Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d83802a6d932095…

MALICIOUS

PDF

77.2 KB Created: 2021-04-02 20:58:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5f371a805ccb7f25732f7ed689e04c1 SHA-1: 9e0dbab7ea6e5702cc153972de75307321fcbe5f SHA-256: 6d83802a6d932095c564d7b6f6d0dba7b5c62058373facda3fb452fe344af1d2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used in link farms or phishing campaigns to direct users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a mass of external links, suggesting a manipulative purpose. While no scripts were explicitly extracted, the presence of external links and the ML classifier's high confidence score point towards a malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=endocrine+system+test+questions+and+answers+doc
    • https://cdn-cms.f-static.net/uploads/4408340/normal_6055192ba6e83.pdf
    • http://wimesuzajomos.mypressonline.com/honda_livo_bike_spare_parts_price_list.pdf
    • https://widosutolitidaf.weebly.com/uploads/1/3/4/8/134847614/divifexobepuko.pdf
    • https://cdn-cms.f-static.net/uploads/4392472/normal_605838b093510.pdf
    • https://buneresax.weebly.com/uploads/1/3/4/4/134478328/xapijikawad_vufeg_povewogel.pdf
    • https://cdn-cms.f-static.net/uploads/4505326/normal_6041fa5822fd2.pdf
    • https://cdn-cms.f-static.net/uploads/4407664/normal_602a71664b145.pdf
    • https://cdn-cms.f-static.net/uploads/4369909/normal_600b6d6759920.pdf
    • https://cdn-cms.f-static.net/uploads/4379034/normal_60580de9a2524.pdf
    • http://bajesiradevo.getenjoyment.net/63729076103.pdf
    • https://cdn-cms.f-static.net/uploads/4460706/normal_5fe69e6338dda.pdf
    • https://cdn-cms.f-static.net/uploads/4387826/normal_60102d4211de7.pdf
    • http://segaruzobuguses.scienceontheweb.net/oil_producing_countries_in_africa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/beaabcdf-feb5-45c7-8e60-add33afd572a/what_does_lt_on_a_chevy_mean.pdf
    • https://uploads.strikinglycdn.com/files/ea0e3222-7f5a-44f9-a129-fc957bafaddb/vukiwizusafuvezejesixose.pdf
    • http://likasuretaw.onlinewebshop.net/hand_foot_mouth_disease_malaysia.pdf
    • https://8650d040-a33d-467d-a608-6706f181f11b.filesusr.com/ugd/61b8bf_b977efbd11184880ac839f0f5e9483b8.pdf?index=true
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_2de28639f4fd4db8b7a594fb8cc6f7fd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/09627ea8-08a0-4249-bb8e-97fb07534081/61322335709.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000103e9.bin
42b62f09354f1351194407318917d5766f1846a07360167fb39c001595c2d750		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x103E9 20052 bytes
font_00_sfnt_off0000ce86.bin
f6bde02b35f7a0ae6385cf9bcb77c1b73334859d1812601afbe425e732edd5d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE86 5328 bytes
font_01_sfnt_off0000e0a2.bin
5026eeef74f18c5456dea4cf791d49df83ab039af3e89af4dfe8da823d4679f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0A2 10304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.