Malicious PDF — malware analysis report

Static analysis result for SHA-256 91d8da006049bce9…

MALICIOUS

PDF

78.3 KB Created: 2021-03-22 22:53:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 16a82e5d69855117b9c2d62097219549 SHA-1: 17088143806d03cf5c215c2259c8ac929f5d4cc4 SHA-256: 91d8da006049bce951bce0f9fd19068714390599b662ab2f05853c3a2639e6e9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one heuristic specifically identifying a "PDF link farm" designed to direct users to a large number of external PDF documents. The document body, though heavily obfuscated, contains text related to a TV show review, likely serving as a lure. The presence of multiple unknown and potentially malicious URLs, combined with ClamAV detection and ML classification, strongly indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=the+leftovers+season+2+premiere+review
    • https://cdn-cms.f-static.net/uploads/4454171/normal_5fdbb0e236a83.pdf
    • https://cdn-cms.f-static.net/uploads/4528260/normal_603d89ce813b6.pdf
    • http://bonozowibewoz.mypressonline.com/kewuvoxonukuduvum.pdf
    • http://xsale.trade/49738566578fak3m.pdf
    • http://goodsun.space/2007_jeep_grand_cherokee_diesel_towing_capacityays14.pdf
    • http://differencecheats.net/1105588398vt8ql.pdf
    • http://jijoxep.getenjoyment.net/pdf_prince2_agile.pdf
    • http://maserolamo.22web.org/gone_tv_series_full_episodes_online_free_without_downloading.pdf
    • http://rezisekuvaz.mypressonline.com/byzantine_empire_history.pdf
    • http://komamoj.22web.org/xaxitibefikijul.pdf
    • https://cdn-cms.f-static.net/uploads/4426080/normal_602c9173d71a6.pdf
    • https://cdn-cms.f-static.net/uploads/4480745/normal_5fd2d7c5c359c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://numorikuge.rf.gd/tanatologia_forense_odontologia_legal.pdf
    • https://645c32c3-7e99-4959-b93b-7980205539d7.filesusr.com/ugd/30a31c_9c1fe14681c34799a4ce6424ab6a3b3e.pdf?index=true
    • https://b56e00ce-d729-42e9-814b-b9a4b194f5ba.filesusr.com/ugd/f6f93f_94813188b3e848e5a002442d7e5977c9.pdf?index=true
    • https://0c6b7a74-1ca0-41da-943c-c268a208a416.filesusr.com/ugd/fef373_64e5297a6d7d47df98e961596de40c56.pdf?index=true
    • http://divimoxigorube.epizy.com/molecular_genetics_and_metabolism_reports_impact_factor.pdf
    • https://8488b7ac-84bc-45ae-88ed-26841205fc59.filesusr.com/ugd/7cda3c_dac22b4c31b1443fa53c1a75411078e4.pdf?index=true
    • https://7a512b58-7189-4bc4-8343-f643fa9054c9.filesusr.com/ugd/1e52da_cd097962757f422480c77363662e332d.pdf?index=true
    • https://367e539a-c541-4439-991c-4bf2bef2aa7a.filesusr.com/ugd/77d535_6b3544c4de16414fb37ee7f29c96740f.pdf?index=true
    • https://d6d3a1c5-32ce-46e9-ae92-c5b8d84d65d9.filesusr.com/ugd/a3b54b_6ff88c81ee1e4ca590bf30e031d3cd00.pdf?index=true
    • http://xanosufamim.epizy.com/dell_latitude_e6540_laptop_keyboard_replacement.pdf
    • http://tuxabatadifu.onlinewebshop.net/ruger_lcp_2_vs_ec9s.pdf
    • https://f803bf1b-e1c2-47f6-a41f-c9785c88fbd4.filesusr.com/ugd/bf07b1_d8384b3abff0494883afb38e379feacf.pdf?index=true
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_756b737728cd40ac9df840c091d9604b.pdf?index=true
    • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_a3daa3e193054f28ace259839bf4f8cf.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f47b.bin
c4c35580c49d3801a234ab338a1adb4061530a434fdc5d752315b0d018db1b37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF47B 5372 bytes
font_01_sfnt_off000106ac.bin
822724325ad86c0a26b657e8907a63ee0efc26491a742b46cb3edb9a4811f05a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106AC 10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.