Malicious PDF — malware analysis report

Static analysis result for SHA-256 838eb9a0ecb52413…

MALICIOUS

PDF

77.1 KB Created: 2021-03-19 06:00:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6aaad42dbed64c12ec43565985a7d323 SHA-1: 750d44a43e13026b385f3c56d74707539cd83eab SHA-256: 838eb9a0ecb52413dea47c10c65f26acfe3c8f12f263ad09d70728b0efaa2dd1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, pointing to various PDF documents. This behavior is indicative of SEO manipulation or a distribution point for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=economist+pdf+vk
    • https://static.s123-cdn-static.com/uploads/4473902/normal_5fe31a634e65a.pdf
    • https://cdn-cms.f-static.net/uploads/4477147/normal_602709a5d5323.pdf
    • https://cdn.sqhk.co/vurelakixu/fggXhjU/nick_foles_contract_with_the_chicago_bears.pdf
    • https://manujemupofux.weebly.com/uploads/1/3/0/7/130738512/eb45466.pdf
    • https://cdn.sqhk.co/ramidazumiko/4iegfha/jatezamirumozovapevirimu.pdf
    • https://vutuwoti.weebly.com/uploads/1/3/4/7/134720014/52d07994fc19b1.pdf
    • https://cdn.sqhk.co/zanudiwageg/pheujgU/rumemefetepixu.pdf
    • https://cdn-cms.f-static.net/uploads/4495531/normal_602c972218e52.pdf
    • https://guxenebulofoto.weebly.com/uploads/1/3/2/8/132814975/7532260.pdf
    • https://static.s123-cdn-static.com/uploads/4374380/normal_6003ebf4a8a96.pdf
    • https://cdn-cms.f-static.net/uploads/4365546/normal_601dae7c2b63d.pdf
    • https://static.s123-cdn-static.com/uploads/4391302/normal_5fc733e9a0b28.pdf
    • https://cdn-cms.f-static.net/uploads/4413122/normal_604648857e8a5.pdf
    • https://cdn.sqhk.co/gogojelawov/gfeigZa/bupigiwanunova.pdf
    • https://vuverararusug.weebly.com/uploads/1/3/4/8/134883490/452834.pdf
    • https://cdn.sqhk.co/nubavojek/3jdhgia/85176677888.pdf
    • https://cdn.sqhk.co/ferudati/Z96iLb5/food_wars_shokugeki_no_soma_season_3.pdf
    • https://vidatizotasajad.weebly.com/uploads/1/3/4/0/134017381/famavakepijuluj.pdf
    • https://bozelisu.weebly.com/uploads/1/3/2/6/132695328/dotaximaxonex.pdf
    • https://fadijugiwekonu.weebly.com/uploads/1/3/1/4/131410939/8803384.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f147.bin
55157f828afcb132b604fc8f03d9b3f0d8f3b42f25682b1ad891e444b02e774f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF147 5044 bytes
font_01_sfnt_off0001027f.bin
272272236c36bef463f538fc1e878f49cd2d4c25996518842f2c052d2de5806a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1027F 11204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.