Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c4aa553c4db2032…

MALICIOUS

PDF

95.1 KB Created: 2021-04-06 19:21:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe038c0402ec9ae4cd48bca75980ef3e SHA-1: 6f24898846ca11eb9a8dd684c3e153cc0e352766 SHA-256: 8c4aa553c4db2032b8c9287cdf5d7e844302898a1876594398b4d872f18c98d2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains a large number of external links, many of which are obfuscated or lead to link farms, suggesting a phishing or SEO poisoning tactic. The presence of embedded URLs and the overall structure point towards an attempt to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=bhagavad+gita+chapter+12+slokas+in+kannada+pdf
    • https://cdn.sqhk.co/takularozo/iksjb8t/93224622001.pdf
    • https://lixazasowab.weebly.com/uploads/1/3/4/5/134588429/9469190.pdf
    • https://jubekufolofifi.weebly.com/uploads/1/3/4/5/134593927/5682256.pdf
    • https://regezubigif.weebly.com/uploads/1/3/5/3/135320660/pamebasopulovas.pdf
    • https://satepiwe.weebly.com/uploads/1/3/5/3/135350267/6354260.pdf
    • https://dupukixulin.weebly.com/uploads/1/3/2/6/132681516/wobawi_tipizavur_gejukuwonak_begivuput.pdf
    • https://nanewibogexuro.weebly.com/uploads/1/3/1/3/131382113/sewuwapadu_gogufoxut_mafawureb_keroradojanabub.pdf
    • https://cdn.sqhk.co/kebubupoxiz/ngeior4/planet_survival_tv_tropes.pdf
    • https://cdn-cms.f-static.net/uploads/4366018/normal_604885ddc55ee.pdf
    • https://siresikewutawin.weebly.com/uploads/1/3/0/7/130739490/pefulowulefut.pdf
    • https://vujojetusifej.weebly.com/uploads/1/3/1/3/131398487/28596cb8128.pdf
    • https://static.s123-cdn-static.com/uploads/4393631/normal_60036bdbe081f.pdf
    • https://topalezomezo.weebly.com/uploads/1/3/4/3/134305389/7909519.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0c6b2c5e-c852-454c-8c01-bea24f6181fd.filesusr.com/ugd/b97644_c9d1bae6d2fd408aaf2217270679e283.pdf?index=true
    • https://bc5ba30c-e427-49eb-abc4-9677f18f04c1.filesusr.com/ugd/bcd086_6d84bc0465774e1e8afbeef5acce11e5.pdf?index=true
    • https://19527f6f-7821-4b33-8e58-d909ab9a203f.filesusr.com/ugd/b18fc6_205bcd6f42084753a74a23e8d8b0b2e9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/abd6cbe2-c30d-4bc2-9aa3-9278ad274fff/pipilanofasupediraton.pdf
    • https://a8a70d16-e3f0-4805-b115-4d8c62c40b57.filesusr.com/ugd/82e28d_4844c3924ae240cc8c219725f38593be.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f669d18c-3cbf-4c91-9754-c676750cc40e/biporedexupumelodoseno.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0001086e.bin
8dc59e39b096c169cc1c9f392664571973bd2c71a6a0d92948941662679541b5		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1086E 36420 bytes
font_00_sfnt_off0000eb42.bin
7fb1bdcd1caafad7a5eeee9e985f8d706ee2c1d300003ec564945ce84d6b7d5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB42 5776 bytes
font_01_sfnt_off0000fefb.bin
fd0baac36cf8fc893687cbe6b3b8165417b6c4fca046c9a5e64821bfdf5295b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEFB 2140 bytes
font_03_sfnt_off00014a3c.bin
b7ecc6cd0674eb80fd88e9af066e0eff4544d5c85967045e3d61a4f2b4c54768		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14A3C 10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.