Malicious PDF — malware analysis report

Static analysis result for SHA-256 64a265c3f7e6a3e2…

MALICIOUS

PDF

72.7 KB Created: 2021-06-01 04:42:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 979d7e00169f3645da238cbad00391bc SHA-1: e923556cf9e3950300f7fb197ac97dd11d89d777 SHA-256: 64a265c3f7e6a3e232646d433acdf4736e2519020e1bc9ff352b1e9f761ea8c3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains including 'pbworks.com' and 'strikinglycdn.com'. One of the primary external URIs, 'https://ketchas.ru/pbw?utm_term=how+to+use+presonus+audiobox+96', suggests a potential phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/pbw?utm_term=how+to+use+presonus+audiobox+96
    • https://cdn-cms.f-static.net/uploads/4454672/normal_600a3f4c9c9eb.pdf
    • https://cdn-cms.f-static.net/uploads/4481397/normal_601b8debc0b0d.pdf
    • https://lapefobok.weebly.com/uploads/1/3/4/6/134663543/japumamu.pdf
    • https://cdn-cms.f-static.net/uploads/4464313/normal_60464c6e443bb.pdf
    • https://static.s123-cdn-static.com/uploads/4459777/normal_5fe44d0a40d1e.pdf
    • https://luludosob.weebly.com/uploads/1/3/4/7/134703274/jodofafirexuwipigi.pdf
    • https://cdn-cms.f-static.net/uploads/4499979/normal_604495b64f6dd.pdf
    • https://static.s123-cdn-static.com/uploads/4453337/normal_5ffb250b3bd80.pdf
    • https://cdn-cms.f-static.net/uploads/4446155/normal_6052813d15a24.pdf
    • https://deriwofapavuz.weebly.com/uploads/1/3/4/3/134311795/1061645.pdf
    • https://wuwepila.weebly.com/uploads/1/3/4/3/134371533/09f26.pdf
    • https://lekinimogasujif.weebly.com/uploads/1/3/0/7/130739945/gimidamuxobusumiwimi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://visetululiv.pbworks.com/w/file/fetch/144423117/79435374831.pdf
    • https://uploads.strikinglycdn.com/files/7d172368-0320-49f5-bba8-5f72bfae4d29/my_name_is_red_bangla.pdf
    • https://uploads.strikinglycdn.com/files/174e18d8-89aa-4b8c-b077-898d4d788b8f/68087893311.pdf
    • http://kekirow.pbworks.com/w/file/fetch/144419583/fekakexurepubawuga.pdf
    • http://sonopewobu.pbworks.com/w/file/fetch/144421047/87252115379.pdf
    • https://uploads.strikinglycdn.com/files/29af9416-7306-4001-ac02-3109bfedd20c/4_past_midnight_discogs.pdf
    • https://uploads.strikinglycdn.com/files/c35f9707-726f-4f42-9320-61372fbe37f2/dofifakanoxim.pdf
    • http://jetipufagi.pbworks.com/w/file/fetch/144438186/88560265807.pdf
    • https://uploads.strikinglycdn.com/files/3f1678f1-d016-4638-8a87-2c60f9c68c5b/how_is_tybalt_presented_in_romeo_and_juliet_act_1_scene_1.pdf
    • https://uploads.strikinglycdn.com/files/347aeaaf-a230-45c8-bb46-da59748417e0/kubota_svl75-2_oil_capacity.pdf
    • http://zogekinovag.pbworks.com/w/file/fetch/144436674/xetapefaxovovivabolami.pdf
    • https://uploads.strikinglycdn.com/files/d6d1b0ac-b7bb-40ec-83ea-9ad9c3176df8/stannah_stairlift_parts.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfb9.bin
fb71ba8e948a76ae036f34d7ba85afc8ba4a5bb3037cceb7739d9550b07fdcc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFB9 5492 bytes
font_01_sfnt_off0000f275.bin
2fb923de9f368d877d1fb9ce78b12087dec1e7d475178a7c09b5288ecb32a6f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF275 10248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.