Malicious PDF — malware analysis report

Static analysis result for SHA-256 a210d5281ec4a800…

MALICIOUS

PDF

79.5 KB Created: 2021-06-08 17:11:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4c0f501a5f17bde1f88e861306e4939c SHA-1: 7fdb5018be176ae6d069728c6a63268f6bee6471 SHA-256: a210d5281ec4a8001078ca8f584b448d4dd9235c563b1989c6bd589ad340f16f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One of the primary external links, 'https://infrive.ru/pbw?utm_term=sticta+materia+medica', is flagged as suspicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery through the linked content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=sticta+materia+medica
    • https://runobutadafe.weebly.com/uploads/1/3/0/9/130969205/2c2b4c3e9dc5.pdf
    • https://cdn-cms.f-static.net/uploads/4408981/normal_603938fe20b06.pdf
    • https://sizuzevejej.weebly.com/uploads/1/3/3/9/133997482/vofibiwisotogom.pdf
    • https://zapizurur.weebly.com/uploads/1/3/4/9/134900478/lezudojiwaga.pdf
    • https://cdn-cms.f-static.net/uploads/4460241/normal_60365970cc1b9.pdf
    • https://cdn-cms.f-static.net/uploads/4368991/normal_6020ffb5b7cfe.pdf
    • https://cdn-cms.f-static.net/uploads/4497370/normal_60649a7590e5f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/997ae40b-2f30-47ca-a76d-812973f21c25/communication_skills_for_the_healthcare_professional_3rd_edition.pdf
    • https://uploads.strikinglycdn.com/files/e903b7ad-47b7-4555-a2f0-6223193cb3f1/99699889409.pdf
    • https://uploads.strikinglycdn.com/files/bbabddd5-8ca8-489c-8e19-7227fc12bcf7/65026665094.pdf
    • https://uploads.strikinglycdn.com/files/f65bad76-5618-40e9-bb61-f76fc0cada57/nazukupes.pdf
    • https://uploads.strikinglycdn.com/files/b33b98ba-0219-4067-b174-5b4b69b24645/vibagajasogokibupi.pdf
    • https://uploads.strikinglycdn.com/files/4d1e20c3-6580-4355-80e8-23a45e3e61a1/65057060588.pdf
    • http://bobiginokemo.pbworks.com/f/john_deere_54_inch_deck_diagram.pdf
    • http://zixememot.pbworks.com/w/file/fetch/144870018/fugizupugiredujaxekim.pdf
    • http://lojefizowoj.pbworks.com/w/file/fetch/144621075/how_to_fit_a_shower_panel.pdf
    • http://dawijunegolo.pbworks.com/f/baboketajazetog.pdf
    • http://wetavun.pbworks.com/w/file/fetch/144835026/10411671159.pdf
    • http://poforezufovu.pbworks.com/f/fumazuzivedozegutufaded.pdf
    • http://fijovolumi.pbworks.com/w/file/fetch/144835485/62249063874.pdf
    • https://uploads.strikinglycdn.com/files/e1eab398-ca7b-4a9f-bd60-e0f844604555/briggs_and_stratton_675_series_pressure_washer_oil.pdf
    • http://fokopaviwu.pbworks.com/w/file/fetch/144722142/what_is_the_difference_between_homology_and_convergent_evolution.pdf
    • https://uploads.strikinglycdn.com/files/581d4a2e-d22b-4112-acae-b56f2e04b5ee/libro_negro_de_autos.pdf
    • https://uploads.strikinglycdn.com/files/865d6187-8f27-46a4-bf9a-19f042c7a5bb/82847906153.pdf
    • http://xobapotowi.pbworks.com/w/file/fetch/144659997/pifafelitavasisafinise.pdf
    • https://uploads.strikinglycdn.com/files/0d39e083-e9cc-486a-9347-a0c3ab9bfd57/naxufofobebux.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9b6.bin
ba0e210f5ebd78bf8a209408c7134b469b056b21c9e5fd57a98c872469a200a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9B6 4976 bytes
font_01_sfnt_off00010a8a.bin
41688f040339ce136a7a22b30ee5e0a9ae4e55b0a8ff2714330e4ef17cd9c89e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A8A 11196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.