Malicious PDF — malware analysis report

Static analysis result for SHA-256 69421bef24daacb4…

MALICIOUS

PDF

78.4 KB Created: 2021-03-20 04:41:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0e662f00de2eef06faf6b77a8dbe0d2b SHA-1: ed89ed50c79e1ef1a5c30fc061d44188593e5128 SHA-256: 69421bef24daacb4f7d44f818db15ee566650a1c46bf54eec0dba2934554fb28
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to suspicious domains, indicating a link farm or phishing attempt. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest an attempt to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=magnetic+dry+erase+board+sheets
    • https://fojexoduzasob.weebly.com/uploads/1/3/4/6/134693365/4519138.pdf
    • https://surupipenip.weebly.com/uploads/1/3/1/8/131856971/65fff.pdf
    • http://korecos.ru/cisco_firepower_6._2._2_configuration_guide78pk6.pdf
    • https://lozukiwilef.weebly.com/uploads/1/3/4/6/134644014/7041489.pdf
    • http://jushq.pro/mac_cant_find_ue_boom3oj1u.pdf
    • http://lavka-karamel.ru/gunofikotixajqrds.pdf
    • https://rorobobadewa.weebly.com/uploads/1/3/1/1/131164171/bopoxopizin.pdf
    • https://sugowixo.weebly.com/uploads/1/3/4/5/134588459/jolerumeleju.pdf
    • https://temazojirilezin.weebly.com/uploads/1/3/2/3/132302863/8773314.pdf
    • https://tevunuxewime.weebly.com/uploads/1/3/1/4/131452804/satixilosazofa-xezatorosobaba.pdf
    • http://esportzmlevent.com/moon_river_lyrics_frank_ocean_traduction7yqy9.pdf
    • https://pananufizusa.weebly.com/uploads/1/3/4/4/134445813/6eee7cf8e5.pdf
    • https://kererivodukeje.weebly.com/uploads/1/3/5/3/135303009/sivubufut-xujizit-getasem-dewinudiz.pdf
    • http://waystep.site/icao_annex_13_investigation_template7ljfa.pdf
    • https://baduripafab.weebly.com/uploads/1/3/4/6/134623558/f51d96ae65b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1b65b899-5fad-42bd-af9e-a3fb1d6a4c80.filesusr.com/ugd/a2ebd8_d37dc4afd0994a088d6114dac892a16c.pdf?index=true
    • https://ef4b221f-cfb4-47e8-bf1d-3b5092770df7.filesusr.com/ugd/4948da_4c3be70876b849559f90162477a1a413.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ec7ae01e-35da-4735-9f38-08bf848b8438/kakulikifase.pdf
    • https://uploads.strikinglycdn.com/files/f2aa6f7c-08fd-41e6-a4d2-8b5fbe6d5291/86681182178.pdf
    • https://s3.amazonaws.com/jadudusujuje/66912301608.pdf
    • https://uploads.strikinglycdn.com/files/de2bbfc5-4c69-47ed-9738-76351599a4a0/troy_bilt_6000_watt_generator_carburetor.pdf
    • https://s3.amazonaws.com/juwofuxufijup/reference_page_template_for_research_paper.pdf
    • https://ced6af22-cf5f-4df0-9cd6-2d424634d287.filesusr.com/ugd/3eed2b_6b5450ddecb241678848a20dd786ba16.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e01c831d-e33a-48fc-ba20-4eb38bc20fd6/line_6_spider_v_240_head_review.pdf
    • https://4ceac43d-3374-4736-8926-b47930641487.filesusr.com/ugd/3b1191_c2d26d1896af4a4f833b4393c6c1e254.pdf?index=true
    • https://s3.amazonaws.com/nosepevozux/93595816396.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f205.bin
d19014d310948d4c4d9b1b79fff0103379f75281f84cc4a43791b66fa3e5fdbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF205 5416 bytes
font_01_sfnt_off00010478.bin
c57eec1f76736cc779277c0f68827dbe31fc64ec43e8f4376cbe8ed07ee2856e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10478 11152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.