Malicious PDF — malware analysis report

Static analysis result for SHA-256 90afdc35a11e73ee…

MALICIOUS

PDF

78.8 KB Created: 2021-03-13 15:17:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8f5dc085de6716555cbd02b561a34cd2 SHA-1: 174761be3f8b00ea8af72fc531b3f72e9c651287 SHA-256: 90afdc35a11e73eec2269d7d4760a661a1413ad94ca3e0f861284f2ae68cb991
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking documents, but one key URL, 'https://soxebez.ru/123?utm_term=facebook+login+android+stack+overflow', is flagged as suspicious. The critical heuristic 'PDF_SEO_LINK_FARM' indicates the document's primary purpose is to host a mass of external links, likely for SEO manipulation or to distribute malicious content. ClamAV also detected this as 'Pdf.Phishing.Trojan'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=facebook+login+android+stack+overflow
    • https://ginufadep.weebly.com/uploads/1/3/4/6/134668932/pobawumi.pdf
    • https://botiwugagow.weebly.com/uploads/1/3/1/8/131872238/6240139.pdf
    • https://mifepomaxa.weebly.com/uploads/1/3/4/8/134897651/9491337.pdf
    • http://zowezuluma.22web.org/vuwuvixakur.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/debiwelof/modern_calligraphy_alphabet_uppercase.pdf
    • https://s3.amazonaws.com/dugibabafod/washington_dc_airport_zip_code.pdf
    • https://97d49ff2-d914-4ae4-8ac8-5e5cf5f77cad.filesusr.com/ugd/6350c7_10cd3daed1b24521a01881f8241be66a.pdf?index=true
    • http://xolilevifiw.rf.gd/what_are_the_four_fundamental_operations_in_mathematics.pdf
    • http://bulanorimene.rf.gd/command_and_conquer_red_alert_4.pdf
    • https://s3.amazonaws.com/batoragubukepo/black_market_android_application.pdf
    • https://s3.amazonaws.com/gudukupir/xubetujuwa.pdf
    • https://s3.amazonaws.com/taturi/18355494129.pdf
    • https://s3.amazonaws.com/rujabepifar/sbi_car_loan_emi_calculator_excel_sheet.pdf
    • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_d5b61713073a4b16a3a1de6d056b175f.pdf?index=true
    • http://tegofiv.epizy.com/gaxalofebenofopetusuro.pdf
    • https://s3.amazonaws.com/nowokil/sample_format_certificate_of_participation.pdf
    • http://bowukedogatowo.epizy.com/bronze_colored_formal_dresses.pdf
    • https://s3.amazonaws.com/zolerazowubow/2348031711.pdf
    • https://s3.amazonaws.com/kukupunopedon/us_passport_renewal_application_form_fillable.pdf
    • http://fanutebuxus.rf.gd/further_processing_epo_guidelines.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b0.bin
11a357207890294528333709b4da940809fa594d0983ce23a3d5eefb1e611f41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B0 5500 bytes
font_01_sfnt_off00010687.bin
c2158ff84ca8bf1e2167232d3249892f2e0a61324c263ff5ebd7b904cf9e913b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10687 11548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.