Malicious PDF — malware analysis report

Static analysis result for SHA-256 63bd07dce238490a…

MALICIOUS

PDF

83.6 KB Created: 2021-03-29 00:37:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f5c32379cc4a764c9220674927a7e9bf SHA-1: 781eb2c6fd6815f7e8a48938b0160e4684b198e6 SHA-256: 63bd07dce238490aa615679cd0b6443457b766e1a38c37c5190ff8288a661372
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing or trojan. The embedded URLs, such as 'https://ponafet.ru/wix?keyword=what+does+a+shaded+shape+mean+in+a+pedigree', suggest a lure to trick users into visiting potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=what+does+a+shaded+shape+mean+in+a+pedigree
    • http://x-bionic.shop/shoei_neotec_ii_splicer_tc-2_modular_helmetrj7ke.pdf
    • http://redpandarecycling.com/arsene_wenger_bookjgyia.pdf
    • http://basvuruizleme.online/64851956804fspne.pdf
    • http://bluhgang.best/comparison_of_fractions_worksheets4x588.pdf
    • http://arnautmebel.ru/eternium_leveling_guidevcb5s.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/481ec2f6-b1d0-400d-a797-4aa07ecac4b3/46338813196.pdf
    • https://uploads.strikinglycdn.com/files/693e0ced-3c61-44fa-9b68-f6d9fc16de81/todugunujalozuvilowadigas.pdf
    • https://uploads.strikinglycdn.com/files/c3ff94b0-92a9-4247-9150-d5b7f1711f16/who_invented_cheese_cheetos.pdf
    • https://uploads.strikinglycdn.com/files/477b5866-b2d2-410a-a9b1-430269725a69/how_to_fix_malibu_landscape_lights.pdf
    • https://c30b87d5-e38e-4f4c-8f61-e356d9eaafe8.filesusr.com/ugd/347120_f7289af7955a4b4d9793a1de6c1638bb.pdf?index=true
    • https://s3.amazonaws.com/davolazupivowi/flipkart_online_shopping_double_bed_sheet.pdf
    • https://uploads.strikinglycdn.com/files/64b916f4-f26f-4833-899f-095e843007b7/masterbuilt_30_inch_digital_electric_smoker_with_window.pdf
    • https://uploads.strikinglycdn.com/files/079e5430-379a-4649-bcfa-4e3ac438a751/96662073630.pdf
    • https://uploads.strikinglycdn.com/files/392227ea-5ae9-4c92-867f-0a18258a6ad0/lemilasewivozote.pdf
    • https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_8e3c39c6886046fe8d13f8504bdf2994.pdf?index=true
    • https://uploads.strikinglycdn.com/files/49608399-30bb-48c2-90f5-efe21bfaed95/14472256229.pdf
    • https://s3.amazonaws.com/nafoxuda/89493872658.pdf
    • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_eda78fadffa74fde983e90e82bf2c3d2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a4bb7f7b-8a95-40d0-92d1-66545b6f638d/cat_in_the_hat_costume_mask.pdf
    • https://uploads.strikinglycdn.com/files/53f273e3-d8aa-4b59-9e24-7b16cefc1ed6/husqvarna_435e_ii_parts.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f209.bin
7d6233c8f7fa7e08047f736fe7fb36e7477eccc3d26a261ef1f451a5e9cc12fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF209 5356 bytes
font_01_sfnt_off00010421.bin
19400ed90fff7f75aefc36f8fcfcac415914527ab670b78e26782a08111bfd61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10421 11012 bytes
font_02_sfnt_off000129da.bin
541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129DA 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.