Malicious PDF — malware analysis report

Static analysis result for SHA-256 69d434ab67524a05…

MALICIOUS

PDF

78.2 KB Created: 2021-03-14 23:47:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f762d32de21e103d3eae26c79ea01f3 SHA-1: 5bf471cb9bd79370f1993a55776cdf6f6c0e5b37 SHA-256: 69d434ab67524a058c54ec2828cd3189f5f83770e08b3f6e826f34ee98891233
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-themed, suggesting a link farm or phishing attempt. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and numerous external links indicate a malicious intent to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=water+absorption+test+for+concrete+pdf
    • https://dipupobelazaw.weebly.com/uploads/1/3/1/3/131380354/541643.pdf
    • http://wijasagasipode.getenjoyment.net/woluluv.pdf
    • https://fitatopiwize.weebly.com/uploads/1/3/0/7/130739398/a9181b.pdf
    • http://fazoluniguket.iblogger.org/in_the_mood_for_love_soundtrack_analysis.pdf
    • https://mazazujusuvazix.weebly.com/uploads/1/3/1/8/131856432/bifirovunew.pdf
    • https://warevinigipa.weebly.com/uploads/1/3/4/8/134898994/jerixe.pdf
    • https://gemudafaleg.weebly.com/uploads/1/3/1/8/131856492/3929638.pdf
    • https://puxipevabama.weebly.com/uploads/1/3/4/3/134308905/xuvefox-wojosinebivex-gufegiwolib.pdf
    • https://todoxaladavefuk.weebly.com/uploads/1/3/4/5/134529573/7282416.pdf
    • http://bolagafub.iblogger.org/gajenasidokolotosebituzi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pozonijegexovu.epizy.com/acrok_video_converter_ultimate_manual.pdf
    • http://dafudezukixoz.epizy.com/buddynice_2019_album.pdf
    • http://tumapaluk.rf.gd/acca_f9_financial_management.pdf
    • http://xakagigoneliv.myartsonline.com/agenda_2020_united_nations.pdf
    • http://somizifiwij.epizy.com/foduladesagisirigawifadel.pdf
    • https://ded05c8b-f0d8-42bc-a64b-daa0b63394ca.filesusr.com/ugd/99afdc_ff14d3129e69450bbbd74d0170d1baa4.pdf?index=true
    • http://kifesafijupesob.onlinewebshop.net/sepimexivibugufutux.pdf
    • https://3228dc58-b2c1-4aed-ac20-03fc52793822.filesusr.com/ugd/43afbb_2df654cf854541c188331553b0fdd857.pdf?index=true
    • http://zaruxokogidut.epizy.com/which_alcohol_is_not_haram_in_islam.pdf
    • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_9735651555f348db87bf56500f4e108b.pdf?index=true
    • https://3d3b31fc-6152-41c7-b1d4-a4af3afcce63.filesusr.com/ugd/3f8d85_69c2f8b3728b487090f17614c0f3246f.pdf?index=true
    • https://be9c8297-50e9-4ec8-be22-7cc4068ef96a.filesusr.com/ugd/fc3b0b_9d800c64f67846629b979e2d148596a7.pdf?index=true
    • http://fuzonojidufube.epizy.com/human_development_across_the_lifespan_book.pdf
    • http://zimopup.myartsonline.com/fosusawedirawozotuvuxu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f352.bin
1ab626248638bf62a56c8cf370947a2338e6408b337e3c091c5f4181a93d9a15		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF352 5272 bytes
font_01_sfnt_off00010556.bin
d12f0e820c1a073bc4cced643e8f30467e9a353bf35e9841628f9987ec0547ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10556 10496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.