Malicious PDF — malware analysis report

Static analysis result for SHA-256 98b898f282f89318…

MALICIOUS

PDF

78.3 KB Created: 2021-05-08 18:35:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 924dedad4a4674c51fb175607710df2e SHA-1: 7b3a7e1c507031e40522196bb62065514551896a SHA-256: 98b898f282f8931872d9aef8b704ecf3943af5bcaf3dfeea4649f3d1f1b803ad
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. The document body, though heavily obfuscated, contains text related to 'Fallout 4 map bobblehead locations', suggesting a lure. The presence of external URLs and the ClamAV detection as 'Pdf.Phishing.Trojan' strongly indicate a phishing or scam attempt designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=fallout+4+map+bobblehead+locations
    • http://getarileduvuda.22web.org/lewonuna.pdf
    • https://cdn.sqhk.co/jalotenabo/zicidjf/air_elite_group.pdf
    • https://cdn.sqhk.co/tatidukigag/qjbhb5j/mijejolumirorakar.pdf
    • https://cdn.sqhk.co/rumoligodo/iehbhiR/car_racing_warsaw.pdf
    • https://cdn.sqhk.co/fedelubu/jcmhjgg/61256876873.pdf
    • http://bekowakiged.iblogger.org/printable_calendar_template_december_2018.pdf
    • https://cdn.sqhk.co/milimewaj/9ijFhdR/mp3_music_player_2019_equalizer_and_bass_booster.pdf
    • http://tenakororor.iblogger.org/azshara_heroic_guide_deutsch.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4fa17fa3-4a62-49cb-867b-449ed59ccbd5/65079383287.pdf
    • https://uploads.strikinglycdn.com/files/af89d3f1-1c21-4b9e-9b25-e4bd5ed4a37f/how_to_teach_phonics_grade_1.pdf
    • https://uploads.strikinglycdn.com/files/7fb60a51-59e9-4d18-9bd2-5bf4bfdeec4b/60466769443.pdf
    • http://zolasot.rf.gd/madame_calderon_dela_barca_la_vida_en_mexico.pdf
    • https://uploads.strikinglycdn.com/files/beda95e2-8311-44b9-8d8f-28ff7106d93b/3319324919.pdf
    • https://d45de9d9-8116-4232-9203-1b9506c390e4.filesusr.com/ugd/a69a10_c6fb1f6ae8eb41f1b69d8d96f5717eb3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5c787f0a-2660-4b6e-ab81-87cd7e69a5cb/organizational_culture_refers_to_a_pattern_of_shared_beliefs.pdf
    • https://uploads.strikinglycdn.com/files/508c357a-78a9-4408-83f7-4443fade74dc/fadelewagaxubifi.pdf
    • https://uploads.strikinglycdn.com/files/be8e10ef-f293-4cbc-a853-1618e4cb1e9d/zuzulonibogobitu.pdf
    • https://e9b66cc5-9289-431c-8f17-6739e1cd2d88.filesusr.com/ugd/c8f33b_c4312b4da9574e1988526ddfde35f467.pdf?index=true
    • http://rironedonigebi.epizy.com/bach_piano_sheet_music.pdf
    • https://37b1cabf-41b6-4e27-befa-0fe7335ed416.filesusr.com/ugd/9d05b5_4614dfa9263e46429d44cce5a7ee2c66.pdf?index=true
    • https://9eff4bf0-55a5-42b9-a65a-250f23c32afd.filesusr.com/ugd/80978b_50198e860d2c4a6399a1d49907b67431.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9c90cef8-5397-4781-a59e-0507d071942d/news_of_the_world_streaming_netflix_canada.pdf
    • http://kolofagigetu.epizy.com/candlestick_livro_gratis.pdf
    • https://uploads.strikinglycdn.com/files/36f0fddf-3fe6-48d2-aef5-c3021bb20729/graph_y__x2__4x__1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f501.bin
46375f19c2b53cd751f708d38a165d08e6811c0c002b607366cfc7a83a54bcd5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF501 5400 bytes
font_01_sfnt_off00010736.bin
bfe49454e65e437a93a3c39a2216deb7aa51a56b944edfb098d76b124f686d95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10736 10624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.