Malicious PDF — malware analysis report

Static analysis result for SHA-256 89e6fe9cd70f81bc…

MALICIOUS

PDF

84.0 KB Created: 2021-05-28 23:00:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: b81d4af0d83ae62455f160bfba8df7ff SHA-1: e847bab52f912e848842d3643a6f80bae680bc17 SHA-256: 89e6fe9cd70f81bc309492b7d35ea3b10a8e7fb4fd6f517b038c1c242ca69e5e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV and an ML classifier as malicious, with critical heuristics indicating it contains a mass external PDF link farm. The document body, though heavily obfuscated, contains references to 'acg practice guidelines acute pancreatitis' and authoring application details, suggesting a lure. The presence of numerous external URLs, many hosted on file-sharing or personal web services, strongly indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/123?utm_term=acg+practice+guidelines+acute+pancreatitis PDF link annotation
    • https://pakipuxis.weebly.com/uploads/1/3/5/3/135347710/torikawetun.pdfIn PDF document text
    • https://fukenotaza.weebly.com/uploads/1/3/2/7/132740373/xukabemaf_xuwosokok_lefasosesasap_xatawimazexe.pdfIn PDF document text
    • https://xaminipa.weebly.com/uploads/1/3/1/0/131071220/timulazabibakuki.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453909/normal_5fe9811eafa2a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489257/normal_606a00c1246e6.pdfIn PDF document text
    • https://jijovozezara.weebly.com/uploads/1/3/1/1/131163872/pudodewovugamibi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486353/normal_605c3a7ca389a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480173/normal_603efb60b46ab.pdfIn PDF document text
    • https://bevozuvegala.weebly.com/uploads/1/3/3/9/133999301/tufojenalixole.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454179/normal_600fce93f272b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/14dfc5b3-d090-4caa-b276-97fc64d9b135/78256108227.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f72b4d8a-0f13-400b-a643-a78efc974d66/21999388523.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27ec00a3-da14-4d7f-bcb8-a20ba0bb123b/lafetediririraforori.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55de736c-b132-4e0d-8052-1b5c9f0bce7a/kalumudomepaburujivatiz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9f4d790-69ad-46ba-94bf-033d744dc477/25603688163.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c021af70-7f07-4ef1-be04-69e3a4d6755f/romeo_and_juliet_act_1_scene_2_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f04b4e66-ee4f-42cf-9957-7dfe02bb4252/hp_3050_printer_driver_windows_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66268da9-bf6c-4569-bb50-582740d7d6fe/pebinesixekoteposusuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68e2908f-b9e4-4009-9446-6d658042fb0f/19244254062.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5a0398d-acdd-4c97-b960-eeb178c03ede/etapas_del_proceso_de_investigacion_documental.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16bd886d-0823-4343-92c3-077a904ce98a/lenovo_thinkpad_t420_ram_slots.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87165c3b-bbc4-4a37-8b06-e9c4a302b025/what_is_the_role_of_technical_writer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c291aacb-4fd5-4d89-97cd-0f1e074e5e82/child_maintenance_plan_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109A2 5232 bytes
SHA-256: 14fc7a27e04f2e7b7208c16b71e4a5cac29b4fb79f7a9f057f51d3f3f90c7851
font_01_sfnt_off00011b7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B7D 11816 bytes
SHA-256: 14ee171e502d3b3c877a41466fd9d8e840fc16fc434afaba512c2c34a9b908b7