Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d1958493fdc0a25…

MALICIOUS

PDF

80.2 KB Created: 2021-06-04 08:00:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5adf734417f614f5377a832d90973dfb SHA-1: d9e61db7a6dad1d4a778fff88063b967b8d244ba SHA-256: 8d1958493fdc0a258a40f4dacd41e9f7a07e23a0fdf255e4b4338efe5923d218
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a phishing or malware distribution lure, as indicated by the 'PDF_SEO_LINK_FARM' heuristic and numerous external URLs. The document body, though heavily obfuscated, suggests a theme related to 'Autentico 2 capitulo 1a crossword answers', which is likely a pretext to encourage users to click on the embedded links. The ML classifier and ClamAV detection further support its malicious nature, pointing towards a phishing or trojan payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/pbw?utm_term=autentico+2+capitulo+1a+crossword+answers
    • https://golisarupu.weebly.com/uploads/1/3/5/3/135317681/somolirovanolaj_wadip.pdf
    • https://malibuvebejonab.weebly.com/uploads/1/3/4/5/134524684/c0b24.pdf
    • https://static.s123-cdn-static.com/uploads/4473645/normal_5fdfa64f46635.pdf
    • https://doxigexuwalo.weebly.com/uploads/1/3/4/7/134708718/dijonubeluw-pejibo.pdf
    • https://static.s123-cdn-static.com/uploads/4369914/normal_5febcb0b97395.pdf
    • https://vudeberas.weebly.com/uploads/1/3/3/9/133997553/tunaxozatanole.pdf
    • https://mesipaku.weebly.com/uploads/1/3/1/3/131383407/5510076.pdf
    • https://cdn-cms.f-static.net/uploads/4469143/normal_606c46f76129e.pdf
    • https://burekanokem.weebly.com/uploads/1/3/1/0/131069897/sananado-dotezelode-susuginisuzi-supiwemijakiki.pdf
    • https://raxuvutozorar.weebly.com/uploads/1/3/7/5/137512290/b91978373bb.pdf
    • https://cdn-cms.f-static.net/uploads/4377935/normal_603a0240ea533.pdf
    • https://cdn-cms.f-static.net/uploads/4380211/normal_6035fc5a7e49c.pdf
    • https://static.s123-cdn-static.com/uploads/4474977/normal_5fde68d0f13a3.pdf
    • https://pakimisubimoge.weebly.com/uploads/1/3/0/7/130776027/wawibovagonakesok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e356e1bf-06b2-49ba-8719-d9f4ed1928a1/15669292826.pdf
    • https://uploads.strikinglycdn.com/files/a9c4d622-b662-45d5-9152-14cd73a02627/assistir_novela_os_dez_mandamentos_capitulo_38.pdf
    • http://zexowisam.pbworks.com/f/how_to_value_us_silver_coins.pdf
    • https://uploads.strikinglycdn.com/files/06604211-4de0-4030-ae56-d848fc8b3a7c/mystery_gift_codes_pokemon_sword_serebii.pdf
    • http://noxiwako.pbworks.com/f/clean_master_apk_android_4.1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f642.bin
2deae5a8cfdde35c0b6100b0787cdf9fce2fb736dbd7e57e5a899c2196593aa7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF642 5332 bytes
font_01_sfnt_off0001088d.bin
68b128c681d4c6782d6502ac44bcce8a6a461551d7cd4e571fc1816e96aa2a2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1088D 13484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.