Malicious PDF — malware analysis report

Static analysis result for SHA-256 826a0cda04d124db…

MALICIOUS

PDF

83.8 KB Created: 2021-04-17 18:59:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9891e98c8666c5ff6ae73abd8f508270 SHA-1: 60d5eec4233f9eaee40124f6416b342678e26def SHA-256: 826a0cda04d124db2d0cadf693223880371ce604ca74e65f700d790b342d11c2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains a large number of external links, many of which are disguised as search results or document titles. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically phishing or malware distribution. The embedded URLs point to suspicious domains, suggesting the document is part of a link farm designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=the+metamorphosis+movie+2019
    • http://gesetaxoxu.sportsontheweb.net/what_are_the_covid_19_health_protocols.pdf
    • https://mubatizusilaboj.weebly.com/uploads/1/3/4/4/134475350/69bd8d2ad81f7.pdf
    • http://icub.tech/7833496642mxjhu.pdf
    • http://kugewezebuvigiw.mygamesonline.org/diagnostic_procedure_in_veterinary_bacteriology_and_mycology.pdf
    • http://tihefers.online/93723605056ava7d.pdf
    • https://sezijaxafiv.weebly.com/uploads/1/3/1/6/131637080/9400926.pdf
    • http://mofobawosenej.mygamesonline.org/67754680359.pdf
    • http://honey-love.ru/33899117147b9mor.pdf
    • http://airet.space/soniwexasurd6g5r.pdf
    • http://bbflowers.net/norekevubupas6ykx.pdf
    • http://levantemosaic.com/kobulipogafobfwb5f.pdf
    • http://drnextact.xyz/99646965439papk3.pdf
    • https://pewenotevis.weebly.com/uploads/1/3/4/5/134597539/toripunafopimuvuzef.pdf
    • http://ukrdomonis.xyz/pebble_smartwatch_app06yd0.pdf
    • http://thiswaytovogue.com/how_to_formulate_an_average_in_excel4gu1u.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_05c7d9ab0143464dbdb1993de9d86ad2.pdf?index=true
    • http://judiserod.onlinewebshop.net/behavioral_activation_cbt.pdf
    • https://770ad53b-b55e-4e58-b1eb-3709f41304f7.filesusr.com/ugd/98e298_28fb94a59e4c473a8daaefcbc9ea0bf1.pdf?index=true
    • https://7e574f8b-ef34-4833-8dee-b18f3ac9fc91.filesusr.com/ugd/af8ffd_a484b2d9b5524dceb6e04cc783d4ad81.pdf?index=true
    • https://s3.amazonaws.com/xulikamul/broncolor_siros_800_l_manual.pdf
    • https://b9a4c3d6-4ccf-4d04-9b0f-c2e9c357e15d.filesusr.com/ugd/e5cbe5_dbe73bc426194630bbbe2211e3fca079.pdf?index=true
    • https://s3.amazonaws.com/wiwuxot/45615951354.pdf
    • https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_af4ca168a6cb480ba7488a5fb79a17a7.pdf?index=true
    • https://s3.amazonaws.com/tokatefozude/english_speaking_online_course_udemy.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107d3.bin
56987e48cad56c3beaa9d439dfa4cb35300b201642a0e06913c1473fa3ff3d95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107D3 5516 bytes
font_01_sfnt_off00011a69.bin
05ed42cd0fe44c71f90d10fdb28e3b2b0230acaabec9831f064fcd76b87a1737		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A69 11656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.