Malicious PDF — malware analysis report

Static analysis result for SHA-256 67a832f90011897a…

MALICIOUS

PDF

78.2 KB Created: 2021-04-06 08:04:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a45b7db080da00d546597eba3304309 SHA-1: 2aa108ad9b4ccb08b5555557e144be4b6f720938 SHA-256: 67a832f90011897aecd889b280d44b613c6e6da642fae41331208a93be91964a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' indicate the document's purpose is to redirect users to external sites, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=video+from+dailymotion+android
    • http://krokoboko3.xyz/25275913372v3nhh.pdf
    • http://tehnotop.store/55690798357igfpx.pdf
    • https://riguniliwegab.weebly.com/uploads/1/3/5/3/135342973/fc7394.pdf
    • https://kexofoxofoxo.weebly.com/uploads/1/3/5/3/135318322/reguvaka.pdf
    • https://kenaveduku.weebly.com/uploads/1/3/0/8/130813649/gujageje.pdf
    • https://jawuvufos.weebly.com/uploads/1/3/4/8/134856807/sebemagugivozenem.pdf
    • http://epaytds.xyz/42947834260zla6q.pdf
    • http://e-devletodeme.net/9905126782h4phg.pdf
    • https://tonituligavu.weebly.com/uploads/1/3/4/8/134884188/4701422.pdf
    • http://ijmalan.xyz/lost_in_space_the_frontier_mod_apk07c9n.pdf
    • https://wubedalenab.weebly.com/uploads/1/3/1/3/131383767/8d4c4a4f999367a.pdf
    • https://wavuzujez.weebly.com/uploads/1/3/1/4/131406867/2281446.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wujanozo/how_to_work_dr_brown_sterilizer.pdf
    • https://369206df-e466-4f8f-9771-850d1edb33c5.filesusr.com/ugd/8fd5dc_f8fa02ad15bb4c0897bb912dbba0d62c.pdf?index=true
    • https://s3.amazonaws.com/folexapurilowe/the_darkest_minds_book_series_review.pdf
    • https://c580675e-8888-491d-8c80-3106eaac86fb.filesusr.com/ugd/c8a981_869f47c0a0124d1da4de5334370b43a2.pdf?index=true
    • http://tuwetixa.epizy.com/hr_interview_questions_and_answers_for_fresher_candidates_free.pdf
    • http://didefiwofiko.rf.gd/jizuturaned.pdf
    • https://237a2310-9536-43ad-add1-fe73b840a51a.filesusr.com/ugd/8b319d_8ca257404d124a8e965a60bd8e33a062.pdf?index=true
    • http://sexudebe.epizy.com/how_many_cubic_feet_is_an_apartment_size_fridge.pdf
    • https://321e46d8-a3e9-4523-905f-b0dcd1dcb7ef.filesusr.com/ugd/29fbc3_f85d5c475d09441a89a14f61ce00b044.pdf?index=true
    • https://s3.amazonaws.com/farefasejikap/excel_to_vcf_converter_android_app.pdf
    • http://solodiwamu.rf.gd/15725452651.pdf
    • https://s3.amazonaws.com/vuraradaso/bangladesh_vs_afghanistan_match_report.pdf
    • https://s3.amazonaws.com/libusamagowuvo/aplikasi_to_word_apk_pro.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f541.bin
b1f881322a4f6bd42f0c9c86dee3f583883630abe7c9f13d36a3a37b7716c8e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF541 4940 bytes
font_01_sfnt_off000105ff.bin
441b59971667aea4cc937584dd0f9ebc811024651ba9076ea94262578b563ad5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105FF 10920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.