Malicious PDF — malware analysis report

Static analysis result for SHA-256 740c77afe404503c…

MALICIOUS

PDF

72.5 KB Created: 2021-09-19 17:54:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 65a0c0706ba696623f57dc6ab87b8d33 SHA-1: b683ee5691d5a6ce58c63380dc124e6488f507c6 SHA-256: 740c77afe404503cffbc8fd8e8921153b3df984ae711957cd84264b9bb629d45
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, a common technique for executing malicious code within documents. The ML classifier and ClamAV detection strongly indicate malicious intent. The sample also exhibits characteristics of a link farm, with numerous external URIs pointing to potentially malicious content, suggesting a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9840

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://windowsplusllc.com/ckfinder/userfiles/files/dokusikobotisirate.pdf
    • http://dalboncostruzioni.it/userfiles/files/jovikaxevab.pdf
    • http://hitechdentalhouston.com/uploads/files/darug.pdf
    • https://clubberia.com/js/ckfinder/userfiles/files/79921127026.pdf
    • https://deltagroup.bg/uploads/file/fogisovubika.pdf
    • http://eviljoy.com/UserFiles/File/jajiwaripuvivotemonodujag.pdf
    • http://automsystem.com/UploadFile/file/20210912081147633.pdf
    • http://ahnil.com/userData/board/file/16208601509.pdf
    • https://hsiaoying.com/userfiles/file/zifafadogegixadovi.pdf
    • https://bishopsalamatkhokhar.org/userfiles/file/fuwedefubilegoleb.pdf
    • https://cristiandellavedova.com/wp-content/plugins/super-forms/uploads/php/files/9e645915619029ee43fc47889cded751/53670673840.pdf
    • http://uni-farm.pl/ckfinder/userfiles/files/45334500518.pdf
    • http://ilkconstruction.com/Images/Media/files/55751230983.pdf
    • http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/1613c6313d22a3---fosatuz.pdf
    • http://hennel.hu/sources/elemek/file/wosidupuvafokozakibop.pdf
    • https://ppkh.net/userfiles/file/17556451516.pdf
    • http://xn--66-6kc8bfmkmjd.xn--p1ai/admin/ckfinder/userfiles/files/27116996644.pdf
    • https://bi-kiesabbau.de/cmsimple/images/file/65673457096.pdf
    • http://855solution.com/htdocs/cljr/data/files/11104967779.pdf
    • http://madiran-cruduparadis.fr/ckfinder/userfiles/files/wigenunul.pdf
    • https://novitas.ro/files/mudunosiwupupovolujo.pdf
    • http://trinitysportsandleisure.ie/userfiles/file/gudurupupasagup.pdf
    • http://www.jacenter.org/js/ckfinder/userfiles/files/44250679209.pdf
    • https://medicabg.com/uploads/wysiwyg/files/baxelutefujijupok.pdf
    • http://servmed.net/userfiles/file/7149115277.pdf
    • https://vibanghanoi.com/uploads/files/61813395135.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/DOqCt-cVA4I/uplcv?utm_term=how+to+show+notification+on+lock+screen+android
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bc37.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBC37 16792 bytes
font_01_sfnt_off0000d44e.bin
c595086fd6a073d03e40e803e97709d450a8c13a763a18024a49aed16e4b31f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD44E 10744 bytes
font_02_sfnt_off0000ecf9.bin
4c87e3b40276321149147e4aafe74d998c5c4d6c5ce8c8f37e9d662436b7dd05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECF9 15388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.