Malicious PDF — malware analysis report

Static analysis result for SHA-256 a06fb87f4595420b…

MALICIOUS

PDF

73.4 KB Created: 2021-06-10 18:51:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3927b4787b83c25ca5f91b51ff6dd332 SHA-1: bf4f476249403b458bb094215ad564801f9a404d SHA-256: a06fb87f4595420bc538000af2a2de9f9ebf03fb28bea2ff8e3ee41400be3e2b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, appears to contain metadata related to a technical manual, which is likely a lure to encourage users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/wb?keyword=honeywell%20rpls540a1002/u%20econoswitch%20programmable%20light%20switch%20timer%20manual
    • https://zadumeredevasax.weebly.com/uploads/1/3/1/4/131453870/7105086.pdf
    • https://sesizapilutib.weebly.com/uploads/1/3/4/2/134266568/lilivigiget_fopuxaroluledaf.pdf
    • https://vizazoxo.weebly.com/uploads/1/3/4/6/134600102/xurivodurufijujet.pdf
    • https://melejorun.weebly.com/uploads/1/3/0/7/130775242/makikavelakuxa-lisoko.pdf
    • https://zapirawega.weebly.com/uploads/1/3/0/9/130969804/e019818228cd.pdf
    • https://tizomunu.weebly.com/uploads/1/3/6/0/136050200/rekupegevepimomipi.pdf
    • https://kebafilononuxo.weebly.com/uploads/1/3/1/3/131378837/fakoxobug.pdf
    • https://lolozodosut.weebly.com/uploads/1/3/1/6/131606575/8939928.pdf
    • https://namovisurov.weebly.com/uploads/1/3/5/3/135338224/xapetafi_xipoxux.pdf
    • https://jeketivogusu.weebly.com/uploads/1/3/1/3/131398097/fikozegoveditowajote.pdf
    • https://jirozonuk.weebly.com/uploads/1/3/1/6/131606844/mibige_nexodasados_nudijukefe.pdf
    • https://durafozo.weebly.com/uploads/1/3/0/7/130740533/fab768.pdf
    • https://senugosuka.weebly.com/uploads/1/3/1/4/131454109/rugofetidit_vubujamis.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://liwuvedesisu.pbworks.com/f/valores_normales_de_signos_vitales_en_nios_y_adultos.pdf
    • http://sujabuno.pbworks.com/w/file/fetch/144942765/gofoxagedavetu.pdf
    • http://tusoxefum.pbworks.com/f/maguxezenusumu.pdf
    • http://pokuwatosat.pbworks.com/w/file/fetch/144431805/what_is_aesthetic_perception_in_art_what_makes_something_beautiful.pdf
    • https://uploads.strikinglycdn.com/files/9f9a7481-b3ee-4c8e-8183-4a29540115bb/reloading_bench_designs.pdf
    • http://donigipoz.pbworks.com/f/hack_android_phone_via_wifi.pdf
    • https://uploads.strikinglycdn.com/files/23205853-a770-46d4-94a7-80f735758217/cryptography_and_network_security_projects_ideas.pdf
    • http://lovixov.pbworks.com/w/file/fetch/144868647/58829066030.pdf
    • https://uploads.strikinglycdn.com/files/a3388ad9-5a47-4420-8d7d-3b0ac7faae39/votonalukupufebudixojimik.pdf
    • http://voluluzij.pbworks.com/w/file/fetch/144935805/instagram_hack_account_no_human_verification.pdf
    • http://zukitisa.pbworks.com/f/fudifavigibefi.pdf
    • https://uploads.strikinglycdn.com/files/226e48dd-40f6-4eb5-b93a-ea096b07c250/57495531384.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de35.bin
f94fe36878f00e5a35d1c0e6046c7ea8934e073dbef0a788ffb213d09e49d01b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE35 6216 bytes
font_01_sfnt_off0000f361.bin
58e96e256ddbad1ce72adabf2cb9f2ffe8e9a790ef60bfb6f6b24bc9270adefd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF361 10564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.