Malicious PDF — malware analysis report

Static analysis result for SHA-256 992ecc2f41139e1e…

MALICIOUS

PDF

79.3 KB Created: 2021-03-30 19:37:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e601befffcb67cedeb04ae8cbb3b58c2 SHA-1: c11ec4b78635c4d010c07e1596197fff5294168a SHA-256: 992ecc2f41139e1e0e6d0901d31a80b3fd589e266c4faec4be71fff1787a1cb8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which point to link farms designed to host malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting a coordinated effort to distribute malware or conduct phishing. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=iyonik+ve+kovalent+bile%25C5%259Fiklerin+adland%25C4%25B1r%25C4%25B1lmas%25C4%25B1+pdf
    • https://jomupalekiloja.weebly.com/uploads/1/3/4/3/134310494/2068385.pdf
    • https://topalezomezo.weebly.com/uploads/1/3/4/3/134305389/6624242.pdf
    • https://cdn-cms.f-static.net/uploads/4467945/normal_6021ea9f37de2.pdf
    • https://cdn-cms.f-static.net/uploads/4407789/normal_602389216c0ec.pdf
    • https://luzatewuxajexi.weebly.com/uploads/1/3/4/2/134265782/mifuta-pesopu.pdf
    • https://cdn-cms.f-static.net/uploads/4374954/normal_5fe894b0edca6.pdf
    • https://puwikopigab.weebly.com/uploads/1/3/1/1/131163601/3fc2098.pdf
    • https://static.s123-cdn-static.com/uploads/4369525/normal_5fd07c37b28f7.pdf
    • https://matiposokatogu.weebly.com/uploads/1/3/0/7/130739068/vetudo_puzadokaxuvixok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ec8143fb-8930-458b-ac01-a4197eacfa87/iso_9001_version_2020.pdf
    • https://s3.amazonaws.com/vonutavekip/23397975771.pdf
    • https://s3.amazonaws.com/mexavofezoxi/uc_browser_freeze.pdf
    • https://fb7bf4c5-056f-4058-a7d1-073478569b53.filesusr.com/ugd/d90490_60ff1b49a39b4c9c928909f377753e5f.pdf?index=true
    • https://d6a293f2-6876-493d-91b7-c13182b05023.filesusr.com/ugd/bcaa7e_14f6d03cb1c3482db5805adef4e2a328.pdf?index=true
    • https://s3.amazonaws.com/jupevuxirapi/agora_2009_movie_free.pdf
    • https://uploads.strikinglycdn.com/files/8d5d4439-60c1-45f8-a617-410a0e3277c6/samsung_sl-m2825dw_toner.pdf
    • https://uploads.strikinglycdn.com/files/3a1b4409-6af9-49a9-9af8-b51cb20ead03/67022008420.pdf
    • https://46ebecaa-9490-439b-bba6-ee77f1a6ca93.filesusr.com/ugd/cee8a1_7b46b6851f5b4d23bf13d50c718b208e.pdf?index=true
    • https://1a9cd40a-f0d6-44d4-a143-19288280ca2b.filesusr.com/ugd/7a13df_ec2ce30a4b8d4adcacc5cca46df27704.pdf?index=true
    • https://s3.amazonaws.com/zuponefi/pa_driving_permit_test_questions_and_answers.pdf
    • https://s3.amazonaws.com/viboxikuz/80603657819.pdf
    • https://s3.amazonaws.com/ladiwuzetawedi/xeleragedawiku.pdf
    • https://s3.amazonaws.com/wobuzisibal/zarizirikiwamo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f38f.bin
6d42d7b28ef269d2ed04710e9f3463c601214c4076927d925ad7444a8a59ea3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF38F 5772 bytes
font_01_sfnt_off000106a7.bin
35225c747439cf7ed3c951adcf410392bcccf4a26685d1fadfab033135cfa0f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106A7 12224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.