Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f6fae5d7b0eb07c…

MALICIOUS

PDF

87.4 KB Created: 2021-03-17 02:23:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 4edd07f8023704cbc5dfd61ba5961f37 SHA-1: 5753c99fcfaacf5353632c1785572db267b01151 SHA-256: 7f6fae5d7b0eb07c2537a12c7ec6512a6cafa2e341dd19e5bcef87a833fba1b3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=national+high+school PDF link annotation
    • http://love-cosmetics.shop/video_maker_software_free_download_for_windows_74xfuj.pdfIn PDF document text
    • http://card2card.live/el_dador_de_sueos_libro_completoxnit3.pdfIn PDF document text
    • http://gbarb.me/38013736911tx8ta.pdfIn PDF document text
    • http://pifovabu.getenjoyment.net/11704860820.pdfIn PDF document text
    • http://czecheducation.space/domino_s_delivery_pizzahyewu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://b2bd4247-5771-4f9a-9f3f-b46500bff287.filesusr.com/ugd/f41bfe_a2f24ba49dc14cb89be4ed10e517c34e.pdf?index=trueIn PDF document text
    • https://98e80eac-0673-4bf9-a3de-4132461903b3.filesusr.com/ugd/1acd69_48c732ee0ce54fde9039bc39f18cef2a.pdf?index=trueIn PDF document text
    • https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_2814e4d63c7d47f48e8b6f4f407b6c8d.pdf?index=trueIn PDF document text
    • https://590703a0-be71-4d3c-a49f-17767d5969ef.filesusr.com/ugd/656c20_0047ca4898b94e1eb2e5ddcb3563bdd9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jivala/suruveg.pdfIn PDF document text
    • https://s3.amazonaws.com/vososasoxumete/18495711678.pdfIn PDF document text
    • https://s3.amazonaws.com/fapaga/fortnite_monthly_revenue.pdfIn PDF document text
    • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_0ed408d0591d42a9bed1188033fbaef8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nademopor/lobodum.pdfIn PDF document text
    • https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_bbb00ff526284b98b6f9ec3ebb8cf8c7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rujabepifar/78825676909.pdfIn PDF document text
    • https://9d349da1-218b-4b59-9e37-2a90cab56d40.filesusr.com/ugd/de9003_3c9a0db9f9c543bd9cc1e1c43c18bf64.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kesumasaka/what_are_the_safety_precautions_in_the_workplace.pdfIn PDF document text
    • https://e22e8d81-f41f-4d51-abb1-39b19d2d32bb.filesusr.com/ugd/96bf9d_508e8feb53354288a4f3fa20d98c6a64.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xixonu/amazon_pay_gift_card_quiz_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/39899077829.pdfIn PDF document text
    • http://luvabokinoleg.onlinewebshop.net/the_road_less_traveled_ebook.pdfIn PDF document text
    • https://s3.amazonaws.com/divikufifir/narefefawifevevuwixe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000117e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117E3 4936 bytes
SHA-256: ac0e23ad9bbd11fb861070fa607ac44351b55b5303d49625b9a87ef94c4ae659
font_01_sfnt_off000128b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128B4 11648 bytes
SHA-256: 7e516fb4c9915e8683f38fff05244febf5bf8ac3821867272606b7e20d60f855

Open this report in the interactive analyzer, or submit your own file for analysis.