Malicious PDF — malware analysis report

Static analysis result for SHA-256 805129946b3928e2…

MALICIOUS

PDF

113.4 KB Created: 2021-03-23 21:57:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 482beb3c5c70f8ac4e79c287eb6f6d08 SHA-1: 2daa42ae4269a54dc90cbdde1e946f7354a9c59a SHA-256: 805129946b3928e2db545df6acc99ebfbea045442d1a9b6552da6785b39a060e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with the primary URL mimicking a search result for a specific query. This suggests a phishing or SEO poisoning attack, aiming to redirect users to potentially malicious content. ClamAV detection and ML classification further support its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=blasphemy+law+pakistan+pdf
    • http://natorg.fun/translucent_paper_sheetsw0uz4.pdf
    • http://shoop-fr.ru/92753080321n37sv.pdf
    • http://wabuxon.iblogger.org/access_point_tp-_link_tl-_wa901nd_manual.pdf
    • http://zukixulen.mypressonline.com/juxenutamabufelunafavupa.pdf
    • https://pedegafulip.weebly.com/uploads/1/3/0/9/130969407/e37b40a3704da4.pdf
    • https://rewumakabaw.weebly.com/uploads/1/3/4/8/134856880/524790.pdf
    • http://shoop-fo.ru/710351595187q5db.pdf
    • http://rexevivejegox.scienceontheweb.net/34678605105.pdf
    • https://momimuraw.weebly.com/uploads/1/3/1/3/131384495/joxudegelebinedaje.pdf
    • http://lawobusupovapuv.22web.org/43595767698.pdf
    • https://kagarowili.weebly.com/uploads/1/3/1/0/131070488/janusixes.pdf
    • https://tusogakesi.weebly.com/uploads/1/3/4/6/134661960/5404419.pdf
    • http://yourlivehelp.com/mini_retro_classic_game_console_built-_in_62075hit.pdf
    • http://wersita.fun/33711754739hmkr9.pdf
    • http://zanartcc.net/70966746621lem5s.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jatodilo.epizy.com/does_hazel_die_at_the_end_of_the_fault_in_our_stars.pdf
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_d749de6522904544882931651c61924e.pdf?index=true
    • http://nazewomufewe.rf.gd/4454001252.pdf
    • http://durenifujogax.myartsonline.com/kuwiledusexikuborarenigug.pdf
    • http://miwewugewu.atwebpages.com/skylar_grey_fifty_shades_of_grey_song_lyrics.pdf
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_c5ea8b8a8bbc4b49892df8d07d3917d5.pdf?index=true
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_e6f24d0bd6bd4a45a00561d0f59e7743.pdf?index=true
    • http://xikusaduxofi.atwebpages.com/91444600692.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00019805.bin
e66e547c52c035815275d961ab36074667b9b93df9fb3f92fa2fc7977c8741cd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19805 19000 bytes
font_00_sfnt_off00015dc8.bin
5abd16bf25710dc39ebdb9f930af65fdb2a210da866efb75485b706d27f50728		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DC8 5492 bytes
font_01_sfnt_off0001706f.bin
3f4439dd925fd4acde577ee49f152d477ade496884e8124980976307d5844fbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1706F 11576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.