Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f64ff44b6276f03…

MALICIOUS

PDF

78.0 KB Created: 2021-04-26 14:43:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7f10f24e799da0aa52496a1868734aab SHA-1: e859ffad35fe16eb2622d2ce3f5aa97d8b3a993f SHA-256: 6f64ff44b6276f035ecb88c04e3015130927754cf4b8286fb253412e1918ef91
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to PDF files hosted on file-sharing services, indicating a link farm or distribution network. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution. The document body, though heavily truncated, suggests a lure related to religious prayers, which is a common tactic to disguise malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=what+are+the+most+common+catholic+prayers
    • https://tiselewo.weebly.com/uploads/1/3/1/6/131606631/8968697.pdf
    • https://paxexituva.weebly.com/uploads/1/3/5/3/135332474/pemovov-tovoxilar-lurun-nuwativegu.pdf
    • http://ideaita.fun/zesipebavolus2lq52.pdf
    • http://select-get.top/27252428508xfkav.pdf
    • https://cdn.sqhk.co/lasijutag/iFhiGje/992414798.pdf
    • https://nebunabimumebu.weebly.com/uploads/1/3/4/4/134480995/gikifogewilepi.pdf
    • https://bopovajo.weebly.com/uploads/1/3/5/9/135966354/kiveniwejoxiwe.pdf
    • http://eeuuurrrrr.space/60125825842bs61s.pdf
    • https://cdn.sqhk.co/nifodotiriru/biejdgg/strike_team_online_apk_mod.pdf
    • https://misekijenag.weebly.com/uploads/1/3/1/3/131380320/4e5d6c83.pdf
    • http://taygerr.com/which_blood_pressure_monitors_are_most_accuratenev1n.pdf
    • https://cdn.sqhk.co/kisudosus/jhd30gh/skewerz_kebabz_townsville.pdf
    • https://taresazafo.weebly.com/uploads/1/3/5/3/135335901/xugepivomupakamapug.pdf
    • https://juvezunadu.weebly.com/uploads/1/3/5/3/135306862/8593325.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://acfc0e76-311d-46af-9c13-f46c112eb424.filesusr.com/ugd/f90bad_9a6a6b14571d4387b81b66702bd8742d.pdf?index=true
    • https://4be8a7ba-6c9a-47a4-99fc-a5961b41a404.filesusr.com/ugd/132250_024eaea1e3bf47199ac29094d0bbd093.pdf?index=true
    • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_71f3b63ff9d74c13bccd5a76cf74e192.pdf?index=true
    • https://460eb545-5389-4aa9-9e78-d1074a8bca0c.filesusr.com/ugd/21a131_f983251b977643c8bb0185fc5978ff86.pdf?index=true
    • https://2225f16e-b6a0-48e2-a067-d7e802b71dd4.filesusr.com/ugd/a7ada4_aaea6b1fca7a42a891e773026037edb6.pdf?index=true
    • https://a3de454e-1598-42bb-a259-4eb69c42f179.filesusr.com/ugd/fb5067_678fdb4082f14b73b0f4f88f861f5edb.pdf?index=true
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_55ae5e7310ef40c1a9d07e6eea970d65.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f44a.bin
513ba85ba24f87cd066d38cea8268de879ec1c1b3dcb32afe7c73b30662dc1cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF44A 5288 bytes
font_01_sfnt_off0001062b.bin
c051e3dcb16a5c556dbc5d177cd4350cba3a7c083c186e1a9e17b2cacc7b2184		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1062B 10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.