Malicious PDF — malware analysis report

Static analysis result for SHA-256 76a049da2ddb0969…

MALICIOUS

PDF

84.7 KB Created: 2021-06-12 21:33:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 52300f34955a505c176af872259e7376 SHA-1: e7a7a559c07f63591b0ca6596a1ecebcf16d7169 SHA-256: 76a049da2ddb0969b97d05a13389ddbc7578ba917efd025562b7ea758b8fa92d
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified as a 'PDF_SEO_LINK_FARM', suggesting a tactic to drive traffic to malicious sites. The presence of 'SE_PASSWORD_ARCHIVE_LURE' indicates a common technique to bypass gateway security by encrypting payloads. ClamAV detection and ML classification strongly support its malicious nature, likely as a phishing or trojan distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/pbw?utm_term=install+android+studio+mac+brew
    • https://bomirilipaxotez.weebly.com/uploads/1/3/4/0/134096722/vemegunazewaf_rerexowuvuw_jutumewa.pdf
    • https://xesirizibolaz.weebly.com/uploads/1/3/4/4/134432563/b2a524d2dd6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/67bf1a95-85e9-4dba-86a5-620c18749543/venn_diagram_meaning_in_english.pdf
    • http://xeninexiruvo.pbworks.com/w/file/fetch/144832011/the_flu_full_movie_2013_english_subtitle_download_hd.pdf
    • https://uploads.strikinglycdn.com/files/f2963d28-71b5-4d43-92b9-af75ba988d7e/htt_www_facebook_com_device_and_enter_this_code.pdf
    • http://jajisaparev.pbworks.com/w/file/fetch/144418245/long_vowel_worksheets_for_first_grade.pdf
    • http://siruzosu.pbworks.com/w/file/fetch/144453273/how_is_the_praxis_plt_7-12_scored.pdf
    • http://wovoxiroma.pbworks.com/f/76738943695.pdf
    • http://pudamalulera.pbworks.com/w/file/fetch/144547962/77820982241.pdf
    • https://uploads.strikinglycdn.com/files/e7560f02-620c-4f45-9c79-79d36aec9d49/zavosexubibuzo.pdf
    • http://vatojorisa.pbworks.com/w/file/fetch/144434910/what_is_alphatrak_control_solution.pdf
    • https://uploads.strikinglycdn.com/files/12d1868d-7422-49e9-96c9-1e3234a58a88/93367640758.pdf
    • http://bigixogabu.pbworks.com/f/noxinevufupuve.pdf
    • https://uploads.strikinglycdn.com/files/a6d329f5-642f-4f8a-aee4-5eb217e2bfb0/30497076772.pdf
    • https://uploads.strikinglycdn.com/files/d2fa84a8-b151-4d9f-9a5b-35df77446757/fx_a_christmas_carol_air_date.pdf
    • http://jolowajuwijo.pbworks.com/w/file/fetch/144485154/dalesagokanigijo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df89.bin
a1590c7f5208dc8548bc60c975f0ad55d8fb019de21164224c277915181a96ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF89 3396 bytes
font_01_sfnt_off0000eb99.bin
a867d432ab4d23baf8315ca7442710ecc1bd2cbc289f640d514402e85abfb6b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB99 5252 bytes
font_02_sfnt_off0000fd6b.bin
286d57c3514cdd7cea798270b5be62085485f0e55b9f07c4508276d2fd2ac604		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6B 15272 bytes
font_03_sfnt_off00012df0.bin
d0f4eb84dece17dda01a5bcf204f0581735b9e498de5b617c8cc7037206a9bfd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DF0 16128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.