Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fe4ff44cc4c0e23…

MALICIOUS

PDF

78.5 KB Created: 2021-03-31 00:40:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 11fbf7b8962c36902e8e8abf0f27ef8b SHA-1: 1c460c4177ae9447a5c90ee1727679e0a2ab2757 SHA-256: 8fe4ff44cc4c0e23d62821cc69429459f6887cb9306543957d013c3066f524ba
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one prominent URL leading to a potentially malicious domain. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or phishing attempt. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious classification. The document body, though heavily obfuscated, appears to be a lure related to coloring pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=race+car+coloring+pages+printable+free PDF link annotation
    • https://jazezuko.weebly.com/uploads/1/3/4/3/134389352/3961bd5892a2.pdfIn PDF document text
    • https://cdn.sqhk.co/keridola/JhageZC/39446426307.pdfIn PDF document text
    • https://patosalar.weebly.com/uploads/1/3/1/3/131384166/lorojuzomi-nuvixubosa.pdfIn PDF document text
    • https://ruzudagozigiwis.weebly.com/uploads/1/3/5/3/135394236/7b179bbd.pdfIn PDF document text
    • https://luwupedo.weebly.com/uploads/1/3/1/3/131383743/datibopi_xuzifotozaf_vufigumu.pdfIn PDF document text
    • https://cdn.sqhk.co/sojejinof/dja0MOx/morurezil.pdfIn PDF document text
    • https://cdn.sqhk.co/xakalodesi/Cxricia/retro_games_app_for_android_free_download.pdfIn PDF document text
    • http://idealica-itufficiale.website/51257240712zcnmz.pdfIn PDF document text
    • http://callup.today/zofewilevidozia6gi3.pdfIn PDF document text
    • https://jorobeperepi.weebly.com/uploads/1/3/1/8/131856290/migawewini.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://08b4a39d-fa16-4eaa-91be-ae90003cacb9.filesusr.com/ugd/237bf7_b42968fb59c04a079af4a34774f66eaa.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wisuw/mivifusar.pdfIn PDF document text
    • https://s3.amazonaws.com/gonima/nirareveduboti.pdfIn PDF document text
    • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_fd135ed5ad864f628159113407b31c58.pdf?index=trueIn PDF document text
    • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_58b0f7ce74fe469b8e35e97fb4d00683.pdf?index=trueIn PDF document text
    • https://7e8267f5-6380-480e-ad72-df526eaefc07.filesusr.com/ugd/cbe325_96ac1cec691c4c64b755556c84304ac9.pdf?index=trueIn PDF document text
    • https://6448a590-b571-4b71-a9e4-820b8531b153.filesusr.com/ugd/782be2_f4bfddfd8e5e48819c379c83bb42fcc2.pdf?index=trueIn PDF document text
    • https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_49178cf69a53420fb5a269d87ca6854e.pdf?index=trueIn PDF document text
    • https://a72a04b1-e5b5-4d9d-bdd8-34e053c51a64.filesusr.com/ugd/9c50a8_751940453d6144cfb5fff4ff93132cd0.pdf?index=trueIn PDF document text
    • https://4abf464d-34d5-4c80-8de5-e64f30e04530.filesusr.com/ugd/8b3eb5_e0176e96e00a4d36971ae5c56fdfcf0b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vasofirida/banoxukesad.pdfIn PDF document text
    • https://86a9da1b-0b57-4b35-a77a-523886b904cd.filesusr.com/ugd/0d9a50_6c0256a8bbff40ea96ab4e9460bfe8ab.pdf?index=trueIn PDF document text
    • https://4407eba0-147d-4e9d-98ff-19010b67f466.filesusr.com/ugd/c1f2fd_e4b710dd7f25437ea4df65d9d580b972.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vibuvomomuv/litiwofigokasifej.pdfIn PDF document text
    • https://s3.amazonaws.com/zamuriza/95524830323.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6CB 5328 bytes
SHA-256: 06125e2cf50e86db191bf38015b8436ef6b1ee21dc9a6d009411e5cd1c8fff90
font_01_sfnt_off000108fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x108FC 10308 bytes
SHA-256: 3318289c7c18e48242099d1539b253337ba48c445b94e97b598c92926b971462

Open this report in the interactive analyzer, or submit your own file for analysis.