Malicious PDF — malware analysis report

Static analysis result for SHA-256 94bf4e9d4e8beea4…

MALICIOUS

PDF

79.3 KB Created: 2021-03-31 14:51:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ce311bec63923aa7f5fd039615c04eda SHA-1: ed9b697d52cb655649210c8c78dfff55cef5854c SHA-256: 94bf4e9d4e8beea49acb9af1a2dad5c60a477cbd976b8630257638b596400cd2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which point to potentially malicious domains, suggesting a link farm or phishing operation. The document body, though heavily obfuscated, contains metadata related to 'Dr. Seuss biography' and 'wkhtmltopdf', which appears to be a lure to disguise the malicious nature of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=dr.+seuss+biography+seussville
    • http://lovapezelewog.iblogger.org/83142650096.pdf
    • https://lefukumot.weebly.com/uploads/1/3/4/8/134887275/2761310.pdf
    • https://weranatowo.weebly.com/uploads/1/3/1/4/131408071/bomepakogisa.pdf
    • https://cdn.sqhk.co/waxobakal/gfhj6hi/synchrony_bank_phone_number_rooms_to_go.pdf
    • https://cdn.sqhk.co/wokinuge/hbFmHwn/kozumigugejikagatebu.pdf
    • https://murunabijijot.weebly.com/uploads/1/3/5/4/135401069/rafet.pdf
    • https://wivevesatowot.weebly.com/uploads/1/3/0/8/130813399/cc92067cc9b.pdf
    • https://vagibize.weebly.com/uploads/1/3/4/6/134618654/kanevok-pawanula.pdf
    • https://sifijaxamop.weebly.com/uploads/1/3/4/3/134332722/zelulafezo.pdf
    • https://gikositaga.weebly.com/uploads/1/3/4/7/134773380/8dace0b18.pdf
    • https://cdn.sqhk.co/zowonefaso/HELhigd/car_race_tracks_in_south_florida.pdf
    • http://fazojum.66ghz.com/ambetter_home_state_health_prior_authorization_form.pdf
    • https://fodoradesak.weebly.com/uploads/1/3/1/4/131454556/cb293a46.pdf
    • https://cdn.sqhk.co/puxezuxivas/giebjeO/wagotisote.pdf
    • https://poginatiru.weebly.com/uploads/1/3/0/8/130874277/wotogi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9fb09885-6d30-4877-871e-f3fa08a25bda/jawuwemexugezagewu.pdf
    • https://uploads.strikinglycdn.com/files/82b75c3d-8fa4-46e2-90d2-fe83b67aa2d3/jevugawijafixosa.pdf
    • https://uploads.strikinglycdn.com/files/be1a96b7-6f90-49a9-addc-cff4aa7e54e0/beat_the_market_stocks.pdf
    • http://muropij.epizy.com/new_cutting_edge_intermediate_student_s_book_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/4a32c95f-616b-4096-b8cb-f5a1da5727fc/35669185671.pdf
    • http://pobevejilu.rf.gd/andrew_ng_deep_learning.pdf
    • https://uploads.strikinglycdn.com/files/43f6dea2-50a6-4f7d-8fdd-6abcfb65fac5/62020618407.pdf
    • https://uploads.strikinglycdn.com/files/68bc63fc-329f-49c8-9fa3-136384c6c517/ma_new_driving_license_rules_2019.pdf
    • https://uploads.strikinglycdn.com/files/a82a7fe3-0ebc-440f-bbc9-d888523790d0/sarah_dessen_movie_how_to_deal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f70c.bin
eea7c7e0bebccd5e30d823e9e3f6e82296172beb5bf6016ebd52b93bbbb755fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF70C 5412 bytes
font_01_sfnt_off00010987.bin
7d9b5b94dd79c5f229760e134fde9e66ca9bd8d9a39112142515c10b83bb5d8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10987 10680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.