Malicious PDF — malware analysis report

Static analysis result for SHA-256 7af005523d154c64…

MALICIOUS

PDF

87.5 KB Created: 2021-03-14 22:36:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d7c9331966f7405befbab5f122f5ad89 SHA-1: dabc747c29e5af5373c504bb7d3837bf3f68d99b SHA-256: 7af005523d154c64e48a1b08f9f2326511932759e6099f6017018e80321179a3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm with numerous external URLs. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf and includes a URL related to 'Abacus computer history pdf'. The primary attack pattern involves directing users to a large number of external PDF links, likely for SEO spam or to host malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=abacus+computer+history+pdf
    • https://cdn.sqhk.co/sututidogo/hfgffig/mountain_climb_stunt_off_road_mod_apk.pdf
    • https://cdn.sqhk.co/kigifadarija/DhiIgjt/3918091608.pdf
    • http://indital.fun/kifumilezisowazomotenofid5ij1.pdf
    • http://wumakelanatug.22web.org/car_accelerates_uniformly.pdf
    • http://claire-irk.ru/65931747136yodzx.pdf
    • https://cdn.sqhk.co/mewivupa/VogcjsM/ice_cream_flavors_that_start_with_h.pdf
    • https://cdn.sqhk.co/zajagatetode/ehfn4ha/12799282735.pdf
    • https://cdn.sqhk.co/tefazaturar/iRvjhIh/65019401371.pdf
    • http://musc-media.xyz/gujusijipowunu3b5l4.pdf
    • https://cdn.sqhk.co/zenekukera/bKJmRfT/bouncy_ball_kit_kmart.pdf
    • https://cdn.sqhk.co/sebutarukaw/j7igpQk/like_a_boss_lyrics_og_kid_frost.pdf
    • http://majemuduwiliwun.22web.org/74361776707.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zugoxovok.epizy.com/biwexigapob.pdf
    • https://a3c35cc3-4a3f-4d41-ab51-8b3e4b114d30.filesusr.com/ugd/2b25b5_748901983bda4237b7176b6c01cd78fd.pdf?index=true
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_96c876d504be475eb6d8447844ba7dd5.pdf?index=true
    • http://gedokimisizat.rf.gd/judumabope.pdf
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_d7aee8e659f54a84849dab4ef7c18dda.pdf?index=true
    • https://ee67c5b3-b4d3-4257-b425-af55881d3a68.filesusr.com/ugd/c60da7_6f3502f97279467491f925db19ac06a3.pdf?index=true
    • https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_2f36925dfe8a408388729dd5b886c262.pdf?index=true
    • http://vunowowino.epizy.com/andrographis_paniculata_chemical_constituents.pdf
    • https://27475d5a-2981-497d-8cd5-0c310ef10f8b.filesusr.com/ugd/9cb927_6cb1fbc08e204c99a01ec10613e2a6f5.pdf?index=true
    • https://d046670e-94b8-4ea2-8efc-69fca9b502c9.filesusr.com/ugd/c0b427_e04f60f2ed67402eb879b636452ae46c.pdf?index=true
    • https://1a447ccf-a6a5-490c-ad31-399ae8169532.filesusr.com/ugd/cf5184_9b428b3b0cde462294a55e43891d5a17.pdf?index=true
    • https://75edee45-cd08-43cb-a752-0c33e5c2343f.filesusr.com/ugd/a7c173_3dd174a3c5b34b309327cff032405332.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b23.bin
4aa29cea9fb7d46038940ae16cdf7d6455ac8e9d7c2c3c1927bacac8833b0261		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B23 5368 bytes
font_01_sfnt_off00011d64.bin
d9a0e9aebe7836e4cae7f9da3ebfcd947d7b348cfced51385994c917a8e870b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D64 10900 bytes
font_02_sfnt_off0001427d.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1427D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.