Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b8fbbc4a0e85672…

MALICIOUS

PDF

96.7 KB Created: 2021-04-12 01:18:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 280154ac78abf8b2ca3c5141cc59814a SHA-1: 2b45f5783db501bf21dd8b2cdfb3308b1eb6f4a4 SHA-256: 6b8fbbc4a0e85672833582a880fe44e032f69051366d9010e22012384bfe45cb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. One of the primary external links points to a URL that is likely part of a link farm or phishing campaign. While no scripts were explicitly extracted, the PDF structure and the presence of numerous external links suggest an attempt to redirect users to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=advaita+vedanta+philosophy+slideshare
    • http://dosubodanes.mypressonline.com/jiduva.pdf
    • http://mosomupusafebin.medianewsonline.com/dulatafopufefivosawedunu.pdf
    • http://toxipoxekej.medianewsonline.com/biruzidemazu.pdf
    • http://zevibeponakat.getenjoyment.net/bayes_probability.pdf
    • http://rexuwoxaga.sportsontheweb.net/autocad_fundamentals.pdf
    • http://nikibolerobika.getenjoyment.net/jifegemizusuwaxago.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://beliraguw.onlinewebshop.net/interior_design_book_download.pdf
    • https://s3.amazonaws.com/vuxirefare/21075000704.pdf
    • https://s3.amazonaws.com/votubukaxogilix/41745858333.pdf
    • http://lawewil.atwebpages.com/green_book_script.pdf
    • https://s3.amazonaws.com/jutenojamega/forajusinofapikujawov.pdf
    • http://gafodix.myartsonline.com/2340355724.pdf
    • https://s3.amazonaws.com/lodazojamuva/96562094899.pdf
    • https://s3.amazonaws.com/gulapore/xatewobamarabimexeduzinol.pdf
    • https://234a0c07-d908-4261-bb83-16b3c96a9b04.filesusr.com/ugd/73e0e6_87b9ee28412a444986b398185c658c37.pdf?index=true
    • https://cc46d2ba-e7cf-42f8-aa62-b015a0c17ef0.filesusr.com/ugd/d180c3_c46079e51a984162aa43ea6533cd30c7.pdf?index=true
    • https://f459ab6e-ac57-43ce-b83a-1524846427e4.filesusr.com/ugd/938c70_e68eb4c7d1294061a5418ef9884db95d.pdf?index=true
    • https://s3.amazonaws.com/zamemigojat/bitlocker_win_7.pdf
    • https://s3.amazonaws.com/kovibu/fur_elise_piano_sheet_original.pdf
    • https://33fe1336-4051-433c-b691-b763732126dd.filesusr.com/ugd/6c8f37_d76ccfa944ee495a9c048b695557c3de.pdf?index=true
    • http://kerexiref.onlinewebshop.net/87881050503.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012451.bin
7bdbb86c6efd94788bf78d6370b67517a28476fdb52a228355bd5cddd42d3837		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12451 5196 bytes
font_01_sfnt_off00013604.bin
1ac9460cade82e7ca55b9cf190d16fd15343ec5e5a5c656f68d801bd2370c326		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13604 12164 bytes
font_02_sfnt_off00015fb1.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15FB1 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.