Malicious PDF — malware analysis report

Static analysis result for SHA-256 7288bf7e4d51c349…

MALICIOUS

PDF

76.1 KB Created: 2021-05-27 18:49:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 822e16ad52c812cbb4d032507db146b3 SHA-1: d54704259f6be369fb43402e21d5990dbe2409cf SHA-256: 7288bf7e4d51c349a8ff223aed9e5cacb79ff2f1ca6e3341387527a9f6809f94
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics and a machine learning classifier as malicious. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://seumenha.ru/strik?utm_term=what+is+mbb+paper+credit, which likely serves as a gateway to malicious content or further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=what+is+mbb+paper+credit
    • https://nakilogizo.weebly.com/uploads/1/3/4/3/134363069/bac486f10f2d7f.pdf
    • https://bawimadesudife.weebly.com/uploads/1/3/4/3/134363746/jopigo.pdf
    • https://tatunonomufobuf.weebly.com/uploads/1/3/4/3/134355176/9095070.pdf
    • https://lelebozo.weebly.com/uploads/1/3/4/5/134578107/852594.pdf
    • https://cdn-cms.f-static.net/uploads/4384460/normal_602c0cb608ebc.pdf
    • https://novomuzedideb.weebly.com/uploads/1/3/1/4/131406537/1067720.pdf
    • https://fivipogokofabid.weebly.com/uploads/1/3/0/7/130776003/1026662.pdf
    • https://nuniladolu.weebly.com/uploads/1/3/0/7/130775245/641e841b0a95a5.pdf
    • https://zurirepazigotot.weebly.com/uploads/1/3/0/9/130969164/vinuvime.pdf
    • https://paratokoke.weebly.com/uploads/1/3/0/7/130739311/xovolesuz.pdf
    • https://cdn-cms.f-static.net/uploads/4483839/normal_602b99f51c01b.pdf
    • https://bofeliwibetu.weebly.com/uploads/1/3/2/8/132814086/f609dc14.pdf
    • https://gesofomudejow.weebly.com/uploads/1/3/4/3/134344239/pajoxed.pdf
    • https://pejuloxekipural.weebly.com/uploads/1/3/4/4/134403187/4cd8da927.pdf
    • https://lapefobok.weebly.com/uploads/1/3/4/6/134663543/bopomo.pdf
    • https://static.s123-cdn-static.com/uploads/4446494/normal_5fffead8789a5.pdf
    • https://tikefukexizuse.weebly.com/uploads/1/3/4/8/134879623/ruded_gelobitarux_najuduzudoro_tobivu.pdf
    • https://sobokiza.weebly.com/uploads/1/3/4/3/134363786/6404636.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/50875ef0-892b-4f33-838c-5f2aa9287fb5/how_to_use_sandisk_flash_drive.pdf
    • https://uploads.strikinglycdn.com/files/d955518b-cb37-46f8-a52e-eaef9c29db27/hbs_800_bluetooth_headset_manual.pdf
    • https://uploads.strikinglycdn.com/files/814d22af-78bd-4063-9c8b-728be45ef6de/frases_celebres_del_amor_en_los_tiempos_de_colera.pdf
    • https://uploads.strikinglycdn.com/files/a8da8c1f-67d6-4a06-9da6-915b5a77ded8/zuwodarasekiped.pdf
    • https://uploads.strikinglycdn.com/files/8657e059-d061-45ae-a81a-b6d3e68cdcd6/munosubupal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ece8.bin
e8dc86638e37965f89e2a9db7970921286fe612fef6f7b0a5241372fa460b926		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECE8 5432 bytes
font_01_sfnt_off0000ff37.bin
b96e9feb72928fe833dd927309881828bbfac45fa04044cd513aa9a4685577c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF37 10512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.