Malicious PDF — malware analysis report

Static analysis result for SHA-256 8aa8f8383fabba38…

MALICIOUS

PDF

76.3 KB Created: 2021-04-03 22:58:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d2052c69d254361fd9e5408778e94def SHA-1: 9ecd0b639a09e4eb6f612188443bef3d467dd0d1 SHA-256: 8aa8f8383fabba38d9aace732017c16fea284bac00ad41adf37b4d9a3c022e86
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting it functions as a link farm for SEO purposes, likely to distribute further malware or facilitate phishing attacks. The primary URL identified is https://seumenha.ru/award?keyword=past+tense+future+tense+present+tense+pdf, which is part of this link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9743

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=past+tense+future+tense+present+tense+pdf
    • https://cdn.sqhk.co/rudolikube/jghgIEx/3d_bass_hat.pdf
    • https://cdn-cms.f-static.net/uploads/4445731/normal_604768c46358d.pdf
    • http://wurogutevifo.iblogger.org/new_ps2_emulator_for_android_2018.pdf
    • https://cdn.sqhk.co/rumoligodo/hD6ghKi/android_system_webview_disabled_cannot_enable.pdf
    • https://cdn.sqhk.co/lanumakefu/wJjgMge/mabotixudafilawotijo.pdf
    • https://cdn.sqhk.co/jivazufevi/jhZ5jjY/boss_rc-_505_loop_station.pdf
    • https://cdn.sqhk.co/dasewugiru/gghsjcd/bollywood_song_2020_download_mp3_pagalworld_dj.pdf
    • http://bonapimum.iblogger.org/kurukshetra_university_ba_1st_year_date_sheet.pdf
    • https://cdn.sqhk.co/titabofasika/8o83gct/management_skills_assessment_instrument_free.pdf
    • https://cdn.sqhk.co/soribivevi/dsCjcjd/amazing_thief_world_record.pdf
    • https://cdn.sqhk.co/muzedikerum/jixghgi/pac_12_championship_2019_basketball.pdf
    • https://cdn.sqhk.co/zaletimerizo/gehdihW/44455983272.pdf
    • http://pufujijixupoxo.iblogger.org/percy_jackson_and_the_sea_of_monsters_full_movie_google_drive.pdf
    • https://cdn.sqhk.co/nusideja/abhevyW/destiny_child_mobile_game_wiki.pdf
    • https://cdn-cms.f-static.net/uploads/4379231/normal_603c566194cc0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nebaxowowugi.rf.gd/49548948691.pdf
    • https://5e3b32e6-a537-4a58-a531-ef303a468713.filesusr.com/ugd/120874_1b0ab5f747f54b338897fcd14d596746.pdf?index=true
    • http://kamupipoduw.rf.gd/medtronic_neurosurgery_product_catalog.pdf
    • https://6e37e838-c278-4d46-baa9-25b8497af200.filesusr.com/ugd/fbcb80_39cd383b50324a34994d59b081aa124f.pdf?index=true
    • http://gorevifero.epizy.com/taposuvirejonudixavanej.pdf
    • https://6f84c080-6bd2-4154-8ce1-0e390380bda5.filesusr.com/ugd/defdb4_7d20ea2dee3d4503a392b56ea50ba1e4.pdf?index=true
    • https://8d684a1e-4078-49cd-b336-05adf09473b6.filesusr.com/ugd/2b25e8_ac8baaf7f49b4559b6251169c411b5a5.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5ca.bin
2dc34e05d3adf08e7fc2992351eadcf5c4d7c72c72d8a7ef7a92cce932bc75b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5CA 5004 bytes
font_01_sfnt_off000106dd.bin
291ba604617ff92900a0ebea93bce2134a381711e2a8e8de67395652d9e8ce19		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106DD 10452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.