Malicious PDF — malware analysis report

Static analysis result for SHA-256 806a983ae47bfe31…

MALICIOUS

PDF

77.4 KB Created: 2021-03-17 05:50:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ff7fc3e229669a5d150b9ac236f4c23e SHA-1: 6bcf89d56ab45991ea30eae1aa13dcb8ea1dd58e SHA-256: 806a983ae47bfe3149c86a11b9d96c2986ff6d70952a569341cd9ffb171ce51c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are hosted on Weebly and appear to be part of a link farm designed to distribute malicious content. The document body, though heavily obfuscated, contains text related to 'game football ppsspp gold for android', suggesting a lure to trick users into visiting these malicious sites. The presence of PDF_SEO_LINK_FARM and ML_NYX_PDF_MALICIOUS heuristics, along with ClamAV detection, strongly indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=game+football+ppsspp+gold+for+android
    • https://tewukowil.weebly.com/uploads/1/3/2/7/132741555/muxifireluf.pdf
    • https://nofuxufemi.weebly.com/uploads/1/3/2/6/132681390/9021332.pdf
    • https://nanopimage.weebly.com/uploads/1/3/1/3/131398258/zegakinu_romedakubof.pdf
    • http://lusivemewuza.22web.org/29353650107.pdf
    • https://siwinapevaz.weebly.com/uploads/1/3/4/3/134338690/4c96078f.pdf
    • https://miburinu.weebly.com/uploads/1/3/4/4/134464577/4be931fc.pdf
    • https://nowepokuvex.weebly.com/uploads/1/3/2/7/132740584/jujomema.pdf
    • https://lugifepitel.weebly.com/uploads/1/3/2/7/132710690/xiliz-gewivuzolonela-gafudekot.pdf
    • https://sosanibizug.weebly.com/uploads/1/3/2/6/132695556/9818050.pdf
    • https://bemafaparad.weebly.com/uploads/1/3/2/6/132681832/4186310.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://12dd324c-696b-4d67-8c19-991f3eacec2c.filesusr.com/ugd/eeb7bd_4e1a3df0e77448c9a8cd923fb8c3a5a7.pdf?index=true
    • https://s3.amazonaws.com/pegozegi/74634923083.pdf
    • https://e86c6366-0652-46cb-9e1f-5633a133dba9.filesusr.com/ugd/510a18_adb2b31e15e347b2958aea0cbf44bfea.pdf?index=true
    • https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_d3ad997b5d3a46fa9864e3309a2dcfc7.pdf?index=true
    • https://s3.amazonaws.com/buxoparadazegu/46614612825.pdf
    • https://s3.amazonaws.com/rovuweraja/musescore_sheet_music_itunes.pdf
    • https://s3.amazonaws.com/lemerisinivum/kowuzedu.pdf
    • https://cdfb6f36-dde2-4af5-b3b7-55ff39976061.filesusr.com/ugd/c6ac46_b40893725e37438ea3e2dc3bd6cd8e2c.pdf?index=true
    • https://s3.amazonaws.com/feborobegibew/68684813983.pdf
    • https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_39e22842095740d09c99c4838d85069d.pdf?index=true
    • https://s3.amazonaws.com/visagogijulep/jokadolowaduxagobotaga.pdf
    • https://s3.amazonaws.com/metubevozisul/75399657742.pdf
    • http://pupovedifa.rf.gd/taxatifizumebuvodovoxura.pdf
    • https://s3.amazonaws.com/towakog/how_to_find_speed_of_subatomic_particles.pdf
    • https://s3.amazonaws.com/bolovopizonuki/fepususineboxizusepalej.pdf
    • https://s3.amazonaws.com/dusubonifu/arduino_uno_program.pdf
    • http://warufadul.rf.gd/17630923220.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f067.bin
257dadc33466298fac1d96e352ad678c3d168e8997b336240dba98d02c56e35a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF067 5532 bytes
font_01_sfnt_off00010320.bin
4771226e8ecea4b50cc96ef964301c710e797a439408cd55812d8fcae3bd5a7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10320 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.