Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bcb9a2340b3cc65…

MALICIOUS

PDF

98.5 KB Created: 2021-04-23 23:23:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cb2c43868b408ba5be9216c886b089e1 SHA-1: 1d9c47e2e89d5a14dbb089234953c5046c1f19ab SHA-256: 8bcb9a2340b3cc65a47a7df25ccccd1e79e460d73d14129213f0fdc24a988bd5
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external URIs, with one prominent URL leading to a domain associated with phishing. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains references to popular media, likely a lure to encourage clicks on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=fifty+shades+of+grey+2018+netflix
    • https://cdn-cms.f-static.net/uploads/4420237/normal_601516f30af84.pdf
    • https://jajonugofetafis.weebly.com/uploads/1/3/0/7/130776034/fonavivibe.pdf
    • https://cdn-cms.f-static.net/uploads/4408853/normal_6025cedeba80a.pdf
    • https://cdn.sqhk.co/dugixikisim/ibZUhjS/how_to_cook_bacon_wrapped_scallops_from_frozen.pdf
    • https://vudolexululuj.weebly.com/uploads/1/3/1/0/131070894/dc9a64.pdf
    • https://cdn.sqhk.co/tosuwukiwate/jawjbhi/2998737619.pdf
    • https://cdn.sqhk.co/pinofizulag/xzgceha/wopebajegulamape.pdf
    • http://duwosolutanuz.mypressonline.com/moraxotigubofa.pdf
    • https://kepijiloxa.weebly.com/uploads/1/3/4/1/134108658/lezatotawuva-kijuvifobojerax.pdf
    • https://cdn-cms.f-static.net/uploads/4479707/normal_6009c7814ae19.pdf
    • https://kikurebimeko.weebly.com/uploads/1/3/0/8/130814200/xifanaresugobedolid.pdf
    • https://cdn.sqhk.co/xosujopi/gNAggeT/juwapilonolavazumiku.pdf
    • http://www.opentle.org
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dutimajizowa/hanzo_guide_console.pdf
    • https://s3.amazonaws.com/kiremefegonar/68170276530.pdf
    • http://gafodix.myartsonline.com/data_structures_and_algorithms_in_java_tutorial.pdf
    • https://b354d503-40d1-4c97-84b4-bc0b16c12f35.filesusr.com/ugd/8c7d07_e5a41fcaf5f24f71bb5130feb78605a0.pdf?index=true
    • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_4c0327bce3f64080b4d49e99afb34853.pdf?index=true
    • https://s3.amazonaws.com/lolijexejomak/85cc_dirt_bike_for_sale_under_1000.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000107e4.bin
31be4a4cbd1422f87c0a980da4b3e7d51aabe338140d06411650d3f4eb3bf612		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x107E4 10992 bytes
stream_005_off00014f93.bin
c644e07a9638abf0fbcb97f15a360b65610e0057ea8c56c2ff065a29f601e65a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14F93 24468 bytes
font_00_sfnt_off0000f411.bin
8b770906efd747418ddc43eb510a8c26e746d444d842535f73928648e3d04a83		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF411 5816 bytes
font_02_sfnt_off0001270a.bin
4dc5ce0e5d316ba5dc848c5c9339b3f3d9aec20972f98c3bd3d88c7b26e3fd02		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1270A 12188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.