Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c3a8e7f8308041e…

MALICIOUS

PDF

138.2 KB Created: 2021-03-30 15:32:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 305cfbf1269cba91dd2a9ae11f6ad880 SHA-1: e02f357fdecb4c57412fe324bb555cc7045a1871 SHA-256: 6c3a8e7f8308041ea5061e5f01d4b3768b2edefd8598dc02328c26491d0ad50e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic firing for a 'PDF_SEO_LINK_FARM'. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically phishing or trojan activity. The embedded URLs suggest an attempt to redirect users to potentially malicious sites for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=mp+vyapam+calendar+2020+pdf+download
    • https://cdn.sqhk.co/rokabumake/cihgjT7/roald_animal_crossing_new_horizons_popularity.pdf
    • https://cdn.sqhk.co/viwiratoposu/ighiiDf/pics_of_ben_10_cartoon.pdf
    • https://cdn.sqhk.co/fabukujeb/gjjbjiq/volopagoj.pdf
    • https://cdn.sqhk.co/dagorabowixu/fg4iajd/rifujofagogavegawanebub.pdf
    • https://cdn.sqhk.co/sunomedude/imgjjib/ketepipofunoganewo.pdf
    • https://cdn.sqhk.co/jaxugaveg/aRHjeCT/free_ds_emulator_for_android_6_roms.pdf
    • https://cdn.sqhk.co/talexadu/2QSNfii/52459750118.pdf
    • https://cdn.sqhk.co/buzomesil/ehfRXig/87459237311.pdf
    • http://gosologesegob.iblogger.org/martial_artist_stretch_routine.pdf
    • https://cdn.sqhk.co/sisowufabo/mMnrTic/homemade_ice_cream_recipe_made_with_condensed_milk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://0aa989e7-076c-475f-bc22-fff5ae310860.filesusr.com/ugd/b44be6_4059eee1cd1c4085a65fb50d31b21eba.pdf?index=true
    • http://mezexefobotero.epizy.com/video_player_hd_all_format_apk.pdf
    • https://uploads.strikinglycdn.com/files/b529ce2f-4b20-4bbd-b517-a4ed726fedb7/70303305364.pdf
    • https://12c21f6a-324e-488c-af83-7e1076049286.filesusr.com/ugd/e84f25_6990ad25a3ac4b9fafec9a0df2847a33.pdf?index=true
    • https://f1ddcea9-c323-452c-a4d3-aaefec61e50a.filesusr.com/ugd/defd8a_e0dc056af9d14435a3401edb1f361370.pdf?index=true
    • https://s3.amazonaws.com/vavabi/22188614150.pdf
    • https://uploads.strikinglycdn.com/files/f917563d-1b9d-4c4c-b713-a77fcc862da6/child_of_god_lyrics_bonner_family.pdf
    • https://s3.amazonaws.com/jaxesabi/orangutan_jungle_school_tv_guide.pdf
    • http://tagugatukosag.epizy.com/ayo_and_teo_reverse_videos_free.pdf
    • https://s3.amazonaws.com/latufenaw/62693919341.pdf
    • https://uploads.strikinglycdn.com/files/97056b1b-133f-4482-a479-331cb446999a/how_to_simplify_exponents_and_radicals.pdf
    • http://nonibil.epizy.com/63521498164.pdf
    • https://s3.amazonaws.com/fukezavazuj/bmw_z4_2008_bluetooth_operation_manual.pdf
    • https://s3.amazonaws.com/xojafemori/nexa_bold_italic_font_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001bfc7.bin
b5d40a3e43fae6dcc8d01587485bcf54a1bb9678699eb2e67044aba4277455c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BFC7 5656 bytes
font_01_sfnt_off0001d320.bin
dea403f15dcd7b678cce6085e669e24932cf2fa76f65f6824fc4b2bbe4deb62b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D320 10700 bytes
font_02_sfnt_off0001f7f2.bin
3ba4b29cfea1b80af963e361d391a2a2f50d1b3c1d23c009a80e93b9b7aa2b85		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F7F2 10084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.