Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c88ede37ef57a8d…

MALICIOUS

PDF

138.0 KB Created: 2021-04-01 13:29:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6db1e03208b173a60d8ae5eb183a44f9 SHA-1: 94aede5a3ffa2f43e8ddf096e36298fd0772a919 SHA-256: 8c88ede37ef57a8da0e38e6d791d065ca890a42f3147eaadc3b90b0f17039b97
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. This suggests the primary purpose is to direct users to potentially malicious or spam-related websites. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=jquery+ajax+formdata+file
    • https://nametipij.weebly.com/uploads/1/3/1/1/131164318/kedawimelekixodalili.pdf
    • https://jowanubeso.weebly.com/uploads/1/3/5/3/135399775/ropibimorerited.pdf
    • http://suletupi.22web.org/meditation_guided_script_breathing.pdf
    • http://tezibif.mygamesonline.org/ps_vita_charger_cable_gamestop.pdf
    • https://jitebogegamoma.weebly.com/uploads/1/3/4/7/134761197/2126633.pdf
    • https://galewijukinez.weebly.com/uploads/1/3/2/6/132695540/2559093.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/85bc9a85-f527-4d88-9472-271dced81556/simon_vs._the_homo_sapiens_agenda_characters.pdf
    • https://uploads.strikinglycdn.com/files/5987d0a6-e420-4b93-b99a-20ed7f19ed6a/medal_of_honor_allied_assault_pc_cd_key.pdf
    • https://53ee2ee6-42da-4c96-954f-60f726bc8d53.filesusr.com/ugd/de2744_30bd5903cf78493dbf8e8b873150afac.pdf?index=true
    • http://mudozegiviw.epizy.com/codycross_answers_group_453_puzzle_1.pdf
    • http://litabasiker.onlinewebshop.net/gubexurajonesudowizi.pdf
    • https://uploads.strikinglycdn.com/files/7e5d87d2-de3a-46eb-9cc5-216222d9fa34/damonavarorapasil.pdf
    • https://0c2a7d7b-be9d-4ef2-a94c-09ca905cc17d.filesusr.com/ugd/7d21c0_093688b54dd04d70b80e2fffefeb9e3c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/24409427-0554-4fd3-a369-08a9e13b9257/32659744783.pdf
    • http://wutesejib.onlinewebshop.net/2188679197.pdf
    • https://uploads.strikinglycdn.com/files/9b9cc6e3-b1f9-4046-892f-a72bd7e5ab12/tipo_de_comunicacion_grupal_y_masiva.pdf
    • https://uploads.strikinglycdn.com/files/d7f2612f-0947-4430-8438-f322999f19f2/mogobogosanin.pdf
    • https://bc732cde-fb09-4fee-8ab5-c82a45a1131b.filesusr.com/ugd/2ac701_68a2683ca4c849948da8c2a2df2f7706.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2e5068c2-de6d-471e-b317-b859ed09daa5/why_doesnt_my_ipod_nano_turn_on.pdf
    • https://uploads.strikinglycdn.com/files/b50dbf0a-3e2a-4594-94d8-2594230f61b4/summer_waves_swimming_pool_walmart.pdf
    • https://uploads.strikinglycdn.com/files/3067f8f5-3bee-4c26-bb21-4b6d3fce5e74/berlioz_symphonie_fantastique_movement_2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e75e.bin
ffaeb114b8dc3870e23df9eb0ea5bd0ca8332dd57cddb073123667cda961e4ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE75E 75356 bytes
font_01_sfnt_off0001ca5b.bin
c8408b21130b75d44ffab77173cc04fb4685edd6c1023b35aa240b2ea3c83535		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CA5B 5236 bytes
font_02_sfnt_off0001dc2d.bin
bab773e89e52d5211de132db7d6e0a5684c6e13ad87a6a6bff6f9200ae7981cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DC2D 11972 bytes
font_03_sfnt_off00020535.bin
354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20535 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.