Malicious PDF — malware analysis report

Static analysis result for SHA-256 9148d9445b1f00e6…

MALICIOUS

PDF

98.6 KB Created: 2021-03-17 19:18:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d1259bbf7a0120a7aacb7413a7407253 SHA-1: 52e031802e2094637793adf7975660182de30e38 SHA-256: 9148d9445b1f00e6a7484acc1a76ef404545f0cebc44afe575b94700a59c5693
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external links, many of which are hosted on dynamic DNS services or link farms, indicating a phishing or redirection attempt. The 'SE_PAYMENT_REDIRECT_LURE' heuristic strongly suggests the document's content is designed to trick users into believing there are new banking instructions, a common tactic in business email compromise. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=letter+from+birmingham+jail+analysis+ethos+pathos+logos
    • https://cdn.sqhk.co/mukibusu/MjifDib/nagodufoxexi.pdf
    • https://bozexiwagufib.weebly.com/uploads/1/3/4/6/134695017/9823885.pdf
    • https://migawireradafus.weebly.com/uploads/1/3/2/6/132695569/potene-batejalorevenum.pdf
    • https://static.s123-cdn-static.com/uploads/4408594/normal_5feef9c319244.pdf
    • https://static.s123-cdn-static.com/uploads/4427498/normal_5fffff86ecb70.pdf
    • https://cdn.sqhk.co/segidexu/SggHjaB/nefodo.pdf
    • https://wilubowedawiwo.weebly.com/uploads/1/3/4/5/134528918/65884b9b598359.pdf
    • https://cdn.sqhk.co/waboperunut/EDn6gdh/moonu_love_bgm_ringtones_for_mobile.pdf
    • https://bezaranave.weebly.com/uploads/1/3/4/1/134108953/fogonob.pdf
    • https://walotowujiko.weebly.com/uploads/1/3/4/5/134582573/rusifogebubi-wakakizetiwem-bakanadesa-pufoso.pdf
    • https://cdn.sqhk.co/didatife/jihEics/48208065575.pdf
    • https://karaxofuko.weebly.com/uploads/1/3/5/3/135344752/katabogowezav_timos_pofaga.pdf
    • https://bovakexigi.weebly.com/uploads/1/3/5/3/135314068/2238489.pdf
    • https://cdn.sqhk.co/sebetite/XEjfMnf/12694765680.pdf
    • https://sobemifukoku.weebly.com/uploads/1/3/4/8/134887972/9264041.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/79073f23-13fa-464a-9005-a754a77fa97b/i_102_how_long_does_it_take.pdf
    • https://uploads.strikinglycdn.com/files/a0c66a8c-0486-4ca9-8874-c7fec2e290a1/network_security_basic_concepts_ppt.pdf
    • https://uploads.strikinglycdn.com/files/3aafb71e-73a4-4f70-98e1-2216b1e90fe9/salisodonofivuparusum.pdf
    • https://uploads.strikinglycdn.com/files/666d5ac4-a8ca-416e-af00-16d64414d3b2/rekojivigodetuj.pdf
    • https://uploads.strikinglycdn.com/files/87e68bc9-df97-451f-a427-394d5749cacc/bosoliwaj.pdf
    • https://uploads.strikinglycdn.com/files/d4a1d13a-0bb5-4438-8f60-28812902d75f/fairy_tales_hair_care_target.pdf
    • https://uploads.strikinglycdn.com/files/d720638a-7a0b-4aec-ab49-d63d20bbcfde/sowilolapitotu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001316e.bin
8ccfc193576d3688a74fd3a73895a97502e3d6b56a3d628b01474d83e0de489c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1316E 5364 bytes
font_01_sfnt_off00014384.bin
330c7d42cbb2d82adb258303d2fde1c1f244ece7f10fd823de70fad70b5e07e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14384 12224 bytes
font_02_sfnt_off00016cbc.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CBC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.