Malicious PDF — malware analysis report

Static analysis result for SHA-256 76f8b2f4ce9085e4…

MALICIOUS

PDF

85.5 KB Created: 2021-03-26 10:02:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02995da1efbee42cec01bf702a38cdd6 SHA-1: ecd0bcf9b664c6c19361db0c5c073d33afb5597f SHA-256: 76f8b2f4ce9085e4b90ecdebfa1ad4cd369dc4cc1548e59b511f7dd567f74fbe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' reveals the presence of numerous external links, suggesting a tactic to redirect users to potentially harmful websites. The embedded URL 'https://pelibifir.ru/wb?keyword=fantastic%20beasts%20and%20where%20to%20find%20them%20movie%20actress%20name' further supports this, likely serving as a lure or part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wb?keyword=fantastic%20beasts%20and%20where%20to%20find%20them%20movie%20actress%20name
    • https://cdn.sqhk.co/xeduwukaxusa/hebfihg/diamonds_imagine_dragons_traducao_natural.pdf
    • https://cdn-cms.f-static.net/uploads/4479436/normal_604dd120a4e85.pdf
    • https://cdn-cms.f-static.net/uploads/4408333/normal_6019ac7f2b87b.pdf
    • https://cdn.sqhk.co/xubewarow/r1dhjje/knife_dash_como_resgatar_paypal.pdf
    • https://static.s123-cdn-static.com/uploads/4403683/normal_5ffa7df42f197.pdf
    • https://cdn-cms.f-static.net/uploads/4445564/normal_602842b9220b8.pdf
    • https://static.s123-cdn-static.com/uploads/4476015/normal_5fce240a103d0.pdf
    • https://cdn.sqhk.co/mozejipakas/R5H1PKv/zabiduxomiw.pdf
    • https://cdn-cms.f-static.net/uploads/4380531/normal_605274712e908.pdf
    • https://cdn.sqhk.co/numokafas/2sB5ZtG/fun_halloween_party_games_for_all_ages.pdf
    • https://cdn-cms.f-static.net/uploads/4473645/normal_605b78b1db51f.pdf
    • https://cdn.sqhk.co/miviterul/hggcC7s/dinosaur_running_game_chrome.pdf
    • https://cdn-cms.f-static.net/uploads/4422645/normal_6039d790587e6.pdf
    • https://cdn-cms.f-static.net/uploads/4422392/normal_600ac82d81b96.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e39bfc17-a898-4016-ac91-fc9303c112df.filesusr.com/ugd/b5068a_9039e886c873452db4929d5fc70a7ce9.pdf?index=true
    • https://s3.amazonaws.com/zikeko/sig_sauer_p320_x_compact_vs_p365.pdf
    • https://s3.amazonaws.com/rodiligarexo/histopathology_report_after_d_c.pdf
    • https://s3.amazonaws.com/baxekojojexusol/witty_ways_to_answer_what_s_up.pdf
    • https://uploads.strikinglycdn.com/files/4602a54c-6993-468e-9797-5e46cb51800c/what_does_having_no_service_mean.pdf
    • https://uploads.strikinglycdn.com/files/8b58de9d-e546-4ca8-9e77-8268e9db7bae/52404850253.pdf
    • https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_04701904750b44fd862c1ed7648cf3f5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e7e1f3de-3972-4877-ac2d-fd39362a79df/42431415850.pdf
    • https://uploads.strikinglycdn.com/files/ecd5fa16-f447-4051-ac1b-6bf10de3fbcf/bmw_navigator_6_update_mac.pdf
    • https://uploads.strikinglycdn.com/files/dd4ff7a2-2234-43b3-9bc9-fcad01ad8994/likufejamiwebememajonez.pdf
    • https://e53c8fcc-339b-4d8f-83f6-44ddc8c6ace4.filesusr.com/ugd/1ea9c4_c4534fefc35848ca98ced5fa1c7170ec.pdf?index=true
    • https://s3.amazonaws.com/nutanigonu/xukulip.pdf
    • https://s3.amazonaws.com/bokelur/dragonscale_leatherworking_guide_classic.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109f5.bin
639756f65ce70dfe2fc54ea8336d690fc8ab75b8a51631bef2b9c683257f5a94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109F5 5476 bytes
font_01_sfnt_off00011c7f.bin
4a5f8f913bc2a7c1e06528203cfae09ce81533275cb305bc071ecc75008fc1d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C7F 12284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.