Malicious PDF — malware analysis report

Static analysis result for SHA-256 626bf21fc94376b1…

MALICIOUS

PDF

105.6 KB Created: 2021-03-19 04:30:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7eb9dde3905cc89ea1955c291320241e SHA-1: bf829a7e94ae03773c914ad9b1021ae869751d57 SHA-256: 626bf21fc94376b1410cc9eb3b43fef4adf8a29b2c0b10e1c533598a90b44edc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier as malicious. It contains a large number of external links, many of which point to PDF files hosted on various domains, suggesting a link farm or a method to distribute further malicious content. The presence of external URIs and the PDF_SEO_LINK_FARM heuristic indicate an attempt to manipulate search engine results or redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/aws?utm_term=are+dyson+ball+vacuums+worth+it
    • https://cdn.sqhk.co/buruvalufe/chejhhh/fables_the_wolf_among_us_comic.pdf
    • http://gejuwepejuvula.iblogger.org/what_is_the_main_point_of_the_academic_text_from_hand_to_mouth.pdf
    • https://cdn.sqhk.co/xupotuferu/Sgj8bKJ/towejesopo.pdf
    • https://static.s123-cdn-static.com/uploads/4421208/normal_5ff9b9ec564be.pdf
    • https://cdn.sqhk.co/livukigelo/hbAhdcT/juventus_pink_jersey_pogba.pdf
    • https://static.s123-cdn-static.com/uploads/4388157/normal_5fcc451eced93.pdf
    • https://cdn.sqhk.co/libobivole/ijMBvje/mekexusedodadinirujiv.pdf
    • https://cdn-cms.f-static.net/uploads/4454547/normal_5fda90a23bc37.pdf
    • https://cdn.sqhk.co/letarezetap/CKsihKb/40504930244.pdf
    • https://cdn.sqhk.co/kokojisip/ial5yg9/37018888376.pdf
    • http://fofakowusagafo.22web.org/juz_30_sudais_mp3.pdf
    • https://cdn.sqhk.co/vumulevezuf/hd8ha6d/details_of_relatives_form_2019.pdf
    • https://cdn.sqhk.co/wodelaganav/jgqjgYX/zakululaxarorixuxu.pdf
    • https://cdn.sqhk.co/susojareb/MgfihHS/fox_deportes_en_espanol_en_vivo.pdf
    • https://cdn.sqhk.co/pesasotiro/Nqgcjih/iron_causing_itching.pdf
    • https://cdn.sqhk.co/xisalaximel/Oyuiehh/tribal_mania_offline_mod_apk_1._0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e0f910ba-f4aa-4d6b-87f6-24d78cda99ab.filesusr.com/ugd/cc15ef_f2c8a16ebab7485ab05c5191160c5fde.pdf?index=true
    • https://3465328d-eb21-4af5-a94e-b8fdacefaafa.filesusr.com/ugd/c63bf9_f01148419925489fabc804d108d49caf.pdf?index=true
    • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_891330bec4854f3ab3af620cc96f401e.pdf?index=true
    • https://4868a29a-6d77-448d-a9c5-bc5c6a1713c3.filesusr.com/ugd/060e50_bb11b83a07294ae1803ad25b82cbdcaf.pdf?index=true
    • https://f4b9ed98-44c1-44e6-9966-d9817cd43de7.filesusr.com/ugd/9ced5d_9c502c3747e247b9a0862a1cc3d16e79.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015d24.bin
978fc9ab8421c4a0f958f59ec4215d1209e4011d1ea4a9dc28ccad3ead1dbe1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15D24 5564 bytes
font_01_sfnt_off00017003.bin
12be0bf1f24109d7eb9838e4bfacd7e1739682043965219ead87c6e3d3123552		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17003 11860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.