Malicious PDF — malware analysis report

Static analysis result for SHA-256 83c1f38701941692…

MALICIOUS

PDF

110.1 KB Created: 2021-03-16 18:48:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dac9e0bd72f2858b5f464d184917772c SHA-1: d8809347864c0bcb98cf47f74117f99dafa757e9 SHA-256: 83c1f38701941692d0a0c7ec099f92fb8c118a380e7cfbee26d3f149b3443563
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. ClamAV and ML classifiers flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to lead the user to a compromised or malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9770

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=is+tempest+in+a+teapot+an+idiom
    • https://cdn-cms.f-static.net/uploads/4469640/normal_60403ff48d6f0.pdf
    • http://libutulidux.medianewsonline.com/application_letter_for_math_teacher.pdf
    • https://dukuvurijo.weebly.com/uploads/1/3/4/5/134522813/fe84cac626e6.pdf
    • https://lurevovikofa.weebly.com/uploads/1/3/4/6/134693735/b35e6.pdf
    • https://duxudalo.weebly.com/uploads/1/3/4/8/134866109/588d65db.pdf
    • https://dunopupusegujuz.weebly.com/uploads/1/3/4/3/134348927/5372810.pdf
    • https://punopofogow.weebly.com/uploads/1/3/1/4/131437229/vowurofuvobadir.pdf
    • http://xemokajoled.medianewsonline.com/how_to_write_a_film_analysis_essay_example.pdf
    • http://idealica-official-it.website/papiwoseke6egd.pdf
    • https://static.s123-cdn-static.com/uploads/4407306/normal_5fc9167d3088c.pdf
    • http://pay-order.info/26232979920fndy7.pdf
    • http://trynutra.shop/dhakad_chhora_movie_all_video_songjpmae.pdf
    • https://static.s123-cdn-static.com/uploads/4380393/normal_6009a819ccbe9.pdf
    • https://static.s123-cdn-static.com/uploads/4484814/normal_5feb086364e29.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102Hussain
    • http://smc.org.inhttp://smc.org.in
    • https://s3.amazonaws.com/latufenaw/pepenefuwuwemewisak.pdf
    • https://s3.amazonaws.com/bupijila/4985271458.pdf
    • https://s3.amazonaws.com/bubodeliza/histologa_del_pancreas.pdf
    • https://s3.amazonaws.com/lewuli/what_are_the_twins_names_in_the_shining.pdf
    • https://s3.amazonaws.com/bajuse/pazido.pdf
    • https://s3.amazonaws.com/lanaladu/after_the_sunset_dual_audio_720p.pdf
    • https://s3.amazonaws.com/jarirotexab/the_confidence_gap_free.pdf
    • https://s3.amazonaws.com/juvuraguvutoxif/eagoler_chokh_full_movie_1080p.pdf
    • https://s3.amazonaws.com/bejenosugede/bahamas_government_passport_forms.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • https://gitlab.com/smc/meera/blob/master/COPYING

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off00018920.bin
7849aa43baa88f0600225bff93bf8a3e0eb3949b3fd87a4f2cb215261b9f10dd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18920 18748 bytes
font_00_sfnt_off0000f97f.bin
039609b2326d1f7adcfb4cd5b57324bd23a51c0464a4f770df3bfe58c4ac3b4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF97F 7484 bytes
font_01_sfnt_off000112fb.bin
331523a26cf2d9dd136a12af72f76185d4179ecdbb365264ac907f5593a3c4c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112FB 4912 bytes
font_02_sfnt_off00012396.bin
1d6706b025cac74583389599b2ea872663c2ca42a2db1ecaff8e76a0565febfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12396 4248 bytes
font_03_sfnt_off000132f9.bin
ef620752bea4377fa2441f0f5bd561299ce1e921a172f1a4d3bdbc675525b61c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132F9 4864 bytes
font_04_sfnt_off000142c3.bin
094c6d950dbad620d9130e456b9f6c90e2a5418f646468d0c557ba154d1624cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142C3 4608 bytes
font_05_sfnt_off000153fa.bin
b961f0d78816c837268be56a05020b4e580264433f0547757a9faabe3034e7b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x153FA 17960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.