Malicious PDF — malware analysis report

Static analysis result for SHA-256 756eb9371ba0060d…

MALICIOUS

PDF

76.0 KB Created: 2021-03-20 22:23:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 712b2c4836c90ca6f160f954729c1453 SHA-1: 7fc91965ff5123365e7de7b94924e2c3fa2dc32e SHA-256: 756eb9371ba0060d586808ebfb60b358bbd6d1161bce7e32d566907a2acf5238
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL pointing to a suspicious domain. ClamAV and ML classifiers identify this as a phishing or malicious PDF. The document body, though heavily obfuscated, appears to be a lure related to a movie search term, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/aws?utm_term=romeo+and+juliet+leo+dicaprio+movie
    • https://cdn-cms.f-static.net/uploads/4493245/normal_603766116bca8.pdf
    • https://static.s123-cdn-static.com/uploads/4417040/normal_6004e57e40f83.pdf
    • https://cdn-cms.f-static.net/uploads/4444358/normal_6025531e52692.pdf
    • https://cdn-cms.f-static.net/uploads/4462056/normal_5fd1157e46d31.pdf
    • https://static.s123-cdn-static.com/uploads/4477400/normal_5feaff141a91e.pdf
    • https://static.s123-cdn-static.com/uploads/4417408/normal_5ff05b5f2b8e0.pdf
    • https://cdn-cms.f-static.net/uploads/4465559/normal_5fd5f32444c9c.pdf
    • https://cdn-cms.f-static.net/uploads/4421787/normal_602ac1d8a4944.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/78eccb3f-3695-4087-bb0a-1fa9f77b6852/45205227988.pdf
    • https://uploads.strikinglycdn.com/files/bdaf2c49-3aa8-4a72-be17-37bb36327601/86054866993.pdf
    • https://uploads.strikinglycdn.com/files/afdea929-92d0-440c-9c52-fc84cfea18c6/difiwab.pdf
    • https://s3.amazonaws.com/jivagajamav/79796299378.pdf
    • https://s3.amazonaws.com/kovezodepugov/fishbone_diagram_template_ms_word.pdf
    • https://5b0e1d79-1acc-45ba-a965-31015372eee8.filesusr.com/ugd/67f5f7_afbf548d7cfd41c6a4907984e6d432b0.pdf?index=true
    • https://7e70056c-c2aa-4e53-98c5-50750123c107.filesusr.com/ugd/f8ae5d_2b9a6332e89548a7adf6d6422a67f91e.pdf?index=true
    • https://s3.amazonaws.com/satedafadusizo/58328126921.pdf
    • https://da6a6a96-7907-4aac-bfe3-592928b14ca9.filesusr.com/ugd/39e844_79c84f5a623a4a15ae12ffc01042b8c6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a098c35c-da87-438b-99cf-4c6ac8d6332b/does_powerade_zero_sugar_have_calories.pdf
    • https://uploads.strikinglycdn.com/files/7a31e9ed-c920-439d-afae-9f19e4fcce2b/how_to_turn_on_bluetooth_motorola.pdf
    • https://uploads.strikinglycdn.com/files/74bb42d7-7a59-4eb6-aba4-43129b46c162/99281321573.pdf
    • https://s3.amazonaws.com/verirejon/zinavefedugimefawewes.pdf
    • https://uploads.strikinglycdn.com/files/66fa0d93-c32c-41fb-826d-8d380ff1e43b/samsung_scx-3405fw_airprint_setup.pdf
    • https://627ea4a7-3f28-4bf3-8c99-6a9da7dacf48.filesusr.com/ugd/1970e2_e602d4bf88bb415eb493c6fecf7a09b1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/07ed86ac-8992-4fd7-a9b8-3c64d627182e/xokuva.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb37.bin
dd012e7f346640e3d96b304d1d7641daee7bb8eec73bfdd73e048fadbff00d27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB37 5184 bytes
font_01_sfnt_off0000fcd3.bin
5f6ec248168163dc147aab10b7cbe449d21e58033cb0de1356fe4f631c45a699		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCD3 11180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.