Malicious PDF — malware analysis report

Static analysis result for SHA-256 818108f9ee835db1…

MALICIOUS

PDF

70.6 KB Created: 2021-04-01 19:48:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 527f2eac881eecc4766245baebab560b SHA-1: 29f19516d4a756911ee4de43167a5da32e545014 SHA-256: 818108f9ee835db160a11b168cffe546ec293a1b73aa99db4717af4d0e6efb29
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are disguised as academic resources, indicating a link farm or phishing attempt. ClamAV and ML classifiers strongly indicate malicious content, specifically a phishing trojan. The embedded URLs suggest an attempt to redirect users to malicious sites for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=cambridge+primary+mathematics+teacher+s+resource+book+3+pdf
    • http://spainsale.pro/38722194755rm5h2.pdf
    • https://static.s123-cdn-static.com/uploads/4464865/normal_5fecbf3aba1cd.pdf
    • http://sy0n.icu/return_to_dark_tower_game_release_datevb5fb.pdf
    • http://sberbank.services/saperobazikisuvuspa1cc.pdf
    • https://static.s123-cdn-static.com/uploads/4530070/normal_5fc65ef82add3.pdf
    • https://jofexudu.weebly.com/uploads/1/3/5/2/135295173/266563.pdf
    • https://rofovotojoroko.weebly.com/uploads/1/3/4/8/134878837/bbc418b48b.pdf
    • https://cdn-cms.f-static.net/uploads/4419001/normal_606116cf770ef.pdf
    • https://cdn-cms.f-static.net/uploads/4483839/normal_6044d6d7d5e6e.pdf
    • http://216tilford.com/wosikexesuleraregufabu4nex0.pdf
    • https://static.s123-cdn-static.com/uploads/4448540/normal_5ff61d059cc22.pdf
    • http://milky-rp.space/bomber_jacket_mockup_templates_free9ikci.pdf
    • https://cdn-cms.f-static.net/uploads/4416919/normal_6037c0158f08d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_757cfcf7a0d4423f86a06cd61ba9522c.pdf?index=true
    • https://s3.amazonaws.com/sitok/develop_mobile_apps_for_iphone_and_android.pdf
    • https://s3.amazonaws.com/supefujoxopubu/82882653277.pdf
    • https://s3.amazonaws.com/rebomedug/how_to_get_a_job_proofreading_at_home_uk.pdf
    • https://s3.amazonaws.com/mukutud/x_minus_pro_vocal_remover_apk.pdf
    • https://9a4b5e96-23fe-4021-9525-787506808755.filesusr.com/ugd/b3318b_ea5b4e44efeb46cab39efc6cba47727e.pdf?index=true
    • https://s3.amazonaws.com/gazivemon/taxujanalureleruzifiximal.pdf
    • https://b9a4c3d6-4ccf-4d04-9b0f-c2e9c357e15d.filesusr.com/ugd/e5cbe5_3cc911a931c74794a70007bc050c4ac9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d277.bin
88780e6d1716eae741106c3081d56008c94bd0478cc8c8a2fa9a76138e7da57a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD277 5912 bytes
font_01_sfnt_off0000e66e.bin
97eef12204b03c93436bd1b0b0d84ed34ed5e2f7e4b4ba0703643df582d8c1e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE66E 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.