Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bcb9277499298be…

MALICIOUS

PDF

74.9 KB Created: 2021-03-22 17:15:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58dcab59798fb6426d3c68939f88682f SHA-1: 9f17615cdcf50971a7ebdaeb5bfb544e0765fb58 SHA-256: 7bcb9277499298beabc3f34dc52d602803cb75595289a7f2d349d5e31fb5a448
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF_SEO_LINK_FARM' suggesting a large number of outbound links. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV identifying it as a phishing trojan. The document body, though heavily obfuscated, contains text related to a 'worksheet answer key', which is a common lure for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=csi+web+adventures+case+1+worksheet+answer+key
    • http://jefijunanupe.sportsontheweb.net/ototoxicidad_por_furosemida.pdf
    • http://gejudoxe.mypressonline.com/alice_s_adventures_in_wonderland_book.pdf
    • http://peramabejakes.sportsontheweb.net/cards_against_humanity_russian.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zijedan.atwebpages.com/vascular_parkinsonism.pdf
    • https://68f2566a-c586-4d15-a5d1-3a72044c38f3.filesusr.com/ugd/ecec20_e5a0d3c8a3f74d38b2c5182c6a0e685a.pdf?index=true
    • https://s3.amazonaws.com/kisagoz/logo_mania_quiz_answers_level_2.pdf
    • https://s3.amazonaws.com/bokexizometun/27531091246.pdf
    • https://s3.amazonaws.com/satudifin/piziredixakijozedomilulop.pdf
    • https://s3.amazonaws.com/tigewibejageju/chuukyuu_kara_manabu_nihongo_workbook_answers.pdf
    • https://s3.amazonaws.com/vonuxagupeduze/doromifopomatizarokuwetu.pdf
    • https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_12aff521946e482c9f2891e608366148.pdf?index=true
    • https://s3.amazonaws.com/rizoli/beast_mode_2_zip_free.pdf
    • https://uploads.strikinglycdn.com/files/48a25cc7-1884-4387-b366-d28be641e6fd/vegobiwotejovot.pdf
    • https://63150c49-9e7f-4923-bc7a-1e4049050ce6.filesusr.com/ugd/cba449_20d94b28225341feb2625b1141d9b18e.pdf?index=true
    • https://d0bf7e8b-5449-41c0-93e9-161603c0719f.filesusr.com/ugd/197ed4_5fc9aa5a98b54bf282f086fb1040b1fa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e90fd7b0-5ecb-4005-a62e-c68cbfb53cc3/meaning_of_verbal_communication_in_hindi.pdf
    • https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_8fb9a649a054461d908ff24736912946.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a58e234b-318d-490a-85f3-fe62baf224f4/how_to_tell_if_your_furnace_inducer_motor_is_bad.pdf
    • https://s3.amazonaws.com/pozokimepe/jilepu.pdf
    • https://uploads.strikinglycdn.com/files/70fdb76f-c30e-4325-b54e-def2bca6cdd0/troy-bilt_weed_eater_tb575ec_manual.pdf
    • https://uploads.strikinglycdn.com/files/1a57306b-8a8e-42a1-9b11-110ad2b0b97a/how_to_thread_a_kenmore_portable_sewing_machine.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e640.bin
04b2a15a5d415db23adcb0cb4faf738789775c167043c512fe14b48bb300d4fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE640 5408 bytes
font_01_sfnt_off0000f8bd.bin
6f80c73de9309843748aa37f1d8a8005bf9e4d2127f0bfc7ded47e59932bbb09		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8BD 10988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.