Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f06a637acce5b47…

MALICIOUS

PDF

79.4 KB Created: 2021-06-01 02:54:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df043ea01c74dcfe520e03ffc9215634 SHA-1: 23a8f673339cf5891a9e34793a480650d97ea488 SHA-256: 6f06a637acce5b477bf952dbe0a79fef70873fbe2d1278baf7b977f5bca6bc54
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, with the primary heuristic identifying it as a PDF SEO link farm. The embedded document body, though truncated and obfuscated, suggests a lure related to accessing information, which is consistent with the link farm behavior. The primary IOC is the URL used in the PDF's link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/pbw?utm_term=how+to+access+periodic+table+on+ti-84+plus+ce
    • https://gaxopekel.weebly.com/uploads/1/3/0/9/130969853/7487781.pdf
    • https://static.s123-cdn-static.com/uploads/4383131/normal_5fdfda1b7d5fe.pdf
    • https://cdn-cms.f-static.net/uploads/4451954/normal_606e25a94d65c.pdf
    • https://fuloronarenor.weebly.com/uploads/1/3/4/8/134880411/b381a6b.pdf
    • https://static.s123-cdn-static.com/uploads/4414176/normal_5ff87d27772c0.pdf
    • https://murerodotabuvo.weebly.com/uploads/1/3/5/3/135327115/virodumumu_xefise.pdf
    • https://loloxanasi.weebly.com/uploads/1/3/4/7/134712840/0fe427db8eaec.pdf
    • https://gigorevexi.weebly.com/uploads/1/3/4/7/134714530/gofaxejizatubi_rotade_somefuxat_ditimu.pdf
    • https://static.s123-cdn-static.com/uploads/4446286/normal_5fcd3150e2200.pdf
    • https://wokopapun.weebly.com/uploads/1/3/5/3/135388848/suxedu.pdf
    • https://fubafutevulaz.weebly.com/uploads/1/3/1/8/131856433/xidarapik.pdf
    • https://static.s123-cdn-static.com/uploads/4484806/normal_5ffe6a4b831ad.pdf
    • https://static.s123-cdn-static.com/uploads/4476939/normal_5fed8f0de624e.pdf
    • https://cdn-cms.f-static.net/uploads/4383923/normal_6060f32ca5eaa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/a52806cf-e8f1-40c2-abbe-f99b9575ea32/rslogix_5000_ascii_examples.pdf
    • https://uploads.strikinglycdn.com/files/d5e4812f-ac46-4394-ad5c-5151f3c0686a/jesus_redeems_message_in_tamil_today.pdf
    • https://uploads.strikinglycdn.com/files/f3fa3576-9cf4-4252-8b38-9567bd698c3c/resomakisunumapi.pdf
    • https://uploads.strikinglycdn.com/files/76398b4f-83be-49e3-a52e-46d7d50e18dd/phase_1_makers_diet_food_list.pdf
    • https://uploads.strikinglycdn.com/files/abf481a4-8681-47bc-bba8-13be029d8e16/77232530560.pdf
    • https://uploads.strikinglycdn.com/files/18dee16f-9bbd-4838-88a9-68ba5f811461/what_is_end_stage_rheumatoid_arthritis.pdf
    • https://uploads.strikinglycdn.com/files/ff2c1f32-344b-4d4e-8d71-46d1c67bd11b/metric_conversion_practice_answers.pdf
    • https://uploads.strikinglycdn.com/files/876cb6e9-52d3-4b52-9205-bff85ae4e17b/12097180234.pdf
    • https://uploads.strikinglycdn.com/files/5e6ec890-9e06-4b1e-9f8c-14c17a8b92e0/78646260504.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ead0.bin
5b6fc15794cf3659eaaa6bd169d86c7e7a84cbed280f93ffd5cfbd2c524c075f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD0 5456 bytes
font_01_sfnt_off0000fd78.bin
7b0e83585c03a8797496a01ea27ff9816405b3c00cbf136ee9ad4a8ace7622d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD78 10596 bytes
font_02_sfnt_off000121b8.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121B8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.