Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b3fcf2f74f2adaf…

MALICIOUS

PDF

113.4 KB Created: 2021-05-22 20:33:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b48f093bdfcb3510fa7224fa166d9193 SHA-1: b2b4c8e34c94e8798087bc80d1b972e59b85c585 SHA-256: 9b3fcf2f74f2adaf34aa39234217c145e19ef2a51ef0583b4466530552f99664
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or SEO link farm. It contains numerous external links, with one prominent URL pointing to a potential malicious domain. The presence of a 'download' lure further supports a malicious intent to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=studio+d+b1+german+book+pdf+free+download
    • https://cdn-cms.f-static.net/uploads/4412391/normal_603a0655d60a3.pdf
    • https://fikobovivinuzo.weebly.com/uploads/1/3/0/7/130739062/7318527.pdf
    • https://cdn-cms.f-static.net/uploads/4414487/normal_60592df11485f.pdf
    • https://static.s123-cdn-static.com/uploads/4372963/normal_5ff8579276b29.pdf
    • https://static.s123-cdn-static.com/uploads/4497109/normal_5fe598b0b6284.pdf
    • https://demaxezobenila.weebly.com/uploads/1/3/1/8/131856353/xijusixokeleke.pdf
    • https://rowusebejaron.weebly.com/uploads/1/3/1/6/131637242/zisufalutopivo.pdf
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/8125380.pdf
    • https://cdn-cms.f-static.net/uploads/4413231/normal_60216d6530ef3.pdf
    • https://rutarutan.weebly.com/uploads/1/3/5/2/135294158/257291.pdf
    • https://cdn-cms.f-static.net/uploads/4410703/normal_6041d177998d0.pdf
    • https://cdn-cms.f-static.net/uploads/4393908/normal_602b6f027df49.pdf
    • https://pesasujax.weebly.com/uploads/1/3/4/8/134882000/konufigolupobed.pdf
    • https://cdn-cms.f-static.net/uploads/4385853/normal_5fe89cbcf1043.pdf
    • https://vedudogekikusiw.weebly.com/uploads/1/3/1/1/131164168/d66c828b78adf.pdf
    • https://cdn-cms.f-static.net/uploads/4470412/normal_6051913084deb.pdf
    • https://renugukid.weebly.com/uploads/1/3/0/9/130969315/bd989e33e7.pdf
    • https://wifenawejiwatu.weebly.com/uploads/1/3/4/8/134879118/pusufaxelobadot.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/zazelujeju/denonufobibo.pdf
    • https://s3.amazonaws.com/pevuwarobuvowa/42627745323.pdf
    • https://s3.amazonaws.com/vigevot/samatawisixevuwemegowutu.pdf
    • https://s3.amazonaws.com/nolarifaforuxop/canadian_citizenship_practice_test_by_chapter.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000153e8.bin
0211128af99d6baf4e6abac442c1eb74e8597c1176a96df42372aa93ad92ffc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x153E8 5516 bytes
font_01_sfnt_off000166a1.bin
5ac711f4d377c393e8432b50461fef6c9f3b9bb32131620e2c38810d8b543899		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166A1 14040 bytes
font_02_sfnt_off0001940a.bin
503f5200e83b189a546b6c6e1d808633a9135186956fe76ff9bd78de3d91e3c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1940A 16060 bytes
font_03_sfnt_off0001a8a2.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A8A2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.