Malicious PDF — malware analysis report

Static analysis result for SHA-256 6be1d8a7cd1ed557…

MALICIOUS

PDF

77.9 KB Created: 2021-03-06 16:21:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab18ddb3060d961b51ade2dceca4ac00 SHA-1: 93a1ad35458f69c6b62a605d926deff4d7f85906 SHA-256: 6be1d8a7cd1ed5570a41fdf372d70f2942f4a1164c24e8fdc645e94e522e5d3f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a "PDF_SEO_LINK_FARM" heuristic, suggesting a malicious intent to redirect users. The presence of an embedded URL and the ClamAV detection as "Pdf.Phishing.Trojan" further support a phishing or malicious redirection attack. No scripts were extracted, but the structure and URL patterns are indicative of a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=origami+flower+bouquet+white
    • https://static.s123-cdn-static.com/uploads/4418185/normal_5fdda8eddffe2.pdf
    • https://static.s123-cdn-static.com/uploads/4428052/normal_6006d767305f0.pdf
    • https://cdn.sqhk.co/vetesomiw/jhplMGU/snakes_and_ladders_online_dice.pdf
    • https://cdn.sqhk.co/durotula/jaMP3jc/35912362199.pdf
    • https://cdn-cms.f-static.net/uploads/4488335/normal_5fe912be273d4.pdf
    • https://static.s123-cdn-static.com/uploads/4451355/normal_5ffa93e6ad0ef.pdf
    • https://static.s123-cdn-static.com/uploads/4366341/normal_5ff2cb4f322dc.pdf
    • https://cdn.sqhk.co/vovewotutal/ieFggjd/cyberpunk_city_wallpaper_1920x1080.pdf
    • https://cdn.sqhk.co/novimabe/kXigOif/bloxx_craft_girl_game.pdf
    • https://cdn-cms.f-static.net/uploads/4413120/normal_602d39803a79f.pdf
    • https://static.s123-cdn-static.com/uploads/4446287/normal_6002d17c3af35.pdf
    • https://cdn-cms.f-static.net/uploads/4413835/normal_60145aaf44d3e.pdf
    • https://static.s123-cdn-static.com/uploads/4473938/normal_5ff3501b294b8.pdf
    • https://cdn-cms.f-static.net/uploads/4494430/normal_5fdacdca6df55.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d7ae471b-a447-437d-81b4-4e603f8679d9.filesusr.com/ugd/0a3240_0d8bf8de90644fedbaa45b0207009e92.pdf?index=true
    • http://vexabimumemig.atwebpages.com/how_to_install_fastway_e2_hitch.pdf
    • https://2cfcb734-ec62-4cd9-b61c-03d4762ad765.filesusr.com/ugd/a891c0_df5f49a45a4a4cefa4f7a177c624b95f.pdf?index=true
    • https://5637a596-61ce-4e67-8953-8fd9cb84b940.filesusr.com/ugd/c20ea7_f28bb2445002429398cd6fbbb94b1962.pdf?index=true
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_df252d9d750a4220bac209bc2c64ce21.pdf?index=true
    • http://kisalonokexiwi.atwebpages.com/jesus_was_an_only_son.pdf
    • https://4ac36a2f-1533-488b-b282-cf34cdace458.filesusr.com/ugd/bcfc12_d20142bc01ee482f9ddac020b8845a30.pdf?index=true
    • https://bf6af823-cb0d-4ee8-9d5b-4f0b1de5ed24.filesusr.com/ugd/9eb187_24b62a2a60a545a29f87660075bd1a5b.pdf?index=true
    • https://4192d618-ecd7-4808-8485-efd4d6773ded.filesusr.com/ugd/17a5db_65b4d881a5cf45a7b48e8440905c46b0.pdf?index=true
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_7c12e41ac7344bbc8640259b9e8692d5.pdf?index=true
    • https://22520ec4-2132-45a5-98b8-54db1b71d3ea.filesusr.com/ugd/b33b96_b055ce7aa2ba459b8beca4d136e26774.pdf?index=true
    • https://167c2301-eccc-4e3a-a609-38a4f17b9bf8.filesusr.com/ugd/b1dabf_c4ca763a28474fe694ce4b61ea7d770e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4c0.bin
7c190531ad2e868799a99ceb2092c4cc91e34a6ecb4dee2d175a730b14574eeb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C0 5388 bytes
font_01_sfnt_off000106fb.bin
17436bfb73113f891798577dd17181aee329c32b921af863ddbe79aba51be5b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106FB 10228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.