Malicious PDF — malware analysis report

Static analysis result for SHA-256 a179fb81776f6b0d…

MALICIOUS

PDF

91.5 KB Created: 2021-03-06 04:00:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64106df99fce2ae8fcae7a5e1525fd13 SHA-1: bd447eae7fbfa2afcaf60374146ee774934b650e SHA-256: a179fb81776f6b0d2b5cab310d34aa6f13e1ed12beede1c64098d07663c593f5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a phishing or SEO manipulation attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9919

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/aws?utm_term=what+are+odd+functions+symmetric+to
    • https://cdn.sqhk.co/bexutavukaro/yusiarc/one_clue_crossword_chapter_41_answers.pdf
    • https://cdn.sqhk.co/sovokeduseb/dziiMjh/zumekokizegitu.pdf
    • http://doxalasi.mywebcommunity.org/cisco_rv130w_specs.pdf
    • http://mobufuwiwid.medianewsonline.com/whirlpool_cabrio_he_washer_error_code_lf.pdf
    • https://cdn.sqhk.co/zanotunuzi/3igjhf9/dujisiv.pdf
    • https://cdn-cms.f-static.net/uploads/4402262/normal_60379dc70f4c4.pdf
    • https://static.s123-cdn-static.com/uploads/4388037/normal_5fe0b128624d1.pdf
    • https://cdn-cms.f-static.net/uploads/4493873/normal_600f72f7ac756.pdf
    • https://cdn.sqhk.co/lexebogefaj/qjb2chc/lusubitowofeparepajisu.pdf
    • https://cdn-cms.f-static.net/uploads/4487935/normal_602c41056da7f.pdf
    • https://cdn.sqhk.co/ribobujir/he5ohaE/size_of_virus_vs_bacteria_vs_fungi.pdf
    • https://cdn-cms.f-static.net/uploads/4460725/normal_5fe87d21063c2.pdf
    • https://cdn.sqhk.co/sakiforivona/ga8jbhd/man_o_war_steps.pdf
    • https://cdn.sqhk.co/zibumimuw/gfljchi/wolf_simulator_wild_animals_3d_family_game.pdf
    • https://static.s123-cdn-static.com/uploads/4392218/normal_5fc8c41895cd0.pdf
    • http://rubewox.sportsontheweb.net/psychology_in_your_life_second_edition_apa_citation.pdf
    • https://cdn-cms.f-static.net/uploads/4391015/normal_6024151ff1564.pdf
    • https://cdn-cms.f-static.net/uploads/4420756/normal_601a7dc384422.pdf
    • https://cdn.sqhk.co/wajerewuwer/PxP8Qhb/survive_said_the_prophet_bridges_mp3.pdf
    • https://static.s123-cdn-static.com/uploads/4369901/normal_5fc811a9eb790.pdf
    • https://cdn.sqhk.co/lazogapuvo/t8afieb/zoborujolomajemexib.pdf
    • https://cdn-cms.f-static.net/uploads/4392652/normal_6028738e6b9f5.pdf
    • http://fidofawi.medianewsonline.com/fodorilokokimafev.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8909b315-4d59-4940-aabf-0fdaa532e0ad.filesusr.com/ugd/4542d9_f76b9c2648474ca3946b75e79ad397d7.pdf?index=true
    • https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_1c4534f856494ad7918ffdc4a28b4381.pdf?index=true
    • http://nejesezape.myartsonline.com/brandon_burlsworth_death_video.pdf
    • https://0df22b04-17ae-4e65-9af8-3af4445b4601.filesusr.com/ugd/71fd01_98d022719002483f84e72f81561dde65.pdf?index=true
    • https://590703a0-be71-4d3c-a49f-17767d5969ef.filesusr.com/ugd/656c20_749cf7c2202f40779b3ae5affa57ad44.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff8f.bin
4d11d02c8a86bf5ff54dd9d908c332850e4615a4e6e5c3ed8cd249342f5a03b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF8F 5344 bytes
font_01_sfnt_off00011166.bin
fba9f6d5d467b7d6bbccdc8ac95b73ea8a6825a62cfb156e50cd914bb525142d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11166 6300 bytes
font_02_sfnt_off000120bf.bin
e5cc9669aa955c871e11bfd5117455d97b269f88eb56089798ad894d07dc7348		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120BF 12180 bytes
font_03_sfnt_off000149d5.bin
4635c7d6ad2b4fddb05d62107d527f2b5680c8f1bef88041992c8eb571f41ea5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x149D5 16208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.