Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f540dc1cf51194e…

MALICIOUS

PDF

79.1 KB Created: 2021-02-13 01:01:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e25cc4cf19a4e60bd7da39ef81d53af1 SHA-1: ea503b5d08e4182b881b8d30bc0ba5045b59d730 SHA-256: 6f540dc1cf51194e88f49b3fa9576d1a176f3fc1626fc0f7b88839b11c0bed79
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. The presence of numerous external links, particularly those pointing to other PDFs, suggests a link farm or a method to distribute further malicious content. The embedded URL 'https://maypoin.ru/wix?keyword=blackmart+pro+apk+download+free' indicates a potential lure for users seeking specific software, which is a common phishing tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=blackmart+pro+apk+download+free
    • https://cdn.sqhk.co/sobexofap/fjfOgjl/8898546207.pdf
    • https://jozufibajas.weebly.com/uploads/1/3/0/9/130969385/8264893.pdf
    • https://cdn.sqhk.co/refevebux/ZidggQJ/jaime_lannister_song_lyrics.pdf
    • https://cdn.sqhk.co/podidiwi/hijjiih/96880442194.pdf
    • https://cdn.sqhk.co/gisatajofo/LjijOC1/usa_truck_simulator_2020.pdf
    • https://cdn.sqhk.co/wugunifikezu/jfytajj/evertile_flooring_company.pdf
    • https://kigimijufofudiv.weebly.com/uploads/1/3/5/9/135977026/voxekefo-nosujuz.pdf
    • https://zisafidavilux.weebly.com/uploads/1/3/2/8/132814196/32bb76a81db7df0.pdf
    • https://cdn.sqhk.co/medasozuf/gfVe6d0/apple_mouse_charge_time.pdf
    • https://malavaxun.weebly.com/uploads/1/3/4/0/134018228/kobebukek-zuvewometo-rinalujubex-mixopamaso.pdf
    • https://cdn.sqhk.co/lotazoza/hehhJhg/oconomowoc_farmers_market_winter.pdf
    • https://cdn.sqhk.co/wifavizen/jeITlic/salespulse_school_login.pdf
    • https://dilipifoson.weebly.com/uploads/1/3/1/0/131070096/5012904.pdf
    • https://cdn.sqhk.co/xoripudesew/iehiVfF/roblox_toys_series_5_redvalk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://novoboninixeme.epizy.com/81003778397.pdf
    • http://gelifadewew.rf.gd/wipafozowururamusimafu.pdf
    • http://tawenaxogiminax.epizy.com/kabogir.pdf
    • https://s3.amazonaws.com/sigobija/pakudomevag.pdf
    • https://s3.amazonaws.com/jasipefulaxiduj/21362641136.pdf
    • https://s3.amazonaws.com/nonabafat/sentence_correction_exercises_with_answers.pdf
    • http://fujesotes.epizy.com/65644401365.pdf
    • https://s3.amazonaws.com/laradusa/18669878219.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd4a.bin
0f2fd6c102994782d97d79cb8a0712dbabaa11afa4de88846deb0c0be6c98ce2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD4A 5328 bytes
font_01_sfnt_off0000ef6a.bin
dbd543cab4069cd748ce1b8214c93920b2e117a020a2375c2de111d9fc1ab683		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF6A 9864 bytes
font_02_sfnt_off0001116c.bin
552e926f59ef53231249b6015cc51882b512f7a40c6b17c25f707dc25a221893		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1116C 16368 bytes
font_03_sfnt_off00012726.bin
0d9b6ab0354368cdfa5a4e52e4dfb250ede80cec4283e48fafec0a3c1c1d30df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12726 1736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.