Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c5e16feb7b200fd…

MALICIOUS

PDF

78.6 KB Created: 2021-03-06 06:25:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 36943af613c1e23066eccfe9c99bdf8e SHA-1: 813af37589f90bcca10dd0ab1f72f0547a7f4c24 SHA-256: 7c5e16feb7b200fda4ac404af36040a627db0f3e49e4ad45c1e79961b31d09b4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to SEO-optimized PDF download sites. This behavior is indicative of a link farm designed to drive traffic, potentially for phishing or distributing further malware. ClamAV detected this file as Pdf.Phishing.Trojan, and ML classification strongly supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=narrative+of+the+life+of+frederick+douglass+an+american+slave+citation
    • http://vosutixovu.22web.org/46093168929.pdf
    • https://cdn.sqhk.co/fujesepulo/rhdhcif/blood_pressure_machine_omron_m3.pdf
    • https://cdn.sqhk.co/dukosisevu/aUKBl5g/kibonabuwulalipuviraw.pdf
    • http://lifolibi.sportsontheweb.net/what_is_chi_in_medical_terms.pdf
    • https://cdn.sqhk.co/pivokazi/1KgghfC/25140425993.pdf
    • http://boxidodo.22web.org/maninajerijuduvoxow.pdf
    • https://regutipedazuvi.weebly.com/uploads/1/3/1/0/131071249/9532a1e3.pdf
    • http://fafijitesulexiz.mygamesonline.org/mikomibotuwatiwozagaru.pdf
    • https://cdn.sqhk.co/javepuju/ihbeLig/practical_ice_cream_maker_frozen_fruit_dessert_machine.pdf
    • https://cdn.sqhk.co/madufuxenuw/Pjahigc/other_names_for_hot_dog_in_a_bun.pdf
    • https://cdn.sqhk.co/fivufotimad/MYhelzc/life_is_strange_chloe_s_house_walkthrough.pdf
    • https://gukabezifom.weebly.com/uploads/1/3/6/0/136051166/2570037.pdf
    • https://cdn.sqhk.co/zudipoje/idv4qxU/talking_husky_dog_mod.pdf
    • https://cdn.sqhk.co/nufesewepi/e2ieRvs/winning_slotstm_free_vegas_casino_jackpot_slots.pdf
    • https://cdn.sqhk.co/vatuliwa/jedgd8U/22376432634.pdf
    • http://zazorin.scienceontheweb.net/didumedosirizu.pdf
    • http://></http://></
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://padusij.onlinewebshop.net/2006_bmw_330i_repair_manual.pdf
    • http://jepatejefa.epizy.com/19352769612.pdf
    • http://zobawukesilebaf.epizy.com/chemistry_form_4_chapter_3_notes.pdf
    • https://7aff118d-26f6-4d76-9bc9-1838009e7274.filesusr.com/ugd/f80014_51bb0137dc30446ca316bb7a5a75e9b3.pdf?index=true
    • https://2e5cbe44-7de3-4e3f-b94c-8a8567814465.filesusr.com/ugd/f96b02_d699961e83474f20b434f692d5f34630.pdf?index=true
    • https://bdc3fad0-85dd-4e34-85f7-620d54d4ff6f.filesusr.com/ugd/10cedf_a9930e1d80d24fba8d2769f8ec54dd2f.pdf?index=true
    • https://680e7e7f-99bb-4309-8a01-ecc910dc7690.filesusr.com/ugd/717a42_e84ac7d232ad41d3829710ed8517ea07.pdf?index=true
    • https://8c285b57-3156-47ce-881b-df665acc117b.filesusr.com/ugd/8d46c2_3bb55ddc966e47a9b6a1c3bdf2dc9c96.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8fd.bin
d5547a82140edd6318637e002cb2973bd0dd194f81897380a1b15dd5b9690c23		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8FD 5528 bytes
font_01_sfnt_off0000fbac.bin
ef8fac7fcaff41a91cbcd488a108d7d139a6eaea85abbdd861cbdf6c17ba94b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBAC 2920 bytes
font_02_sfnt_off00010741.bin
d5095b1c0c33d0a362f05d3fc8996310c5187a5d7c8b7641eab81cd3efeaf56a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10741 10776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.