Malicious PDF — malware analysis report

Static analysis result for SHA-256 79c6b93b3dde5e97…

MALICIOUS

PDF

75.4 KB Created: 2021-03-17 16:58:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e0eed018b2c5e34d8a03acdb5c0f7a67 SHA-1: ba8e232951739df5571cc2beebb9f6d724828c6f SHA-256: 79c6b93b3dde5e978ec98360d3db67072119776f83f8c0547d3468eeb8d30e6f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, with one pointing to 'https://resalured.ru/strik?utm_term=what+is+the+nc+dmv+vision+test', likely to manipulate search engine results or direct users to phishing sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=what+is+the+nc+dmv+vision+test
    • https://cdn.sqhk.co/nadipozow/ihb1Rhj/last_minute_hotel_deals_new_york_city_manhattan.pdf
    • https://cdn.sqhk.co/migixurej/ghTidhj/sonic_boom_baseball_song_lyrics.pdf
    • http://finuxezanasa.mygamesonline.org/hamilton_beach_2_way_flexbrew_not_brewing.pdf
    • https://cdn.sqhk.co/nalomuxe/qlpgcjg/motorcycle_riding_apparel_stores.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5b5cf7c4-d983-4e27-bd54-44d52fc9074e.filesusr.com/ugd/2f9450_f949016eaddb4c64b8f13b124fe3bd2e.pdf?index=true
    • https://cceb078e-1df6-42b0-9e12-359f30e42f1d.filesusr.com/ugd/e8506d_9a213dd26ef743109d96fdc1fdda0764.pdf?index=true
    • http://fogovulosuzan.onlinewebshop.net/textbook_of_biochemistry_for_dental_students_download.pdf
    • https://uploads.strikinglycdn.com/files/610dce3f-cb2d-420a-8e24-3a3a0d2dea34/24662574172.pdf
    • https://uploads.strikinglycdn.com/files/e1b1e8cc-d91d-4ec2-839d-626293f6e4ae/dusajamomen.pdf
    • https://uploads.strikinglycdn.com/files/7ddc6b65-591e-4827-9908-e50eac2520a7/how_to_fix_facebook_marketplace_search.pdf
    • https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_2b08ffdedb33423fb67ce831d6069401.pdf?index=true
    • https://ad5375d1-0dc8-447d-a54b-f1659eeba1ba.filesusr.com/ugd/a4ba79_faec8632f49e450bbe1444bab0e496ed.pdf?index=true
    • http://vuxebezedigelun.onlinewebshop.net/57397246821.pdf
    • https://71bfc0c6-4bef-405a-aee6-9e9dcaab3d12.filesusr.com/ugd/708cfd_258fafe04a8440f29e9d368f8bab90ee.pdf?index=true
    • http://lanosebezazov.onlinewebshop.net/vupikurugojofimawabupulix.pdf
    • https://86b7bb9a-6a0b-496c-a062-e8aa60c365d0.filesusr.com/ugd/dcf311_e07d05c76341443a910104ca35126448.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a04633a3-c919-4b54-b09b-2125f41697d4/dracula_by_bram_stoker_audiobook.pdf
    • https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_aa5addab51234ff0bdcdec2e14a7226c.pdf?index=true
    • https://dce579ed-4708-43c3-aaeb-2c76a6268d78.filesusr.com/ugd/944939_055b601e3b7740fe9b2c02f78f12968e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4405a6a5-805c-4b91-9de8-7ffa9d4bb073/nordic_track_pro_skier_reviews.pdf
    • https://uploads.strikinglycdn.com/files/aa275e6b-b70f-4544-815b-364817edeb44/what_is_a_hardware_short_answer.pdf
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_f10329e754fa4ef4bedcf8530226df96.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9b434f1a-0669-4065-b76a-d6657e73bbe3/8825727598.pdf
    • https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_3829eb2a833644738ab51004d59af5cc.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dff4dd67-ca2d-41ea-b108-2937f3e1eed6/mutev.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e90f.bin
fce03e1d882e88aa3e813d09b35c3800910bcdd7fc1462337f20eaa7748e8c26		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE90F 5124 bytes
font_01_sfnt_off0000fa69.bin
f22c119bc657f3b7fbd905b27cb1ed845e2a79576df0e616b34652db4fceeb43		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA69 11120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.