Malicious PDF — malware analysis report

Static analysis result for SHA-256 90e2ea26d9a1f753…

MALICIOUS

PDF

79.8 KB Created: 2021-03-09 13:03:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b785e169900d0c9b6e7d7998917bdb60 SHA-1: c768f5bfabafb3958bd31d50cb546eac13f796ce SHA-256: 90e2ea26d9a1f75342df69b610a962c43790ef0e76405356a83aa99d03ff6286
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a significant number of external links, with one heuristic specifically identifying it as a 'PDF_SEO_LINK_FARM'. The primary external URL observed is likely part of a campaign to redirect users to potentially harmful content. No scripts were extracted, but the presence of numerous external links suggests a redirection or phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=2+room+tent+with+screen+porch
    • https://cdn.sqhk.co/muligumixe/0highhb/pirujaditerufo.pdf
    • http://linza.media/constellation_map_apptonbh.pdf
    • https://cdn-cms.f-static.net/uploads/4424991/normal_603016f9f1c60.pdf
    • https://cdn.sqhk.co/relulapezele/jilij3J/vulojuzokujifu.pdf
    • https://cdn-cms.f-static.net/uploads/4416316/normal_6021f7713d293.pdf
    • https://cdn.sqhk.co/nobipajami/jgzyggj/wipamulokajulagikimime.pdf
    • https://cdn.sqhk.co/vumuwilaj/diihdij/trackitt_h1b_extension_nebraska.pdf
    • https://cdn-cms.f-static.net/uploads/4426261/normal_60200bd963ef6.pdf
    • http://pasendapp.online/jebenaxisilspmgc.pdf
    • https://cdn.sqhk.co/jigijobofofa/dPiege7/pba_tour_finals_2018_results.pdf
    • https://cdn-cms.f-static.net/uploads/4501660/normal_6010a5d2861aa.pdf
    • http://plsale.pro/clash_of_kings_strategy_game_guide67dcj.pdf
    • https://static.s123-cdn-static.com/uploads/4482399/normal_5ffff22a0e6cf.pdf
    • https://cdn.sqhk.co/sotisajen/ggj2ggs/42146749023.pdf
    • https://cdn.sqhk.co/tavanaru/EmThhig/56423252122.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3070905d-cde9-47d7-a837-309f4216c262/asian_stock_market_opening_time_in_india.pdf
    • https://c84d532c-3b33-47d6-96aa-4134a1164eb1.filesusr.com/ugd/6d45f6_726e026ddb314f32b5534f555d991b56.pdf?index=true
    • https://uploads.strikinglycdn.com/files/51420b17-6a19-40ec-809d-8cfc7855fcca/44372472651.pdf
    • https://f7e05ffc-afae-4d19-be15-7e9c659e5e5f.filesusr.com/ugd/72f62b_903a7ce1ff74432eb04bff764b95c2aa.pdf?index=true
    • https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_1a9d45c88a6f40db8ccb0f060bfef9c8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9f810bd9-c4c0-4dbc-974d-34181860b3d3/92302339407.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc1b.bin
d17b414ce30d177a449288da1c48f9298374e6fc33117f44bb1005a58ffe2524		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC1B 5060 bytes
font_01_sfnt_off00010d40.bin
808f652151b7f1f02b056a7e2f4b3e4415e641f2fb4ac6182d8110aaa0ccaa37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D40 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.