Malicious PDF — malware analysis report

Static analysis result for SHA-256 689d037af33640b0…

MALICIOUS

PDF

79.1 KB Created: 2021-03-12 12:34:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 485b50cb7056d7d3ed585102403d7a87 SHA-1: ef26bd5d958863ef9f6b0273598677ddda564a53 SHA-256: 689d037af33640b0622ddfb2105d81c35e7cbe38d44283bd49e062ec39fad949
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous external links, with one heuristic specifically identifying a 'link farm' designed for SEO poisoning. The presence of a 'download button' lure and ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a malicious intent to trick users into downloading further malware. The ML classifier output of 0.994992 further supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=bihar+si+previous+paper+pdf+download
    • https://zozutogumudeke.weebly.com/uploads/1/3/4/4/134440166/1788753.pdf
    • https://cdn.sqhk.co/mekaxosur/dHwlidz/dojeve.pdf
    • https://gixatupugibezi.weebly.com/uploads/1/3/5/2/135296842/cd57a0b8a540c4.pdf
    • https://cdn.sqhk.co/xugosovemi/jfjhQji/diversity_and_inclusion_best_practices_2018.pdf
    • https://kotedeturu.weebly.com/uploads/1/3/1/6/131606402/afa3b9fcb7b3.pdf
    • https://lemoxubasox.weebly.com/uploads/1/3/4/3/134329143/putawugu.pdf
    • https://cdn.sqhk.co/mojikeke/igngjwW/biketovutotefulirokep.pdf
    • https://cdn.sqhk.co/zubavagi/ijiin8A/smoji_face_of_emoji_avatar_makers.pdf
    • http://bapupozizevose.22web.org/mystudentbody_answers_alcohol.pdf
    • https://rujunile.weebly.com/uploads/1/3/2/7/132710621/sidumozi_tebabitaxetu_joxudu.pdf
    • https://cdn.sqhk.co/zumedizojas/Yiekij8/rally_fury_extreme_racing_hack_mod_apk_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://tedijafubivot.epizy.com/jivukabopawodog.pdf
    • http://pitalonefizat.rf.gd/sony_trinitron_21_inch_tv_price.pdf
    • https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_f72330a2420a44feb5b919deef20beef.pdf?index=true
    • https://9e7b01ce-91ce-414a-93c5-ade8df4b7359.filesusr.com/ugd/cfbfd2_42e2d9d3fa464e0dbf541a3c024e75aa.pdf?index=true
    • http://kigetivizaru.epizy.com/how_much_is_a_thermal_fuse_for_maytag_dryer.pdf
    • https://a9864912-ad24-422b-99f3-2d90f7703507.filesusr.com/ugd/d6af85_ac724aa8d255411db27dab4ceae93291.pdf?index=true
    • http://jegelafaxorew.rf.gd/kewikob.pdf
    • http://zugawixiwo.rf.gd/49961752322.pdf
    • http://kirigawegugava.epizy.com/70322615629.pdf
    • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_8276aa9094bc4176b1b193c5f0c8f041.pdf?index=true
    • https://ced6af22-cf5f-4df0-9cd6-2d424634d287.filesusr.com/ugd/3eed2b_1e33b07a44834292beeefdd2e64071de.pdf?index=true
    • http://xaramoturowuf.rf.gd/2010_chevrolet_aveo_owners_manual.pdf
    • https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_b68a80e81ac5435b851ddf3bd8bf26c0.pdf?index=true
    • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_1d54590c3bf741c5a99c0e5d0761bf4b.pdf?index=true
    • http://latilofu.rf.gd/bekhayali_video_song_female_version.pdf
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_2143ca0f9bd34156abe8d30f1828b827.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebcd.bin
6ae5b26708fdf2f723ceb43a2938e45111507fb9d213e90cd7e4585e4630cfa0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBCD 5132 bytes
font_01_sfnt_off0000fd45.bin
38b5ad85a1d98588104480b923100e696e073ef78a68b7bdce22af105cb5bc4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD45 10368 bytes
font_02_sfnt_off00012083.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12083 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.