Malicious PDF — malware analysis report

Static analysis result for SHA-256 826b3567780d6d7e…

MALICIOUS

PDF

91.1 KB Created: 2021-03-23 15:27:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8ef622c00ea69e7578fd59e37655fcbc SHA-1: ed8f1cd68e0197a0ff380394b29cd3a79bf3931e SHA-256: 826b3567780d6d7eee33c6a585a0d2ec148c97efc5d8b4dada6f94eb988db9b8
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to file hosting services, suggesting an attempt to host and distribute malicious content. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document may be instructing the user to open a password-protected archive, a common tactic to bypass security filters. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=barcelona+bus+tour+map+pdf
    • https://tazuwadafif.weebly.com/uploads/1/3/4/8/134857375/9390739.pdf
    • https://regezubigif.weebly.com/uploads/1/3/5/3/135320660/29440ff3c.pdf
    • http://zazorin.scienceontheweb.net/algebra_definition_and_examples.pdf
    • https://miwawedunosojoz.weebly.com/uploads/1/3/1/6/131606480/lunipokezura_vefegi.pdf
    • http://wojisub.mypressonline.com/how_i_learned_to_drive_script.pdf
    • http://zuvalasit.mypressonline.com/wolf_gas_range_oven_stove_ignitor_igniter.pdf
    • https://vakejijumusefuv.weebly.com/uploads/1/3/5/3/135313512/jejexenotowa_wixivibejen.pdf
    • https://neseveroxikiz.weebly.com/uploads/1/3/4/6/134603771/gawiduleriwasofupu.pdf
    • http://fupemagis.mywebcommunity.org/talobubiperevoriviwupu.pdf
    • http://puveputado.sportsontheweb.net/80077257609.pdf
    • http://wurilozi.scienceontheweb.net/25845993318.pdf
    • https://jobalexaxikut.weebly.com/uploads/1/3/4/8/134892204/2792b.pdf
    • https://mefosenide.weebly.com/uploads/1/3/4/7/134715399/8916753.pdf
    • http://wapadax.scienceontheweb.net/62079517167.pdf
    • http://kumululurug.scienceontheweb.net/coordinate_plane_worksheets.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://24451074-f53b-4065-993c-779ba3957988.filesusr.com/ugd/0ae25f_ef76e3d8d63d4ba3940f4b75de4a9f54.pdf?index=true
    • https://c3e810f9-371e-40b9-9a0b-4695a496ec77.filesusr.com/ugd/2c7c49_51fd66aae37f494296c3b6e94b3b8756.pdf?index=true
    • https://3e021c9a-284a-4c54-9ba1-f6d43d4d2ba5.filesusr.com/ugd/a619af_457a6950c2154be18076329a647bb9ac.pdf?index=true
    • https://7e6b698e-d56f-4a21-8c48-787e2f6d39f4.filesusr.com/ugd/7836c9_34d8e4a37f784928a598cde9355952fe.pdf?index=true
    • https://s3.amazonaws.com/wezukep/business_mathematics_questions_and_answers.pdf
    • https://s3.amazonaws.com/tonemakopinibem/kawuwebaz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00010392.bin
096f52fd0367245d6d4f7f7819d823972aa848f1ffdbcbd4cd933a9819b9229f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10392 2792 bytes
font_00_sfnt_off0000f106.bin
84c44f26bd202e793df4a6750511c7f682096478eb566c9ab73d2364e202f68c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF106 5492 bytes
font_02_sfnt_off00010f8d.bin
ed384bb577535ba8fdf44d4a391ad35e3993c2a4e40c1e6c2d374cf35aefd0ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F8D 11584 bytes
font_03_sfnt_off000136a4.bin
b6a6ca5d1ececf9b8f85cf34f243a5152d852bd6c46ff1fd844468d100e5349c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x136A4 16172 bytes
font_04_sfnt_off00014bfc.bin
b219d29f4a34116e917f94ec4556dbb123733e5506e6cfc50b273d7d7971515f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BFC 4244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.