Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ee01766a06c75c0…

MALICIOUS

PDF

77.0 KB Created: 2021-03-01 05:32:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b79c0a470e7a1ea699267ee2a383265 SHA-1: d53658bc37688b3e9307c14a037e6422097714c7 SHA-256: 9ee01766a06c75c0134d1a3b152d34f5d3c94369758cd2495239b7f83d43dfe2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO farms or to direct users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URIs suggest an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=who+was+original+cast+as+captain+marvel
    • https://bobepeduzogir.weebly.com/uploads/1/3/4/6/134673546/52be8ed17ec20c.pdf
    • https://cdn-cms.f-static.net/uploads/4387031/normal_5fd7a4aeae30c.pdf
    • https://cdn-cms.f-static.net/uploads/4409604/normal_603a79fb2537d.pdf
    • https://cdn.sqhk.co/zumedizojas/bhaiffb/sisters_oregon_real_estate_brokers.pdf
    • https://cdn-cms.f-static.net/uploads/4489595/normal_60295658adafe.pdf
    • https://static.s123-cdn-static.com/uploads/4374369/normal_6000ae5a5509d.pdf
    • http://zevewidojodot.mywebcommunity.org/dungeons__dragons_3_the_book_of_vile_darkness_cast.pdf
    • https://befufagu.weebly.com/uploads/1/3/1/3/131384284/xalunixidesi_pemafazorazer_sofukilu_baseviz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/dazinibonofobi/fedex_label_template.pdf
    • https://s3.amazonaws.com/jadudusujuje/jogo_de_luta_para_celular.pdf
    • https://s3.amazonaws.com/kefefetafij/20396396792.pdf
    • http://vudalulok.rf.gd/20965167604.pdf
    • http://pidezesu.rf.gd/5791346992.pdf
    • https://s3.amazonaws.com/vixuwogetiv/54928078254.pdf
    • http://zizinamejukurep.rf.gd/17473948275.pdf
    • http://padijajuvon.rf.gd/pumisulikoxukomenuvu.pdf
    • https://s3.amazonaws.com/fofeguj/bollywood_movie_video_2017.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e14c.bin
726a3fcce3ff9c761a13762018313fb183b5c111acaafffc1ae71d876b43e5d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE14C 5300 bytes
font_01_sfnt_off0000f33a.bin
f4f6ca432504003058c6eeeca21a7c842cd0cea93096fde3403a3748a61a8508		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF33A 11072 bytes
font_02_sfnt_off000118f1.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118F1 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.