Malicious PDF — malware analysis report

Static analysis result for SHA-256 99d58b9a8e70a4cb…

MALICIOUS

PDF

80.0 KB Created: 2021-03-24 21:29:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1bb6633ae3d0e155a44183a4fd8313c SHA-1: d115d29e2181625fb287a95b5108b68b106ba5d4 SHA-256: 99d58b9a8e70a4cb94b2b5c3c9fcac808f8867ec32b839973632d4d22f1e0ea9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, with a critical heuristic identifying a 'PDF_SEO_LINK_FARM' pointing to external PDFs. The primary lure appears to be a sociology syllabus for UPSC Mains, suggesting a phishing or scam attempt. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=sociology+syllabus+for+upsc+mains+pdf
    • http://gidonuvawugirid.medianewsonline.com/pdf_to_dwg_converter_free_download.pdf
    • http://mapotilij.mygamesonline.org/a_long_obedience_in_the_same_direction_review.pdf
    • http://wisatemubudu.medianewsonline.com/english_to_french_dictionary.pdf
    • http://xitigedomure.66ghz.com/kejarurizeka.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vovojoj.atwebpages.com/nosamufif.pdf
    • https://a2ae8793-a99f-480d-a3bc-849ef63d34f7.filesusr.com/ugd/cc207a_7fcbfe4b2635479e9fe0c0b142b7177f.pdf?index=true
    • https://s3.amazonaws.com/sazomo/t-test_one_tailed_vs_two_tail.pdf
    • https://uploads.strikinglycdn.com/files/a8fa3fd2-43d7-441b-99ac-82785c5f9652/63484282556.pdf
    • http://rixedimuven.epizy.com/digital_painting_characters_in_photoshop.pdf
    • https://s3.amazonaws.com/moduluzuxikari/noviform_gonsalva_biverkningar.pdf
    • https://s3.amazonaws.com/bivanud/car_logos_and_names_list.pdf
    • https://s3.amazonaws.com/futamo/sr_financial_reporting_analyst_salary.pdf
    • https://s3.amazonaws.com/sabegokek/81877222535.pdf
    • http://gifidabula.atwebpages.com/refutando_o_calvinismo.pdf
    • https://s3.amazonaws.com/wovigebi/canada_visa_forms_online.pdf
    • https://uploads.strikinglycdn.com/files/0e4c8891-1d21-4b9e-adb4-166d005f1b31/99695144322.pdf
    • https://4a0f17ac-6ce6-4c05-9546-25c48d39d9f7.filesusr.com/ugd/cd79e3_8c2cf20c0bd94d3aac47d91b7ae01f70.pdf?index=true
    • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_768e625c62194b819a21e1b444445bfd.pdf?index=true
    • https://s3.amazonaws.com/sixenogafopoj/dodofewamefar.pdf
    • https://uploads.strikinglycdn.com/files/528c6e5b-1abd-4868-a8de-f42875e46e05/the_sound_relationship_house_share_fondness_and_admiration.pdf
    • https://s3.amazonaws.com/tixedujegibex/nowovazaxezatadaxurotuja.pdf
    • https://uploads.strikinglycdn.com/files/2b4145b3-dbdb-46fe-ba7f-5862f51341d4/arturia_minibrute_2_analogue_hybrid_sequencer-synth_keyboard.pdf
    • https://uploads.strikinglycdn.com/files/192120c3-7be2-4707-952b-34715538281e/how_do_i_fix_my_brother_printer_is_offline_windows_10.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f95d.bin
ed02702daa9296655599e882fdc1705758f6fff325c88353c45ab7e8dd6e4e6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF95D 5820 bytes
font_01_sfnt_off00010d1c.bin
973bfd041b02efd7bb3a6fa4e5c66fcd5afc93dba53a95f40c3b07793546a1c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D1C 11056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.