Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dcc3b61ca9afef2…

MALICIOUS

PDF

75.6 KB Created: 2021-03-19 19:56:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ccf0782c556e73ce7cc3417c2c57973a SHA-1: 55db26f3b7c2ccbd69e4d3f7d020d6e2bb16bbef SHA-256: 6dcc3b61ca9afef217d1f4a868d0afa06e5ffb92f6da6dbc2fa2f7f50e425b32
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, a technique often used in SEO link farms to manipulate search engine rankings or to hide malicious destinations. One of the primary external URIs, 'https://pelibifir.ru/wix?keyword=magic+bullet+manual+espa%25C3%25B1ol+pdf', is flagged as suspicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=magic+bullet+manual+espa%25C3%25B1ol+pdf
    • https://static.s123-cdn-static.com/uploads/4460048/normal_5fc8d159e1245.pdf
    • https://cdn-cms.f-static.net/uploads/4378834/normal_60217d4b248b8.pdf
    • https://static.s123-cdn-static.com/uploads/4450502/normal_5fc5bed176a7a.pdf
    • https://cdn-cms.f-static.net/uploads/4416796/normal_603688f39f7af.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8bfb5976-804a-4f08-b278-31d4a505a07d/farewell_my_lovely_film_plot.pdf
    • https://uploads.strikinglycdn.com/files/bafea769-4899-43b1-9120-8337a392cf96/55613931928.pdf
    • https://adc0bc6f-2b4d-4951-bce0-9128d215fa34.filesusr.com/ugd/5ea4d5_cc3dbad98ef645c3b2a62fd658d7b88a.pdf?index=true
    • https://s3.amazonaws.com/zazelujeju/asus_p7p55d-e_deluxe_ram_compatibility.pdf
    • https://uploads.strikinglycdn.com/files/07a31666-1c55-453e-96e1-4b9ccacb2ed0/dna_tree_of_life_tattoo_meaning.pdf
    • https://4647adb0-9c01-46a1-aef1-4380d5873f13.filesusr.com/ugd/edb4a7_6f23080453374ddda7edfd8fa004dc5b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c45a5595-e979-4ff2-8de9-ba0ff8e2a2f2/ocarina_of_time_3d_fire_temple_walkthrough.pdf
    • https://uploads.strikinglycdn.com/files/fa2ee5f2-db70-4cf5-84b2-558394a1d170/organic_chemistry_exam_multiple_choice.pdf
    • https://s3.amazonaws.com/lijopavexanuse/how_to_pray_the_rosary_for_a_deceased_person.pdf
    • https://uploads.strikinglycdn.com/files/93c2745d-2a44-43bb-8ab0-35e2fa43ffdd/famuwubopapepafufob.pdf
    • https://d064ede3-316f-4d13-8ec5-014b2136b3bd.filesusr.com/ugd/154db6_3f4416b0dc9c4966b8e9a5ee6cbe6e80.pdf?index=true
    • https://uploads.strikinglycdn.com/files/02f0932e-be54-420e-a7c2-860aa951d84a/are_participation_trophies_a_good_idea.pdf
    • https://uploads.strikinglycdn.com/files/4b640ba7-905a-4831-abfc-09c8b326cdb7/13654678808.pdf
    • https://70010cfe-69b1-4fe9-a336-bdfe2418dc1e.filesusr.com/ugd/f1d680_0671744f1977411cb9137a551c1a890c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ab5fbe25-a23f-4b99-9cc3-6218762dd8aa/quanto_custa_uma_lamborghini_aventador.pdf
    • https://uploads.strikinglycdn.com/files/14acc737-b6b6-4dca-b4aa-1822e8a95b90/fresh_mechanical_engineer_jobs_in_oil_and_gas.pdf
    • https://uploads.strikinglycdn.com/files/db0f38d3-0d6d-44b2-80df-1d0ccb083c93/nikon_digital_camera_d40x_user_manual.pdf
    • https://uploads.strikinglycdn.com/files/c0f177ac-5d04-40e0-b0a7-9aa258670d2e/equality_before_law_define_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/d8e4c3b4-e9bd-44c8-85f5-510d20fcbc2a/chez_nous_textbook_5th_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5de.bin
d7f82efa1d611d8966e0d9551a18e957e48966d90ad0973c59996968dcb12c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5DE 5736 bytes
font_01_sfnt_off0000f91b.bin
d6a1873ed61aa7b358d13a3ab5ac6e187f85f905d47c7fc2b20cab068ddfa1d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF91B 11660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.