Malicious PDF — malware analysis report

Static analysis result for SHA-256 996a308c68ac07da…

MALICIOUS

PDF

79.3 KB Created: 2021-05-08 12:41:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 6a231b0f825d4e7b603b9a2ec494f09e SHA-1: dea024a6bf2706ea4ef0476419ed18dd37e589b9 SHA-256: 996a308c68ac07dab300ce9c05ce0b2fc11ba954463e1c081a8b3ecc98b99c28
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=tascam+dp+006+adapter PDF link annotation
    • http://ctuxuu.com/las_reglas_de_acentuacin_en_ingleszacey.pdfIn PDF document text
    • http://xruhdfo.site/burger_king_menu_and_prices_jamaicagse8x.pdfIn PDF document text
    • http://fivadoguna.medianewsonline.com/bell_less_top_charging_system.pdfIn PDF document text
    • http://memiwuv.mygamesonline.org/moluzegewuduzapulim.pdfIn PDF document text
    • http://finansi-7.online/95201155646ikp2.pdfIn PDF document text
    • http://bitjoms.xyz/rekukuromemorotog8p8g.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zubuwujoxom/medios_de_comunicacion_humana_a_distancia.pdfIn PDF document text
    • https://s3.amazonaws.com/luropiw/how_to_reset_motorola_baby_monitor_camera.pdfIn PDF document text
    • https://869e45c2-9c2d-410b-ad52-4d3411d41339.filesusr.com/ugd/73bd41_22a74cb4052841d6a997821251f34fcd.pdf?index=trueIn PDF document text
    • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_cf0d83f40ce040648d5ab1ac72bdb12b.pdf?index=trueIn PDF document text
    • https://704d67de-a0ba-412a-a77d-f8c4cf0d88a3.filesusr.com/ugd/a83d94_e38c84100d21428693d547fdd4961328.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/filidabut/bus_driving_3d_game_apk.pdfIn PDF document text
    • https://551f0ad2-75d1-4009-b90b-2f3e3e20230b.filesusr.com/ugd/c2bf0a_6878dfbf8dac4a8e856d253b6cbcb271.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/edinson_cavani_injury_report.pdfIn PDF document text
    • https://s3.amazonaws.com/vizegemawokaxe/mivemitut.pdfIn PDF document text
    • https://s3.amazonaws.com/womirofop/5426998100.pdfIn PDF document text
    • https://s3.amazonaws.com/fosagoba/bodybuilding_meal_plan_for_female_beginners.pdfIn PDF document text
    • https://s3.amazonaws.com/posufij/plt_legend_instructions.pdfIn PDF document text
    • https://s3.amazonaws.com/patilawasu/lugakubi.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/74418148586.pdfIn PDF document text
    • https://dec4a425-646e-450a-80ca-a73a75d058ad.filesusr.com/ugd/ba3095_9db0656a7d3340a1bd32303182d3eca2.pdf?index=trueIn PDF document text
    • http://xologikaju.atwebpages.com/test_de_raven_general.pdfIn PDF document text
    • https://s3.amazonaws.com/zoluwivebiro/cant_help_falling_in_love_ukulele.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f490.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF490 5432 bytes
SHA-256: 9d993f93a6cd490dca549558715d6b9fcbd890f7ea482d104a05f6148c007adb
font_01_sfnt_off000106ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106EA 11740 bytes
SHA-256: 25f1f585638523c841975fdf538bc09ff53b7acebd3a42a98c60014d6ecba30f

Open this report in the interactive analyzer, or submit your own file for analysis.