Malicious PDF — malware analysis report

Static analysis result for SHA-256 a12ed74e5ecd2273…

MALICIOUS

PDF

119.9 KB Created: 2021-04-05 01:41:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 38ee7ad4e137ddc1501fd610e4fdde33 SHA-1: a3515105c29f8ea946a3b648790952da92976ce7 SHA-256: a12ed74e5ecd22733bb942de882f61c391414e92ddf1b77ebbfbdbdf66c08118
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO poisoning or phishing campaigns. The embedded URL 'https://resalured.ru/wix?keyword=pathfinder+unchained+monk+build' suggests a lure to a malicious website. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=pathfinder+unchained+monk+build
    • https://cdn-cms.f-static.net/uploads/4487184/normal_601f3aede39ee.pdf
    • https://cdn-cms.f-static.net/uploads/4482189/normal_5fdb24c348505.pdf
    • https://cdn-cms.f-static.net/uploads/4404959/normal_6029d0ee5228c.pdf
    • https://cdn-cms.f-static.net/uploads/4488336/normal_6011899bf3f0a.pdf
    • https://cdn-cms.f-static.net/uploads/4480145/normal_6060d9ca61c62.pdf
    • http://straponartist.com/pakemegigezokonjxehz.pdf
    • http://golosa-spasibo.ru/5194250303342g6i.pdf
    • http://chatik85939775.fun/75976104202lzp40.pdf
    • https://cdn.sqhk.co/metevetufi/ajijdhb/pulsera_xiaomi_mi_smart_band_4_negro_mgw4052gl.pdf
    • http://ig-copyrightviolation.com/terror_in_the_mind_of_god_sparknotesui5pb.pdf
    • https://cdn-cms.f-static.net/uploads/4411922/normal_60131fd4665d3.pdf
    • https://cdn.sqhk.co/wofunukasu/gngijhx/rogimotibidegituz.pdf
    • https://cdn-cms.f-static.net/uploads/4448126/normal_6048f792843dc.pdf
    • https://cdn-cms.f-static.net/uploads/4386337/normal_601795ddbf117.pdf
    • http://frukt.space/webozipog8xjo4.pdf
    • https://static.s123-cdn-static.com/uploads/4471703/normal_5ff3f29d1f619.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://30fe55a9-f0c7-4aec-9bf5-b9d2225d99a8.filesusr.com/ugd/c4a51e_827a4149adb74f838d0e8afe11e40b0d.pdf?index=true
    • https://e1cd7dcf-8988-4be8-9b1a-722367337987.filesusr.com/ugd/6203b9_b2071d1913944f45aca3ea68ccb3a2be.pdf?index=true
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_37df56deb83544d39be88e9290819757.pdf?index=true
    • https://bb0106b8-f3e0-414b-a873-a0e24df3f2ad.filesusr.com/ugd/b84a33_8c7f0d42939647e6aee3b8988a1b74b7.pdf?index=true
    • https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_5c5a00cbc3a44d149c35a1e23bda0480.pdf?index=true
    • https://0e75ab8e-f6a1-4360-bef2-1d94e06fde4e.filesusr.com/ugd/c0518c_b7d8390490794dfcae97f47ea51e266c.pdf?index=true
    • https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_696a7cd5b7a445deb940461fa9613bee.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019822.bin
ad6e0de1b4de9c439cb22ca0843aef0ba2a920e85636b0b776d32c9c1042a23d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19822 5288 bytes
font_01_sfnt_off0001a9f6.bin
82c03b07af2178311eb9f0382d68763dc8c5e43d275719bfe7269e343fe0d6a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A9F6 11092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.