Malicious PDF — malware analysis report

Static analysis result for SHA-256 62a4791a3aa76ab5…

MALICIOUS

PDF

81.9 KB Created: 2021-06-09 17:08:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55c66df6a3d3fda3b3b8cad6bce60f75 SHA-1: afeae9fe1540e94f640318a6a682c2d16fb1764b SHA-256: 62a4791a3aa76ab5092794dbc9b5691073b691c9769e3a2e004b0f579b1e0c79
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL pointing to a suspicious domain that appears to be part of a link farm or phishing operation. The document body, though heavily obfuscated, suggests a lure related to a 'writing task', likely a pretext for directing users to malicious content. No scripts were extracted, but the presence of many external links suggests the primary goal is to redirect the user to a compromised or malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=writing+task+1+brick+manufacturing
    • https://bonizilolalov.weebly.com/uploads/1/3/4/4/134458774/rotutuw-pufogetigalebo-bokavoxaxa-nosejimuwiwar.pdf
    • https://dexugagemer.weebly.com/uploads/1/3/4/7/134715037/f094da94dd8dd6.pdf
    • https://cdn-cms.f-static.net/uploads/4365652/normal_605b87753fcea.pdf
    • https://cdn-cms.f-static.net/uploads/4463559/normal_60be538168ba8.pdf
    • https://cdn-cms.f-static.net/uploads/4407060/normal_602c96c07a885.pdf
    • https://wibafodutaselo.weebly.com/uploads/1/3/1/3/131380847/5733931.pdf
    • https://pazerutafu.weebly.com/uploads/1/3/5/3/135392620/1146596.pdf
    • https://xinuluparos.weebly.com/uploads/1/3/0/9/130969110/maxaxupepoxowujivol.pdf
    • https://cdn-cms.f-static.net/uploads/4448746/normal_6043332960e9f.pdf
    • https://cdn-cms.f-static.net/uploads/4407562/normal_601a2822b6fc0.pdf
    • https://static.s123-cdn-static-d.com/uploads/4409405/normal_60afe8bbca626.pdf
    • https://zisawotagaxikad.weebly.com/uploads/1/3/4/4/134478332/30f2bf031.pdf
    • https://goxufosoxewuje.weebly.com/uploads/1/3/5/3/135300646/6624585.pdf
    • https://liwemonifeji.weebly.com/uploads/1/3/4/7/134704326/birisodat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ab40ac51-4498-4740-a1b1-090b9441237c/salicylic_acid_face_wash_fragrance_free.pdf
    • https://uploads.strikinglycdn.com/files/3fbd61c4-840d-46b4-9f41-94d6a0f79e1f/elf_on_the_shelf_pets_fox_amazon.pdf
    • https://uploads.strikinglycdn.com/files/2f56bf5d-06d0-4ae7-9e2d-666d4d82cf12/stopping_by_woods_on_a_snowy_evening_summary_slideshare.pdf
    • https://uploads.strikinglycdn.com/files/3dd6097f-36b0-45e7-85f6-409b4d48c1b2/litepi.pdf
    • https://uploads.strikinglycdn.com/files/36386b57-f4f1-405e-8944-a6d64bdeb755/sex_and_the_city_2_cast_imdb.pdf
    • https://uploads.strikinglycdn.com/files/11f3d1b3-4d06-472d-88db-235a910d7974/sakidufariworasikuxiwi.pdf
    • https://uploads.strikinglycdn.com/files/fc935b17-880b-48cc-8478-6c69d362ebe6/buwaxomama.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e992.bin
c2f91e29ac2796c9f66ab6fd2d32f5e1300421ea3eb82d586912b42418ac19ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE992 5092 bytes
font_01_sfnt_off0000fad7.bin
8893d73f9119c5b4320ddf1ad3b62e2ea0d6188fbb47a399094d172faa889ceb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAD7 21724 bytes
font_02_sfnt_off00012be4.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BE4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.