Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e6c066a3230dae1…

MALICIOUS

PDF

83.4 KB Created: 2021-04-08 23:52:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 833104de512f5b6a74233ef41981c19a SHA-1: 11d64203581a6befdf68011a68883e1dc5e5a57f SHA-256: 8e6c066a3230dae12475e5ed651421f481ad87ab826b9118eec0b08227257733
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to other PDFs, suggesting a link farm or SEO poisoning attempt. The primary URL, maypoin.ru, is likely part of a phishing or scam campaign. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=toyota+camry+hybrid+price+in+pakistan
    • https://cdn.sqhk.co/rovifatira/NBKQgfH/rutulomutiw.pdf
    • http://wugupomovupa.sportsontheweb.net/logitech_mk710_keyboard_protector.pdf
    • https://cdn.sqhk.co/berazanoga/AgeqmaY/anarkali_movie_video_song_free.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jepinebawo/gimixirijinokanizekudi.pdf
    • https://uploads.strikinglycdn.com/files/96eae88f-d676-439c-829e-e2d27fbc80c3/gimadasovarikize.pdf
    • https://ee67c5b3-b4d3-4257-b425-af55881d3a68.filesusr.com/ugd/c60da7_3a7bcf25908349e88be708111f2b2cec.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bf2f57c2-b915-43aa-9e1d-f3c053bbe15b/10081896150.pdf
    • https://s3.amazonaws.com/mubefula/79304709043.pdf
    • https://s3.amazonaws.com/dubiditiginowo/eversafe_fire_extinguisher_data_sheet.pdf
    • https://s3.amazonaws.com/sirilagewuga/calories_in_a_sonic_double_bacon_cheeseburger.pdf
    • https://s3.amazonaws.com/nufidibodudulad/wonolivamaxosim.pdf
    • https://abc5f1b3-ad37-4660-b048-d9bff2240d70.filesusr.com/ugd/a1fb68_8cb4b8eb4cf7418099b71fe1311afbb2.pdf?index=true
    • https://8ed7ad90-0d0e-491f-9c15-1f6cd5a61d18.filesusr.com/ugd/f1a804_f55e6c14c94141d6ba7c08ec4b339866.pdf?index=true
    • https://uploads.strikinglycdn.com/files/19cec45f-7538-44ca-bf21-e6ba7f386a4e/kung_fu_tea_menu_vegan.pdf
    • https://s3.amazonaws.com/tubupejevomo/xorozopovavewesazosat.pdf
    • http://zevesijuduma.atwebpages.com/jafagopulal.pdf
    • https://uploads.strikinglycdn.com/files/fb650d08-7c7a-4d67-a3db-70ebed73e243/goodwill_in_spanish_fort_al.pdf
    • https://s3.amazonaws.com/sajezife/how_to_fix_lg_tv_screen_size.pdf
    • https://b304dada-1952-41b2-af44-d16a3232bb3f.filesusr.com/ugd/c19c34_475bb07df68b4f7baa4abd3251249174.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fed96b40-a54b-4330-8e2f-4ec90909622a/is_goat_simulator_multiplayer_online.pdf
    • https://s3.amazonaws.com/dixaleko/lawelisezujo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010760.bin
12daa75804e467c15bc191b1b11eea6086d32024be07abe2523a061d86799698		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10760 5536 bytes
font_01_sfnt_off00011a07.bin
049bc1fe0565362a0b2782e63f86f463a72e91a60657504d4fb3e76df2a34060		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A07 11216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.