Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c5e02591fabca3d…

MALICIOUS

PDF

78.7 KB Created: 2021-03-25 03:37:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1479885d9bc52665cf116f7f2f650686 SHA-1: dccd90e0e31d6d1f0934d93daf6a9a5c5fdab6cb SHA-256: 9c5e02591fabca3d63460097b9579a47c9b8eb30b4dc8fe21825e1640533af3f
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are likely part of an SEO spam or phishing campaign. The heuristic 'SE_PAYMENT_REDIRECT_LURE' suggests a potential business email compromise pattern, aiming to trick users into believing there are changes to payment instructions. While no scripts were directly extracted, the PDF structure and link farm indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=important+days+in+all+months+pdf+in+tamil
    • https://gesaleku.weebly.com/uploads/1/3/4/6/134694927/75e38d8b594.pdf
    • https://cdn.sqhk.co/finulepaf/i8jichb/retasutikatujodepux.pdf
    • https://cdn.sqhk.co/fiwujumejuf/iwXdnTo/diafragma_dolor_toracico.pdf
    • https://weralafopibobal.weebly.com/uploads/1/3/4/3/134338927/d6f16.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/772c810c-3f47-4515-a84f-3a851b3c4826/un_historia_de_la_lengua_espaola.pdf
    • https://3c8d80e7-2998-4b53-b1db-ea2053e4eee2.filesusr.com/ugd/5c8c55_378a4ae25ed84ccdb9b83731a5b569d8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ea507246-f0fb-4f0e-ad70-deff2627148c/transformational_leadership_style_disadvantages.pdf
    • https://uploads.strikinglycdn.com/files/c9d6b242-a271-4485-b28d-0a95b5834b3e/corresponding_angles_worksheets_free.pdf
    • https://uploads.strikinglycdn.com/files/fbbe1b57-cf96-471c-b957-1b7d74feeba3/dd_3.5_illusionist.pdf
    • https://uploads.strikinglycdn.com/files/37896181-42b4-45b2-a786-61946d2f0315/10126975667.pdf
    • https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_f970aedffc4a471482637b2194b6af25.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ceab4df0-f13d-4486-86e2-a3544a977ab4/fatokiwitisonut.pdf
    • https://uploads.strikinglycdn.com/files/a82f4135-1d4d-4303-b889-8522ee83e274/5_dysfunctions_of_a_team_pyramid.pdf
    • https://7835c217-6b95-46a1-915a-76cdebae3fe0.filesusr.com/ugd/debfb4_30620e43a3994502b0ba02e3a862205b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3670a48c-ff2f-4a65-99f8-0c9cc5cad57e/mackie_808m_fr_series_manual.pdf
    • https://uploads.strikinglycdn.com/files/9a81ef08-91e4-469d-8e2a-dcacdae7e28b/computer_architecture_and_organization_course_outline.pdf
    • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_423351ab06044fb8b7f1109632c9adf7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a5e8d3a3-6a8e-460a-bc02-c0eb7a54c16d/delete_mental_ray_nodes_maya.pdf
    • https://67389751-14cc-4ed3-b660-7ef7239e4cc3.filesusr.com/ugd/bb5584_71ab4b157fea44548f2f6587e040b080.pdf?index=true
    • https://03f57db0-fbcf-46ec-8713-21b5992b8512.filesusr.com/ugd/455f95_93ced9f84f8b467c818f0458d426b017.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4a4.bin
de4ab1232fc9a30ebc889b413f48de643737212c5402ed0045bc41110d37b6dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4A4 5320 bytes
font_01_sfnt_off00010692.bin
a96a01572ae3037bb8ba298e1f6da5e9271871b96fc4dd1fea5c0d22d0d262ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10692 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.