Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ee37e199f2653f3…

MALICIOUS

PDF

95.8 KB Created: 2021-05-03 00:36:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b12465634e876ee72a622a04cb13872e SHA-1: 26c0603f7efb99be22c0f9aa9f80adfab68e4e87 SHA-256: 8ee37e199f2653f3aaefcf551627743438fa129ecccc391f74d0d97e803c0b28
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are disguised as search results for free PDF downloads, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution via these links. No scripts were extracted, but the PDF structure itself is used to host a large number of URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=betty+azar+basic+english+grammar+workbook+pdf+free+download
    • https://cdn.sqhk.co/moserusoba/mSHgdQu/free_online_games_for_girlsgogames.pdf
    • https://dikasawo.weebly.com/uploads/1/3/5/3/135349802/kokuzijapuve.pdf
    • https://cdn.sqhk.co/loxinesupiva/hhzN4ic/59281800867.pdf
    • https://cdn.sqhk.co/wixexozesila/gLHIjes/vitodatijusovipewo.pdf
    • https://posodukur.weebly.com/uploads/1/3/4/3/134347560/3141f27946d89f2.pdf
    • http://potenciy.xyz/dafobirokitetapimixuluw8p370.pdf
    • https://cdn.sqhk.co/pabefidinaz/chiOSdo/naxelekevorometuziv.pdf
    • https://pebufaso.weebly.com/uploads/1/3/5/4/135400671/7085613.pdf
    • http://demask.space/ncert_maths_textbook_class_6bnb6x.pdf
    • http://webdefilmizle.com/webinuweqkd8e.pdf
    • http://ighelpcenter.xyz/nordictrack_t7si_partschjoq.pdf
    • http://budokudepa.scienceontheweb.net/8067794021.pdf
    • http://tezibif.mygamesonline.org/vexebadejuxelalowapup.pdf
    • https://kexulisil.weebly.com/uploads/1/3/4/7/134762119/36ca71b5.pdf
    • https://cdn.sqhk.co/vusopukov/ighhRid/68771994797.pdf
    • https://xefagopabori.weebly.com/uploads/1/3/1/3/131379938/bogufuj.pdf
    • https://poburazaz.weebly.com/uploads/1/3/5/9/135993358/5542337.pdf
    • https://lozakojetewije.weebly.com/uploads/1/3/4/8/134891862/jokobino.pdf
    • https://dugitesabisaxo.weebly.com/uploads/1/3/4/3/134392589/f472ac1bf8f.pdf
    • https://silepokow.weebly.com/uploads/1/3/4/3/134366863/177406.pdf
    • http://nirenodeba.medianewsonline.com/infosys_verbal_ability_questions_with_answers_download.pdf
    • https://josozigigararu.weebly.com/uploads/1/3/2/6/132681886/viwodisuge.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://vibirokudod.myartsonline.com/seek_and_destroy_bass_tab.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000142a3.bin
a49867076d72125620df1fe35b540fd051dddda88ba245189e4015a5449c67dd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x142A3 19660 bytes
font_00_sfnt_off0001006c.bin
2862f3c6a21cb507b5c4e9affb89bf1fef261ae61c7749c47594d9d3f7b4cd1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1006C 5856 bytes
font_01_sfnt_off00011440.bin
8730757fad339827b6f8cc26b4b2ac1e5b77765dcc52973433e2c371c4bbb692		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11440 17164 bytes
font_03_sfnt_off000162bd.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162BD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.