Malicious PDF — malware analysis report

Static analysis result for SHA-256 a091aadd050e1e77…

MALICIOUS

PDF

71.3 KB Created: 2021-03-29 02:10:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 70a11d050baf84b7e3de1975bb978aae SHA-1: 749a3a00edf1bbf52874cc3489c7c29d3f3bf180 SHA-256: a091aadd050e1e7764625800187ba83958b51f01d179de90875a278ef217082c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to redirect users. The ML classifier and ClamAV detection strongly indicate maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URIs point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=simple+present+exercises+pdf
    • https://wegogutez.weebly.com/uploads/1/3/4/3/134310606/7945975.pdf
    • https://cdn-cms.f-static.net/uploads/4499673/normal_6044233f0401e.pdf
    • https://cdn-cms.f-static.net/uploads/4462368/normal_6018f9e989d30.pdf
    • https://wazaziti.weebly.com/uploads/1/3/4/0/134018063/wolunugupigoso_gifire_linufe.pdf
    • https://cdn-cms.f-static.net/uploads/4427282/normal_600fa4ae13fa0.pdf
    • https://pinozawekik.weebly.com/uploads/1/3/4/5/134589254/sirofupawosuxawaxof.pdf
    • https://maladekokox.weebly.com/uploads/1/3/4/7/134745457/vezof_nonis.pdf
    • https://static.s123-cdn-static.com/uploads/4486061/normal_5fcf2eb4430ab.pdf
    • https://nawajutexi.weebly.com/uploads/1/3/4/1/134108687/6856059.pdf
    • http://wazumitizun.22web.org/48851329044.pdf
    • https://boxenujanazikof.weebly.com/uploads/1/3/5/3/135302290/kipana_zeminijukopux_zadedusemeziwa_sitesini.pdf
    • https://cdn-cms.f-static.net/uploads/4377647/normal_5fd8b8e29585d.pdf
    • https://cdn-cms.f-static.net/uploads/4500887/normal_603a7ea08a23a.pdf
    • https://kitawusew.weebly.com/uploads/1/3/4/2/134234725/3779583.pdf
    • https://cdn-cms.f-static.net/uploads/4468261/normal_604b0f9cb8e63.pdf
    • https://static.s123-cdn-static.com/uploads/4379615/normal_5fcb318082016.pdf
    • https://suxutusebosogu.weebly.com/uploads/1/3/1/3/131379987/ea720da1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://muwaziri.epizy.com/sanisiduxe.pdf
    • http://lozekav.epizy.com/453486489.pdf
    • https://5e024257-ca51-40df-b6b5-a3104c7b7124.filesusr.com/ugd/97368a_1cc995ddc98a4259980354fa7eebb554.pdf?index=true
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_081847fad5344975b017d46e151af85a.pdf?index=true
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_4a9a5c304446435eadcca56d8feba46d.pdf?index=true
    • http://kolixuvurivol.epizy.com/79668237941.pdf
    • https://a04ad255-06d6-4b17-97e7-91173d300295.filesusr.com/ugd/6864df_2bb33d47512d46e29b2a99cdab0ac15c.pdf?index=true
    • https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_909a2d5e014c4f4bab53453969e3219f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db9b.bin
dfc112469773a7184549d5d74f26178321510c4a8ce5a777f6466f213ec9a4bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB9B 5260 bytes
font_01_sfnt_off0000ed6f.bin
8dbe1bf3b3291a5b9147fe3606aa480ee4b426d1c067d449c534e0e8c4931845		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED6F 10068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.