Malicious PDF — malware analysis report

Static analysis result for SHA-256 70bd701bb949d92c…

MALICIOUS

PDF

75.5 KB Created: 2021-04-05 07:01:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6fcb625a62a3f497be50c62979e9463 SHA-1: d75ccd544ceba034cb72f92d6aa11afbc983753d SHA-256: 70bd701bb949d92cf3b7473af7da46ef8b2bdf428347574f30b4591567f24db0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for phishing or SEO spam. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, suggesting an attempt to manipulate search engine results or redirect users to malicious sites. The embedded URL 'https://maypoin.ru/wix?keyword=properties+of+matter+worksheet+8th+grade' is particularly suspicious and likely leads to a phishing or malware distribution page. No scripts were extracted, but the overall structure and link farm point to a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=properties+of+matter+worksheet+8th+grade
    • http://bejuzoz.iblogger.org/billy_carson_emerald_tablets.pdf
    • https://givadebar.weebly.com/uploads/1/3/1/4/131437750/vatem.pdf
    • https://porujeworor.weebly.com/uploads/1/3/2/8/132814718/sofubapifoxuma_dimawofenosela_ridopewotadow.pdf
    • https://cdn.sqhk.co/gopuxipo/hdIC0ic/greatest_hits_of_the_80s_rock.pdf
    • https://cdn.sqhk.co/pibilebomek/tjhfEhc/slingshot_shooter_drink.pdf
    • https://cdn.sqhk.co/fepebage/7igZher/65838739544.pdf
    • https://selemuja.weebly.com/uploads/1/3/4/8/134893326/sasibegusaw.pdf
    • http://niwagiw.22web.org/79501858535.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ddaff43d-ac54-45ac-87b4-f04b1d8415d4/how_to_win_the_booker_prize.pdf
    • https://uploads.strikinglycdn.com/files/9d7a326e-0d51-4205-a083-11136be40333/adobe_illustrator_classroom_in_a_book_2020_lesson_files_download.pdf
    • https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_2a657709113b4e3eb68052a0a6bc234e.pdf?index=true
    • https://66f9c2bc-82a6-463d-9ccd-9c94d3d8805e.filesusr.com/ugd/b361c6_98f1b7bd7e2e4745a9dbe27ed965abaa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/085a6a68-2cca-4051-92b8-0f9c28b161d9/kill_team_starter_set_2016.pdf
    • https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_1c9ef4b13f53455ab606677b628ff553.pdf?index=true
    • https://ab737b70-891a-4a1f-8db9-ee548211cb31.filesusr.com/ugd/ce14f3_f494c2ea0d094c088a35c99b8cb01ec2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/700a376e-dbf8-4788-a3f3-840ac2f23a17/vifafunufibexara.pdf
    • https://uploads.strikinglycdn.com/files/83bd7502-cd8a-4b06-b951-b1fd66041275/jazigul.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db13.bin
2d15ed3e7033f89f2c2162c1195a82d45e748cdb3002c60ae4fe1934a0502586
pdf-font-stream PDF embedded font (sfnt) at offset 0xDB13 5456 bytes
font_01_sfnt_off0000edb2.bin
bac347eec51a7c2eda983dc41fdb2f6e08dcdb6d49b9f78717a9a04908f916bc
pdf-font-stream PDF embedded font (sfnt) at offset 0xEDB2 11148 bytes
font_02_sfnt_off000112c1.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2
pdf-font-stream PDF embedded font (sfnt) at offset 0x112C1 4324 bytes