Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d0685f882a2726e…

MALICIOUS

PDF

94.5 KB Created: 2021-04-09 00:50:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ef0ba32cc1fddfdf317e501726c61440 SHA-1: b76814646192f64a43fbe76e35d00425ffe601ef SHA-256: 9d0685f882a2726ea6393b885fe885bb5dfd74b87a1115f2185169782b2812f6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to redirect users to potentially harmful websites. The ML classifier and ClamAV detection strongly indicate malicious content, likely phishing or a trojan. No scripts were extracted, but the presence of numerous external URLs points to a content-delivery or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=what+is+theory+of+relativity+all+about
    • http://mekomob.getenjoyment.net/69665373353.pdf
    • http://bumumapa.mypressonline.com/apache_nifi_for_dummies_download.pdf
    • http://fitatuvepejozo.sportsontheweb.net/prefixes_and_suffixes_worksheets_for_grade_6.pdf
    • http://latujor.22web.org/onkyo_tx_sr604.pdf
    • http://kirunag.66ghz.com/pronunciation_guide_for_english.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://da9d63b4-fbfd-4f6f-88e7-06ac0d76355b.filesusr.com/ugd/ca300b_c428278e50eb433c967afc1aff68dfc9.pdf?index=true
    • http://tituroxir.rf.gd/deremis.pdf
    • https://s3.amazonaws.com/vasofirida/54357520797.pdf
    • https://s3.amazonaws.com/fovezewi/dubabupovozagasubewaj.pdf
    • https://1c8fadd7-09eb-4d2b-9d42-8e747ba5ce52.filesusr.com/ugd/60625b_e814f875992a4c2880c75476f4457dca.pdf?index=true
    • https://39c3e2ba-dcb8-4bc0-9ed7-0058f02c59d5.filesusr.com/ugd/fd4c29_1ade1f0f3a1e49dda3c61a24e6b2c64b.pdf?index=true
    • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_573109a8ee6f466d833adb7fbc844f25.pdf?index=true
    • https://s3.amazonaws.com/ganubifirigevi/does_sanyo_make_a_smart_tv.pdf
    • https://s3.amazonaws.com/pirosisob/44738786128.pdf
    • https://631ffb88-cf2d-4844-8d6b-9338a1b21cc5.filesusr.com/ugd/d24e6f_6c40e2211f344c199302c1f3515b22dc.pdf?index=true
    • https://1527c8d3-3321-4e9f-872f-e2bebb57bac2.filesusr.com/ugd/bf2d42_05f243757476403c935c7fe7dc98af69.pdf?index=true
    • http://wudazebej.atwebpages.com/63498555863.pdf
    • https://4bd9ed84-c80b-4837-bb2f-b1353ebfd8aa.filesusr.com/ugd/5a1791_bca3973d6c6c454aa5c88bdb7835a343.pdf?index=true
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_8cbff0ea1c41456c8f3e7a35b7f14f4b.pdf?index=true
    • https://s3.amazonaws.com/dupula/utmost_wealth_withdrawal_form.pdf
    • http://kuwijiti.myartsonline.com/55108219764.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001335e.bin
f4bacbfa77a04d89c554dd27a7f7d16e7025086a279540f2932127dd654bdbb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1335E 5168 bytes
font_01_sfnt_off00014504.bin
566f1f95554507566d4462b3e7160a60265eec25843c2518899cc9d286fcb5aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14504 11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.