Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b36aba645245486…

MALICIOUS

PDF

87.3 KB Created: 2021-04-11 23:04:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2443f2bca1218d33e73226771a824e94 SHA-1: 5e464f464551161c6d7c48b9da186fcd62110b03 SHA-256: 7b36aba645245486619208168ab2d926c510168dfed175a22ed248a92e9c0592
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=viper+alarm+system+installation+near+me PDF link annotation
    • https://vikabedegopeve.weebly.com/uploads/1/3/0/8/130874339/b847d247.pdfIn PDF document text
    • http://coins24h.com/ayrshire_housing_application_formzyavb.pdfIn PDF document text
    • http://nout-prodat.site/powerdirector_15_user_manualwi4mj.pdfIn PDF document text
    • http://khareedforosh.com/fonofotekiworawiravoxasl4acd.pdfIn PDF document text
    • https://ronitodusod.weebly.com/uploads/1/3/1/3/131380212/d70e84a80eaa.pdfIn PDF document text
    • http://lunesygets.xyz/6399440633oi4tc.pdfIn PDF document text
    • http://topstop.site/impact_of_globalization_on_business_communicationhdfxj.pdfIn PDF document text
    • https://gagividezi.weebly.com/uploads/1/3/4/4/134477411/5fe3d.pdfIn PDF document text
    • https://vuzaruluweketex.weebly.com/uploads/1/3/4/4/134478477/39a1a132.pdfIn PDF document text
    • https://xomuwesakutizid.weebly.com/uploads/1/3/5/3/135393414/10e8808fa00d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tokudapele/hamlet_characterization_worksheet.pdfIn PDF document text
    • https://30f21d72-2b41-4965-a7bc-2abb02bf1ded.filesusr.com/ugd/47e66e_327e8bc28eec48ff97476da96d75002c.pdf?index=trueIn PDF document text
    • https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_82fde2fa0c3a49498c1b1d581b8a7198.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/watajive/sennheiser_ew_300_iem_g3_in-ear_wireless_monitor_system.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87333be2-cb5a-4dbe-8f8a-801efcc25e76/bloodchild_and_other_stories_octavia_butler.pdfIn PDF document text
    • https://s3.amazonaws.com/zafibimutadoti/safe_car_seat_stroller_combos.pdfIn PDF document text
    • https://s3.amazonaws.com/fidobakipivogit/his_grace_reaches_me_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/fujadabez/biwumewifelapinozok.pdfIn PDF document text
    • https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_e458df9b93ce441da7e0a255747b705e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/waxapoz/present_participle_exercises_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f94f3789-beab-4145-9258-e97588abd711/what_are_the_similarities_and_differences_between_c3_c4_and_cam_plants.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/142f636c-9d15-414b-9ab9-8fb2d816cdc7/what_happened_to_lisa_at_the_end_of_girl_interrupted.pdfIn PDF document text
    • https://s3.amazonaws.com/vunizi/gali_satta_live_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42ada318-07f6-4cf5-bfbf-ece4ed55a59d/what_happens_after_the_stock_market_falls.pdfIn PDF document text
    • https://s3.amazonaws.com/lixuzo/android_16_vs_cell_jr.pdfIn PDF document text
    • https://s3.amazonaws.com/vapelurowar/bssc_graduate_level_notification.pdfIn PDF document text
    • https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_6b98c1e1ea2143a5b906bc27542a93a1.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100F1 5032 bytes
SHA-256: 1b3492bc8d2b9b68b8346fea14c68a2b6f5182cbf188123df075cb417a7a0817
font_01_sfnt_off00011203.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11203 11296 bytes
SHA-256: bb1d8935abe75845c5639323c96cb9a299a44726216bc5d5bcd029d8aeb68504
font_02_sfnt_off000138aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138AA 16060 bytes
SHA-256: d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7