Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c244a703e1b773a…

MALICIOUS

PDF

72.3 KB Created: 2021-03-28 00:59:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: acc95f8c47b56c7e86d52c27ee46acf7 SHA-1: 629cdad9b647d4bfba485367a26e74f85fe93eef SHA-256: 7c244a703e1b773a27161b1826d072e492ea4c3076bc75993f920659548aef80
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to other PDF files, indicating a link farm or distribution mechanism. The ML classifier and ClamAV both flagged this as malicious, with ClamAV identifying it as a phishing trojan. The primary malicious activity observed is the mass distribution of links, likely to manipulate search engine results or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=call+of+cthulhu+7th+edition+character+sheet+pdf
    • https://foreguguwikib.weebly.com/uploads/1/3/0/7/130775698/rimavekubini.pdf
    • https://cdn.sqhk.co/kizofapekeku/CLPhffW/haircut_los_angeles_open.pdf
    • https://livugazenexaru.weebly.com/uploads/1/3/1/6/131607095/fowudoxobawokam-bisivobekuk-musamikox.pdf
    • https://cdn.sqhk.co/ruxagoxoman/dRhdjgz/79524175353.pdf
    • https://nitikado.weebly.com/uploads/1/3/4/6/134660078/suzox.pdf
    • https://wemubutuve.weebly.com/uploads/1/3/6/0/136090051/4622766.pdf
    • https://cdn.sqhk.co/monasomeb/gdQjf4D/joker_whatsapp_status_video_download_sharechat_tamil.pdf
    • https://cdn.sqhk.co/punenekebi/jijjghd/11767984290.pdf
    • https://limuvowefegepud.weebly.com/uploads/1/3/4/5/134509231/fubaxazokexazot_xofitivewi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/349c2213-e1a8-4fd8-be91-3e5cbacf7318/how_to_turn_off_casio_calculator_fx-300ms.pdf
    • https://uploads.strikinglycdn.com/files/86781ad8-c67e-4107-8aad-17471e58630f/kuloz.pdf
    • https://uploads.strikinglycdn.com/files/f90eb657-7dfc-4857-b590-84b403f5c12c/61994463699.pdf
    • https://uploads.strikinglycdn.com/files/8f74b3a8-3faf-46fe-9ed1-cce392e6ecb7/75593518131.pdf
    • https://uploads.strikinglycdn.com/files/64288c55-0cf6-4b37-9bde-5efdd7a6bc55/kogukijutemopugowexitesut.pdf
    • https://cb47f074-0476-4434-b381-5672a365cab8.filesusr.com/ugd/c46c8a_db5f56def0e7469c87700bba77f184eb.pdf?index=true
    • https://801a9f91-e12c-4b3a-b535-42c3eaff61c8.filesusr.com/ugd/d237ef_09aff352c0b84a93b0bc20faf9871578.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5bc39fe6-d15c-4e83-b49d-9a19e746748c/pajedilekivoleguxudivox.pdf
    • https://uploads.strikinglycdn.com/files/4ecd43ab-23cc-455a-b2d7-94b87efe289f/sawirisupawabopekebirif.pdf
    • https://uploads.strikinglycdn.com/files/480f6064-8416-4c28-801f-037dc66a31d0/gravely_owners_forum.pdf
    • https://uploads.strikinglycdn.com/files/fe036241-de23-4b3b-a878-1cef8da9a222/relational_database_management_system_definition_computer.pdf
    • https://uploads.strikinglycdn.com/files/842e0293-6ba3-4e32-bb43-1199f6f4d37b/befubowozuroxobovej.pdf
    • https://5121d360-3808-4f61-aa44-d87cf2d9d428.filesusr.com/ugd/032e8a_46c558027cca4a65b76a12ca7c7aa188.pdf?index=true
    • https://21d44941-995c-48b9-956b-8145330e20d5.filesusr.com/ugd/577b75_44b4887c3c7d4a5aa577dee89b3c3c77.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d10f2ccc-d4a0-426a-8820-0465521fc6b2/miracle_manifestation_manual.pdf
    • https://uploads.strikinglycdn.com/files/ce48bffe-3bab-4ad7-8da2-509161191a29/how_do_i_link_my_iphone_to_my_canon_printer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcd0.bin
47100715805293c86a9ec99ad41c07f28cadda4baa53936ef920c2601563a54d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCD0 5228 bytes
font_01_sfnt_off0000ee98.bin
de383bb116cd41237fa0ebc9ba1a9ed84cca8a0659eb2153bb49afc09db4e3dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE98 10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.