly.com/uploads/1/3/1/1/131164198/79426dcd26f38.pdf
    • https://cdn.sqhk.co/xataruzepape/Jieifih/84575889624.pdf
    • http://larizoseviditib.iblogger.org/13037175197.pdf
    • https://cdn.sqhk.co/guzoladip/fdP5lii/syberia_3_nintendo_switch_gameplay.pdf
    • http://mpvideo.org/hisense_portable_air_conditioner_remote_control4vffv.pdf
    • https://pezujotage.weebly.com/uploads/1/3/4/3/134318684/4b213e84.pdf
    • http://kpupnov.pro/sony_vegas_slideshow_templates_free_download6wc7d.pdf
    • https://cdn.sqhk.co/fefowofuk/alsjbja/11685544063.pdf
    • http://reduslim-ordina.site/34557010051r6te5.pdf
    • http://fruitnaturs.space/gbf_crashing_waves_rising_beats_guidegigh7.pdf
    • https://jumifusat.weebly.com/uploads/1/3/4/6/134629025/ketijuti-rexise-kosagevemomojif.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/bufexa/dog_answering_the_phone_gif.pdf
    • https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_d5a3e71fea944cd9a57c3d8a9e782dbb.pdf?index=true
    • https://d321836a-1bf8-47c4-b4d3-67fe1e7f0250.filesusr.com/ugd/33ab24_1e4d6addbfb74f2b8da52e17ee5928ed.pdf?index=true
    • http://kutepiguzusudax.epizy.com/vebaseloluzimogarivukakuk.pdf
    • https://s3.amazonaws.com/megodipewukitoj/letter_of_intent_for_loan_application_template.pdf
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_7c81236e52bd47919569712dc1e13767.pdf?index=true
    • http://lujolugajejizog.epizy.com/zusedazugakijokojatugal.pdf
    • https://s3.amazonaws.com/dekogamik/wenafopumod.pdf
    • https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_6494d1333f444e63befd669633e36e85.pdf?index=true
    • http://rubujizuz.epizy.com/cyberstart_assess_answers_2020.pdf
    • http://rixexoto.rf.gd/zejilorerikuv.pdf
    • https://18aefb47-0221-41c7-ace0-4f78eb33e730.filesusr.com/ugd/bca722_2fb7e349712b487283e55df606882408.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef7a.bin
c85f69967019aa8ed8c5845e12c28aa13886f12e096d0bd8219fc39a3af58a4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF7A 4608 bytes
font_01_sfnt_off0000ff5b.bin
c64457b93503e588dc5f7cf0b0852ac469f4ccba6f87704ddf19752b5e412179		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF5B 11572 bytes
font_02_sfnt_off000126bd.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126BD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.