Malicious PDF — malware analysis report

Static analysis result for SHA-256 83c8ff093e18ce20…

MALICIOUS

PDF

75.3 KB Created: 2021-03-13 23:17:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a68609245f1dd2fea7279ae509325284 SHA-1: 6b2fcd60000e37681d117b93631b2ee2e0bc9274 SHA-256: 83c8ff093e18ce20703ae030103d1cdf60e6104ff181d465194e6967d3f19f57
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to SEO-optimized PDF documents hosted on various platforms. This pattern is indicative of a link farm designed to drive traffic, likely for phishing or distributing further malicious content. The ClamAV detection and ML classifier strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=williams+iowa+super+8
    • https://tefuledajejus.weebly.com/uploads/1/3/1/4/131437322/6890445.pdf
    • https://finijuzado.weebly.com/uploads/1/3/4/4/134444754/pudaxidoda-nevew-xagerunonepez-wuxuvetunezosi.pdf
    • https://jeregixir.weebly.com/uploads/1/3/1/3/131381720/bekigerunipe_roxosuzo.pdf
    • https://kukavijeri.weebly.com/uploads/1/3/3/9/133997324/6540139.pdf
    • https://milarenu.weebly.com/uploads/1/3/2/8/132814898/xujufezolidofemonudo.pdf
    • https://static.s123-cdn-static.com/uploads/4370275/normal_5fe38ee3cc65c.pdf
    • https://letazofuwukuge.weebly.com/uploads/1/3/4/8/134869061/dajijiwene.pdf
    • https://xiliperudal.weebly.com/uploads/1/3/3/9/133999468/zamur_dosefixulade_kibimi_nodosegivasi.pdf
    • https://dojoxokixen.weebly.com/uploads/1/3/4/8/134878929/xikomewi-xepalobamifuwer-zuripilomovariv.pdf
    • https://dexatasudawuge.weebly.com/uploads/1/3/4/4/134477966/2381047.pdf
    • https://static.s123-cdn-static.com/uploads/4453537/normal_5fc6ccea726c0.pdf
    • https://lobepujijas.weebly.com/uploads/1/3/5/9/135966441/6637640.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2b25f78c-d54b-43e0-bfcf-700034434dfa/82571297800.pdf
    • https://s3.amazonaws.com/nitajosasa/nuvulumi.pdf
    • https://s3.amazonaws.com/mubemutolewe/samsung_galaxy_tab_4_7.0_sm-t230nu.pdf
    • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_5e0103f971bd48569429fee6d39e3bb1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/99537c88-6a85-4a7d-9815-39cba7d738da/how_to_cook_rice_with_power_pressure_cooker_xl.pdf
    • https://ef733714-782c-48ea-8991-1bc0bf0c95f2.filesusr.com/ugd/ad2ade_b7c1bb116dcd403d99e06fd4834148f0.pdf?index=true
    • https://s3.amazonaws.com/jotizifime/esmo_guidelines_prostate_cancer_2015.pdf
    • https://uploads.strikinglycdn.com/files/d24b1017-7f61-4d6a-b2d7-40e9fe9b5209/how_to_program_a_tork_rz307_timer.pdf
    • https://de315c38-daa2-4293-b666-e554ba9b7d65.filesusr.com/ugd/564d2e_2e177bb532404b4d83b3a8b2e81e4575.pdf?index=true
    • https://s3.amazonaws.com/gonafoziguwewe/office_manual_template_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e923.bin
03f7a546582c80810c9d088223e02a73c3042b52f216c9eae2218285c953681f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE923 5264 bytes
font_01_sfnt_off0000fb07.bin
ff16e65439fbcfbcc657c4a4aa4a553873c1df8d9dca8692042cf953b515d713		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB07 10828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.