Malicious PDF — malware analysis report

Static analysis result for SHA-256 69d51436bce35e61…

MALICIOUS

PDF

72.3 KB Created: 2021-03-13 14:19:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9505efce484e3f51217784ca206b02a3 SHA-1: b27a13438a02ef990c7568359b0f5064fa25c858 SHA-256: 69d51436bce35e61b648605ac210224e6323628db97ab9ab33175cf2e307341f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, identified as a phishing and malware distribution attempt. Heuristics indicate a link farm and a high ML score for maliciousness, further supported by ClamAV detection. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=lirik+berkibarlah+bendera+negeriku+pdf
    • https://cdn.sqhk.co/ketalidukepi/gexQjiu/22285449718.pdf
    • https://cdn.sqhk.co/raluzafa/hitjijb/colourpop_amaze_super_shock_shadow.pdf
    • https://cdn.sqhk.co/fabozesemi/h2LPiiR/lekab.pdf
    • https://cdn.sqhk.co/zasokolof/djbQjey/29012104282.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1ffa3996-9af9-43d1-95cd-2a59a2cff0ea/77757398623.pdf
    • https://979cd01f-16ea-4d2c-b189-234964c95597.filesusr.com/ugd/d4c4cf_24f43e73800d460295e6f9934d53458d.pdf?index=true
    • http://bumazuk.rf.gd/2363122432.pdf
    • https://uploads.strikinglycdn.com/files/df0a7554-2bd7-4f7c-bc5f-c391dc006338/lights_out_cast_david_spade.pdf
    • http://kagubosewox.epizy.com/lesson_4_forms_of_government_answer_key.pdf
    • https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_fda3b348ce384530aa2a72b1a0dd9652.pdf?index=true
    • https://58eafb2e-ea74-4523-a1b2-d2e0fe9bfe54.filesusr.com/ugd/466fa0_9067f1ed3e914c91a7f0f1d0b327df14.pdf?index=true
    • https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_104af3b8d063408e8052dbb968ab56dc.pdf?index=true
    • http://satovatusewonaw.rf.gd/is_quite_well_better_than_well.pdf
    • https://s3.amazonaws.com/tixedujegibex/proform_treadmill_repair_help.pdf
    • https://s3.amazonaws.com/tamobalasu/oxford_english_grammar_book_free.pdf
    • https://7fe1f042-206b-4735-a408-f56337efeeb4.filesusr.com/ugd/d34b51_b8971032d79247b8bf021356feb7a646.pdf?index=true
    • https://314f4944-3dd9-45af-b5ee-fc7f46c963e4.filesusr.com/ugd/73cb9e_1a0791a405f34a6286b4fa914958178d.pdf?index=true
    • https://s3.amazonaws.com/jupevuxirapi/probability_worksheet_for_grade_6.pdf
    • https://uploads.strikinglycdn.com/files/45b9ddcb-a26f-426f-a1a5-f7a667ed626e/4066589695.pdf
    • http://bumunosusub.epizy.com/89944052233.pdf
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_b81a24567e6946a699ff906346a92065.pdf?index=true
    • https://s3.amazonaws.com/zatazewoz/java_de_64_bits.pdf
    • https://8c285b57-3156-47ce-881b-df665acc117b.filesusr.com/ugd/8d46c2_9a80c64094e44e449e08c417785c1af4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/af685061-afe0-4adf-9654-29bdff68d224/wopiga.pdf
    • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_2e2a672d6b554ddca8ab61467f2c3741.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c71e99e6-6bca-4fba-91bd-e1bdff85c8cb/73477485214.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd44.bin
c88687387980b733a23dda7c8492b3865ad419d4e8c7ea1171cc65ebeec8a1d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD44 5272 bytes
font_01_sfnt_off0000ef29.bin
27c4e6e7c0566054ad8f659f143d2b66a5bfcf3d676861d2aa676e4b111f3d67		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF29 10520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.