Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ae2dbd5e81408b9…

MALICIOUS

PDF

71.1 KB Created: 2021-03-07 16:58:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3ff63642e5159b78cd6ab2517d2e122b SHA-1: 9d97a3614bd10089e34e9f7d44c85f933c009861 SHA-256: 6ae2dbd5e81408b9bbe92b84dab91117c7e6543f6324c1ec2eae1a58ce151fb5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm designed to improve search engine rankings, suggesting a phishing or malware distribution scheme. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs point towards a phishing or malware delivery mechanism, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=the+closer%2527s+survival+guide+pdf+espa%25C3%25B1ol
    • https://cdn.sqhk.co/kazamepa/ghd8eij/50838949198.pdf
    • http://lufatomitonad.22web.org/zugujozuzif.pdf
    • http://rexevivejegox.scienceontheweb.net/lofomefute.pdf
    • http://kerutugizuxig.mygamesonline.org/goji_smart_watch_manual_dansk.pdf
    • https://cdn.sqhk.co/bexikerez/ihQiaja/funny_voice_effects_online.pdf
    • https://cdn.sqhk.co/semoxumid/heJOOjc/sowade.pdf
    • http://mufutekuson.getenjoyment.net/2008_jeep_liberty_for_sale_by_owner.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6cdf8c5e-36a0-4b6d-987f-32d3d50030cd.filesusr.com/ugd/3c2e2e_5cd3d933703149a19f87b26e3273f75d.pdf?index=true
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_254ab7f08fd64055b4e6e28b5ed5e0d8.pdf?index=true
    • https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_e7b77079099747f09d7f88b6bbc7810f.pdf?index=true
    • http://rejinivak.rf.gd/amino_acids_and_their_structures.pdf
    • https://s3.amazonaws.com/tupofelasujewas/ipl_2019_match_schedule_file.pdf
    • https://s3.amazonaws.com/gotenukevepunin/28506163587.pdf
    • https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_a6186533c20649ad99ac8dfae3fb8554.pdf?index=true
    • https://s3.amazonaws.com/lososimap/company_logo_png.pdf
    • http://zisunajupanege.rf.gd/gikeraw.pdf
    • https://952d9f4b-853a-4e85-af28-23c4d489d487.filesusr.com/ugd/8db125_e2541da4c3064145afbb1dcb8e967ac5.pdf?index=true
    • http://fataragoreb.myartsonline.com/44931412614.pdf
    • http://besowotu.epizy.com/52365667232.pdf
    • https://3dcfbd4a-ef33-49dc-a04a-0aaf5307c30d.filesusr.com/ugd/b47706_242b0373eec147cba1f78b270269abb9.pdf?index=true
    • https://be9c8297-50e9-4ec8-be22-7cc4068ef96a.filesusr.com/ugd/fc3b0b_209777d1f3cb4c76aa8e704f7c677946.pdf?index=true
    • https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_fccbab1ef5f94cc493dc4877f43c722a.pdf?index=true
    • http://zatupux.rf.gd/change_blade_on_craftsman_miter_saw_with_laser.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d646.bin
334c1cd67a427a812b1e82f6b8bc0666ab637a3914a040edf71f614aebdc7f07		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD646 5672 bytes
font_01_sfnt_off0000e95a.bin
0710fc7bc8476d50ef837533e4fd5a0c9ab9c2ed61ab92f6b1659c9828b0d05d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE95A 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.