Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d9ecbb8b3750b8d…

MALICIOUS

PDF

74.0 KB Created: 2021-03-17 14:53:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8dd421de20d1898a3738dd375d6ec979 SHA-1: 7ed541fe935a04d79904fd3c5e2639744eeb4729 SHA-256: 6d9ecbb8b3750b8dd24071b66c337601a0c4ff12348fee09c2f1b8e314afc1e6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM' containing 30 external links. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as 'Pdf.Phishing.Trojan'. The embedded URLs suggest a phishing or malware distribution campaign, likely using a spearphishing attachment as the initial access vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=printable+cd+covers
    • http://zawopim.mygamesonline.org/the_standard_high_line_reviews.pdf
    • https://posajegodat.weebly.com/uploads/1/3/4/4/134477503/jirotigitubepigud.pdf
    • https://lexifodupep.weebly.com/uploads/1/3/2/7/132712330/rusufosa-vojimetanez-fivavaguvuv.pdf
    • http://sufawevugut.mywebcommunity.org/golds_gym_430i_treadmill_will_not_start.pdf
    • http://garanibukumom.scienceontheweb.net/xivuforavewazepavo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_db8891e3159643b4b0b228d26d80c054.pdf?index=true
    • https://b7af6bb9-01eb-4839-ab56-764651de4344.filesusr.com/ugd/2486b5_a0afdc8ff57d4c3288fe7aeee48c0920.pdf?index=true
    • https://5366dd3f-28a3-4342-b8e5-5bed86455aec.filesusr.com/ugd/a92322_4bb7680567944831b017de9054c849c9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3a56012e-32b3-415b-9f43-b83cb5750439/71852503840.pdf
    • https://ecf8b3bd-8201-449f-a39c-156acd88681e.filesusr.com/ugd/97634b_53f991b2b11c431db3a72ceb0e3c2cfd.pdf?index=true
    • https://s3.amazonaws.com/dufekifaral/avengers_1st_part_full_movie.pdf
    • https://de99c131-68bf-4271-bcef-cda292486844.filesusr.com/ugd/f5892c_c5c279463ca541f181f9bfee165e370a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/355d26e4-bceb-407b-b0a1-60b2433b74b9/kejep.pdf
    • https://d5aacb37-8766-4234-9cc8-c2ec3b911aba.filesusr.com/ugd/1e723b_0dc790e5550d4c3689450bcd46370ebe.pdf?index=true
    • https://aabf49e0-5477-4fd2-8456-a986ef8f2a87.filesusr.com/ugd/9e14ca_1a003923bd334a2893d701c7f8915456.pdf?index=true
    • https://f07eb630-23ff-4298-a1df-d7940f1ba2dc.filesusr.com/ugd/097a5b_0226a8e79ebd45d49999ffda7dbfb009.pdf?index=true
    • https://s3.amazonaws.com/falejogajir/zotaweb.pdf
    • https://uploads.strikinglycdn.com/files/76ed53bc-7398-476b-b417-4c73adb68c89/86730987349.pdf
    • https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_5e94318e3cfe48bc8d708000f4a4e1bc.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4c6.bin
d0c4cf8fe775d632e401eac5341b7b7cf8721c1483dfd9d0a89f256a7db84f2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4C6 5136 bytes
font_01_sfnt_off0000f646.bin
2db389e54a94f937e1a5ab5693e2d475f48fc1d7277131ca8e024020d17631f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF646 10644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.