Malicious PDF — malware analysis report

Static analysis result for SHA-256 92710abc647a9cfc…

MALICIOUS

PDF

82.2 KB Created: 2021-03-22 10:05:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 80af3eee2f3b81b84302b273090a7a2f SHA-1: 615b638ebab50cece7b9ba284c009223ce691a9e SHA-256: 92710abc647a9cfcb5b5b28cdb955d40113609b1fafe0f2a33e708e99beb04e1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains a large number of external links, many of which are hosted on suspicious domains, suggesting a link farm or redirection mechanism. The document body, though partially corrupted, indicates a lure related to 'Tamil arusuvai samayal kurippu pdf' (Tamil tasty cooking recipe PDF), which is likely a pretext to drive users to malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=tamil+arusuvai+samayal+kurippu+pdf
    • https://cdn.sqhk.co/vovoritufi/Jgddjfl/46432010725.pdf
    • https://cdn.sqhk.co/wozejodes/5jgdgew/48517416298.pdf
    • https://putebofodabisig.weebly.com/uploads/1/3/4/3/134368176/xogupegag_satazilarax_pefije.pdf
    • https://cdn.sqhk.co/datolabevev/ifhdxCV/ritawekovaxirufibafibuw.pdf
    • http://jerodox.22web.org/pepsi_cola_addict.pdf
    • http://dinewegivogofe.mygamesonline.org/bed_cet_question_paper.pdf
    • https://cdn.sqhk.co/kojetovukufo/jchjje9/21900118934.pdf
    • http://doxisolawasusig.66ghz.com/lebuduxubinedekedoko.pdf
    • https://mobofapewapo.weebly.com/uploads/1/3/5/3/135399527/3358455.pdf
    • https://bamigabimav.weebly.com/uploads/1/3/1/6/131636977/fabadabix-jurajewuxi.pdf
    • https://cdn.sqhk.co/difanemifal/didzV4w/74692247599.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jigezilor/pathfinder_2e_gamemastery_guide_download.pdf
    • https://s3.amazonaws.com/gogunabones/brick_breaker_star_hack_apk.pdf
    • http://dapekafuxururo.myartsonline.com/how_to_calculate_offset_bends.pdf
    • https://0816b8db-db6e-4af9-a106-1766ff0f8d73.filesusr.com/ugd/06e6c8_15c2d51ed058437da8a9685f38f416d3.pdf?index=true
    • http://xepolowamozuxan.rf.gd/fogg_new_advertisement_video_song.pdf
    • http://tutivute.epizy.com/59214243461.pdf
    • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_f4f01f569ddf488ea4bfec44ee8e73be.pdf?index=true
    • https://s3.amazonaws.com/dekogamik/how_to_apply_for_acio_exam.pdf
    • https://80b1f93a-fe74-4439-a81d-34814fa7a505.filesusr.com/ugd/e56fe2_ce0ef8743bb548108357bfbaa544da85.pdf?index=true
    • http://jidufapikefufeb.epizy.com/neguzaf.pdf
    • https://4cd5a77a-be8d-44ba-8952-4177873115c4.filesusr.com/ugd/930050_ec6ffc35b7a24da59e2a7a8350b58088.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000eaf1.bin
d08584cad095ac2900a5af252c421d24e51b4a07cdcb31bc3c97d635cb3567db		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEAF1 19116 bytes
font_00_sfnt_off0000d8c1.bin
2b110859ef486c6d44204cc4da4e9ca94fcb0b86b91fd16f14c85a7ea5ff1979		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8C1 5360 bytes
font_02_sfnt_off0001148c.bin
2bef3146444e2d82049e51c6816258070e0ddeb2ab352c5d184e8b9f25076634		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1148C 10460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.