Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a839d3c4a40712d…

MALICIOUS

PDF

84.9 KB Created: 2021-03-30 22:46:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af32a548952b9f0367936bee6199bdef SHA-1: cfd622a2dc690d78f06dedcab4d21c680d69efe9 SHA-256: 6a839d3c4a40712d4e31f099239c5cf43d23108b89df5c0ec44b48a6cd55eab1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file exhibits characteristics of a phishing or SEO spam campaign. It contains a large number of external links, with one prominent URL pointing to a domain known for hosting potentially malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely involving the exploitation of PDF vulnerabilities to redirect users to malicious sites or download further payloads. No scripts were extracted, but the PDF structure itself is indicative of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=you+were+never+really+here+pdf
    • http://puloxev.iblogger.org/43502692826.pdf
    • http://gunodopo.22web.org/logo_quiz_ultimate_level_10_answers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/serogajugomiji/childrens_short_bedtime_stories.pdf
    • https://42190e62-4dca-482d-a077-ae7b222d7779.filesusr.com/ugd/b91392_f6c6ca6a54d34c5aa9cfd6af413d4fc7.pdf?index=true
    • http://wisijogasego.epizy.com/estadistica_para_administracion_anderson.pdf
    • https://cccd2283-d272-450a-840b-6541230ebad2.filesusr.com/ugd/5de1df_41658f7eec5144cf8b9a9751d20e2268.pdf?index=true
    • https://s3.amazonaws.com/numegubowalonan/67467924382.pdf
    • https://09972071-4174-499b-90b1-de3619f59f53.filesusr.com/ugd/d1c05f_cae4535ffd2140518ffa70d0be59c063.pdf?index=true
    • https://s3.amazonaws.com/folexapurilowe/how_long_should_a_kindle_battery_last.pdf
    • https://uploads.strikinglycdn.com/files/973485b5-789c-4cbf-9d4b-68f7580650cb/how_do_i_set_my_water_softener_hardness.pdf
    • https://uploads.strikinglycdn.com/files/b6a58fd5-cb44-4529-a002-9b6b1b3cb634/dewalt_dwe7480xa_review.pdf
    • https://uploads.strikinglycdn.com/files/ef9e22ce-a0eb-438e-a268-89b0af18785f/49584484732.pdf
    • http://wasizematimom.rf.gd/la_charca_restaurante_asturiano_madrid.pdf
    • https://s3.amazonaws.com/tozaduliwubega/xunavurefawujawowonibaji.pdf
    • https://9ec55029-67b1-4fe0-9a5d-40fd638ac594.filesusr.com/ugd/dc5a51_8c79a3cc09944888ac1776829ee3f4fb.pdf?index=true
    • https://s3.amazonaws.com/vovabagubajegeb/international_dump_truck_repair_near_me.pdf
    • http://guxijukamudeze.epizy.com/automata_theory_and_computability_textbook.pdf
    • https://s3.amazonaws.com/farefasejikap/agnes_of_god_play.pdf
    • https://s3.amazonaws.com/leteraxewe/ariens_8hp_snowblower_carburetor_adjustment.pdf
    • https://s3.amazonaws.com/lurutopobi/how_to_get_into_diy_electronics.pdf
    • https://uploads.strikinglycdn.com/files/df9cede6-b03f-4bef-935d-99b5f8f097da/what_does_the_middle_weight_on_a_grandfather_clock_do.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc8a.bin
2a20552f6f43da985d8ff304478f12c7bb1e75049b6a4786fca634f1206534b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC8A 4920 bytes
font_01_sfnt_off00010d53.bin
98537d6f4b562fcbbda405f93baa5dbb7752bbf3a2154aa8722046ee2ba9015e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D53 12696 bytes
font_02_sfnt_off000136b0.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x136B0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.