Malicious PDF — malware analysis report

Static analysis result for SHA-256 96fbb811775f62cc…

MALICIOUS

PDF

79.4 KB Created: 2021-03-17 01:40:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d19b543ae9b23648d81f69781702a69f SHA-1: 1b71e0433dec12e6ea26835e9a41857647cb8311 SHA-256: 96fbb811775f62cc28f8500c87f3af7dd58f4dfdcdd35e60be09dc5d585fa8e1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. The ML classifier and ClamAV detection strongly indicate maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=how+much+gelatin+sheets+for+panna+cotta
    • https://cdn.sqhk.co/zunesunatiri/cijIgcD/planbook_sharing_lesson_plans.pdf
    • https://cdn.sqhk.co/nivunufozub/hfNMhcs/the_cw_app_download_for_pc.pdf
    • http://file-id.ru/manjaro_cpu_governor_performancewgn8z.pdf
    • https://cdn.sqhk.co/sologavabo/Oiiibha/petuwot.pdf
    • http://watertea.space/wavelet_transform_in_image_processingu99a2.pdf
    • http://bettyloustintruckbbq.com/13242276469hs5v9.pdf
    • http://xasopebonun.iblogger.org/tales_from_the_loop_episode_6_cast_alex.pdf
    • http://mitsumoro.ru/borges_fictions_and_labyrinths9xl8e.pdf
    • https://cdn.sqhk.co/kogewole/henggha/49287974227.pdf
    • http://ppl-nutrshopfit.website/vazopekaxiwuxi2yqxo.pdf
    • https://cdn.sqhk.co/wogirujut/dAheiaH/the_room_place_outlet.pdf
    • http://rijewomel.scienceontheweb.net/how_to_draw_a_turkey_easy_step_by_step_for_beginners.pdf
    • http://ozalupa.space/xofubanexalamen182ig.pdf
    • http://kawafopi.mygamesonline.org/55076854475.pdf
    • http://good-production16.site/world_of_darkness_vampire_bookspn41w.pdf
    • http://rigudozefogo.mypressonline.com/atlas_copco_compressor_parts_south_africa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://44879a12-c10a-431c-a98a-7de142752d0f.filesusr.com/ugd/bb4607_34e7a5d0db0f487aba9e41b919429d36.pdf?index=true
    • http://jevoneloz.epizy.com/ncaa_division_2_womens_basketball_schools_by_state.pdf
    • http://suvalomimo.atwebpages.com/how_to_get_bat_in_gta_5.pdf
    • http://xukaneteris.epizy.com/zenow.pdf
    • http://warodisomadux.epizy.com/bachelor_thesis_psychology.pdf
    • http://zedigopafuwu.rf.gd/how_do_you_check_if_your_license_are_suspended.pdf
    • https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_6c61a0592c144322b61eed45c2089925.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f893.bin
4957864773a14eb2c65aa9465f647f52ab4f006d4f7896e88bf97c6c6d95cadf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF893 5480 bytes
font_01_sfnt_off00010b26.bin
14d06f21ea8746f797db17f2ec43f05714addc1e19836595b5fedefa19fd40d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B26 11088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.