Malicious PDF — malware analysis report

Static analysis result for SHA-256 730365b9e7802338…

MALICIOUS

PDF

109.8 KB Created: 2021-05-14 22:48:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 05d8b7ecb5978a500cc8848f3290d154 SHA-1: b22c1a6a03316b2097b1e1c34b2ea5a235b9f93e SHA-256: 730365b9e7802338389a06e159357c84714757f16b99934c9d2ad7a682cf2385
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'link farm', suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the presence of numerous external URLs points towards an attempt to redirect the user to malicious content, likely hosted on domains such as pelibifir.ru and bojepelesu.weebly.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=line+6+spider+2+150w
    • https://bojepelesu.weebly.com/uploads/1/3/5/3/135350442/kotexenebufot.pdf
    • http://24goodstore.site/grid_template_areas_tutorialmt0p0.pdf
    • https://cdn.sqhk.co/naforokafe/hihjaX3/givuxosivirujozesit.pdf
    • http://nubolats.xyz/5159483000vqfb3.pdf
    • http://snegny.com/how_to_make_a_bookcase_room_in_minecraftuollk.pdf
    • https://cdn.sqhk.co/nebinefis/DP8jThg/healing_crystals_guide_book.pdf
    • https://cdn.sqhk.co/botuvawezej/ijhhc32/gaming_tournament_app_download_free_fire.pdf
    • https://cdn.sqhk.co/bamikalagov/hb2gijd/is_gonorrhea_curable_yahoo_answers.pdf
    • https://cdn.sqhk.co/sidogorego/Pie5mFW/top_50_bollywood_songs_2018_zip.pdf
    • http://goldstein.capital/dyson_dc75_cinetic_big_ball_upright_vacuum_cleanerylyeu.pdf
    • https://cdn.sqhk.co/xelalizogim/C6laGgh/8770738444.pdf
    • http://fapenas.22web.org/2170839142.pdf
    • http://top-odejda.com/48681444069lfh7.pdf
    • https://cdn.sqhk.co/wodigajamu/g5hbgd9/talking_flowers_name.pdf
    • https://pebawozo.weebly.com/uploads/1/3/4/8/134865175/d9f8dd5.pdf
    • https://xotomunekezej.weebly.com/uploads/1/3/1/0/131070571/nabazerud.pdf
    • https://poxobavu.weebly.com/uploads/1/3/1/4/131453713/kojixok_movokedutokup_bigunojazasilu_xukavim.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c2267750-1f6d-4c2f-944a-eb302c7f07d7.filesusr.com/ugd/93971e_9568a406402c496d8cbb70d4db107b21.pdf?index=true
    • https://da54c32a-99c7-4590-8520-800dd2d1cae3.filesusr.com/ugd/7973d2_cf38d1931a9f484f90448405ea0dea32.pdf?index=true
    • http://mumufikoxid.epizy.com/holiday_2020_makeup_releases.pdf
    • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_c35c20222efe4644bb5316a9238e3860.pdf?index=true
    • https://4ebe1e6a-8a13-4145-b3c2-d2faed65f423.filesusr.com/ugd/a67e73_8da0296332394e7ebf95c9b7099fb1d9.pdf?index=true
    • http://xizilagitakov.epizy.com/guvugemojulo.pdf
    • https://9ec55029-67b1-4fe0-9a5d-40fd638ac594.filesusr.com/ugd/dc5a51_0dfe9a8449a345339410f515afb80e08.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f534.bin
ceeef7f8616c5e9df26aa476c55bdca2c7f4f9652aca8408d66a49e512a4b280		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF534 33072 bytes
font_01_sfnt_off00015b92.bin
6655139a912c5fa96f2b3d570b9423ee3676693d96ae184ae339fde93bdfad1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15B92 5348 bytes
font_02_sfnt_off00016def.bin
5054211e579eb7b3d8d96b13345054f5f35c932b0206747a49d0f6bf47d04625		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16DEF 11268 bytes
font_03_sfnt_off00019491.bin
9559dd1bd908241551916101fda3d445a26f5c4b506a1423f23393456f9d5940		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19491 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.