Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bc9279a82807e60…

MALICIOUS

PDF

126.8 KB Created: 2021-05-20 11:11:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55ddf59224bf25c77e7fca9befb912f3 SHA-1: 5d20ebd07d8b0580d5e2f6a56ae1004c732d8543 SHA-256: 6bc9279a82807e60603dab05a96622f639d238364e16f673f5bbacb0e460392b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, identified as a PDF link farm, suggesting a malicious intent to manipulate search engine results or redirect users to potentially harmful sites. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure itself facilitates the attack by hosting numerous URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+read+magazine+at+neighbors+house+in+sims
    • https://mojurakikaluno.weebly.com/uploads/1/3/1/4/131438245/zorukaxit-mazewizide-jiwisozavip-nogopomupos.pdf
    • https://bofeliwibetu.weebly.com/uploads/1/3/2/8/132814086/3350f99.pdf
    • https://vibejatixulaxa.weebly.com/uploads/1/3/4/1/134131444/3439593.pdf
    • https://daradila.weebly.com/uploads/1/3/1/4/131438164/zibawegumozap.pdf
    • https://mizazilat.weebly.com/uploads/1/3/4/5/134528341/bavexak-fazeba.pdf
    • https://nutukotixirijir.weebly.com/uploads/1/3/5/3/135392142/2984938.pdf
    • https://tatudikugox.weebly.com/uploads/1/3/4/7/134738012/datikenam.pdf
    • https://vewudati.weebly.com/uploads/1/3/0/8/130873955/ratakavegal-desefuburivox-sadatidow.pdf
    • https://mivetemadika.weebly.com/uploads/1/3/4/4/134471856/1272735.pdf
    • https://valabokewem.weebly.com/uploads/1/3/5/3/135311070/b78cb.pdf
    • https://nipotowolexitav.weebly.com/uploads/1/3/4/6/134639117/vonamubav-vovosa.pdf
    • https://giwaxevo.weebly.com/uploads/1/3/4/6/134644090/semesomuwusexurewig.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kudufigunabi/63649864554.pdf
    • https://s3.amazonaws.com/nedijowewoded/6694568741.pdf
    • https://s3.amazonaws.com/kovezux/23288740606.pdf
    • https://uploads.strikinglycdn.com/files/81e5fa27-299f-42b9-aeef-5a087c69db36/how_many_calories_in_a_medium_cherry_limeade_from_sonic.pdf
    • https://uploads.strikinglycdn.com/files/79c7801c-7daa-452d-9617-b452adfa6419/amazon_prime_z_the_beginning_of_everything_season_2.pdf
    • https://s3.amazonaws.com/fofeguj/47116579004.pdf
    • https://s3.amazonaws.com/pasawexawinogad/16804777260.pdf
    • https://s3.amazonaws.com/dorobukasawituw/japinulu.pdf
    • https://uploads.strikinglycdn.com/files/bca4aeea-363c-4885-bfed-26f43a727b90/29797174778.pdf
    • https://s3.amazonaws.com/wolina/11787230803.pdf
    • https://s3.amazonaws.com/mizeteb/valuwubaxajediw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019a3c.bin
4c6ded552906366d362e1a4c8238127b4ce7317d3043a7d4d9406083bae9ae07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19A3C 5452 bytes
font_01_sfnt_off0001acac.bin
ed53b17af7f8245de0842d7baf13930b7976e7de7d8e3b07e9772c5b767ce2d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1ACAC 12452 bytes
font_02_sfnt_off0001d64b.bin
5b0d2701ab39d2f69c66d7d16c60d8db0b323aa0832947137e757b5401d27330		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D64B 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.