Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ab9ff9f805f3a0f…

MALICIOUS

PDF

73.6 KB Created: 2021-06-10 10:49:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 10afa08c74d49aa5830ea440f5c987cb SHA-1: e14a2a90902a6410092f1baf23e3204f3e0db6ff SHA-256: 7ab9ff9f805f3a0f0798473fad3dc3a43ba0c3e52bcc404e86445338b7df5471
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO link farms and phishing campaigns. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URL and the heuristic for a "PDF_SEO_LINK_FARM" suggest the document is part of a larger scheme to distribute malware or phish for information, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/pbw?utm_term=faded+instrumental+remix+mp3+download
    • https://tituwuvosaladu.weebly.com/uploads/1/3/4/8/134849885/verodazulewu.pdf
    • https://rigukolanerimi.weebly.com/uploads/1/3/4/5/134519373/buviruxawasaf-bumadi.pdf
    • https://vobudofokivelux.weebly.com/uploads/1/3/4/5/134599261/ridezofo.pdf
    • https://cdn-cms.f-static.net/uploads/4487897/normal_60657e917015c.pdf
    • https://gejowarog.weebly.com/uploads/1/3/2/7/132740172/18e18f1.pdf
    • https://cdn-cms.f-static.net/uploads/4420239/normal_5fe9d0873ac5e.pdf
    • https://cdn-cms.f-static.net/uploads/4366662/normal_605271669f559.pdf
    • https://cdn-cms.f-static.net/uploads/4473445/normal_6058286818a9a.pdf
    • https://tawemitanenu.weebly.com/uploads/1/3/4/4/134474066/nazelufujavetisuru.pdf
    • https://gokaletuwatuni.weebly.com/uploads/1/3/6/0/136098233/mavasat.pdf
    • https://moremutinujiti.weebly.com/uploads/1/3/4/8/134865562/b3c21a496.pdf
    • https://cdn-cms.f-static.net/uploads/4367289/normal_6051c08bb0b08.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3efd3db3-2b59-4910-9450-e8450062936d/what_lights_should_be_on_my_router.pdf
    • http://xorunezagu.pbworks.com/f/john_naka_bonsai_techniques_2.pdf
    • https://uploads.strikinglycdn.com/files/c1d1a8c5-337c-4425-8dd7-877f49db0811/85442227327.pdf
    • http://pugaxigodaka.pbworks.com/f/58545300160.pdf
    • http://nudenuxote.pbworks.com/w/file/fetch/144980475/xukolovonewoxuz.pdf
    • http://siruzosu.pbworks.com/w/file/fetch/144450156/2015_harley_davidson_sportster_iron_883_service_manual.pdf
    • https://uploads.strikinglycdn.com/files/c8df1996-44c2-4dff-adbf-f4742c2dae03/xipusowutaxozajazimod.pdf
    • https://uploads.strikinglycdn.com/files/4f1667cc-cca7-4f9d-92bc-2d96793d70f2/41393690012.pdf
    • https://uploads.strikinglycdn.com/files/171870d3-53c3-40dc-a661-3ae031985ea1/honeywell_pro_4000_instructions.pdf
    • https://uploads.strikinglycdn.com/files/d52947cd-b985-4f41-a9d2-e4eb518579cc/4411487786.pdf
    • https://uploads.strikinglycdn.com/files/5f719cee-04d2-4c90-802e-7dfbb34e627b/why_wont_my_electric_scooter_hold_a_charge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8f2.bin
de48683ae31d49dd391070a4095a3619af9b3d0b6e4dde29516a505e4b46e401		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8F2 5384 bytes
font_01_sfnt_off0000eb43.bin
918a5b04edb43af9377163a0c923865833a435ed3bb74c75eb5b6dabedafe282		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB43 14232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.