Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3ae2421711218aa…

MALICIOUS

PDF

111.3 KB Created: 2021-03-22 23:04:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 544ba9b5b57a0548671fa1f56218508a SHA-1: d1b2ea50cf8990a0462d1a96ef7fe6cc58f801cc SHA-256: a3ae2421711218aaa511f6cd5197c56cffec2700512cb2e086fa7029f8cb69be
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing document and hosts a large number of external links, some of which are SEO-themed. The document body, though heavily obfuscated, suggests a lure related to 'college physics student solutions manual'. The presence of an embedded URI and a link farm points towards a phishing attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=college+physics+student+solutions+manual
    • https://cdn.sqhk.co/lukavago/ihhhibV/fekasoxidadadufenep.pdf
    • https://cdn.sqhk.co/webunojixisa/jjXjjJS/10146151197.pdf
    • https://cdn.sqhk.co/rewazexi/mgdgvWN/zetaluzon.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fejenijovekozu/56549953035.pdf
    • https://uploads.strikinglycdn.com/files/011e7627-5fd0-4875-9570-a50deacbcfa0/what_does_unity_of_action_mean.pdf
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_dcd4dbd3d8194f51b18aa9ef8643df5c.pdf?index=true
    • https://s3.amazonaws.com/luborinizu/hiv_testing_guidelines_india.pdf
    • https://s3.amazonaws.com/tesapibebujep/news_report_on_typhoon_hagibis.pdf
    • https://1b6fbac1-9b66-4609-9151-81f5d4c316f7.filesusr.com/ugd/5e81b9_de0a4e1067e34169b6a731417bb4627e.pdf?index=true
    • https://s3.amazonaws.com/jepinebawo/17805588104.pdf
    • https://cdb53ace-3f3f-41e1-823e-0ecf3add8ba2.filesusr.com/ugd/47e9e0_ab7649d3d8c647439575ab1470b0f9b0.pdf?index=true
    • https://s3.amazonaws.com/kozibowisenatu/ib_business_ia_word_count.pdf
    • https://uploads.strikinglycdn.com/files/6c28605a-653d-41b9-a5ff-365feea3afe1/java_8_stream_convert_list_into_map.pdf
    • https://s3.amazonaws.com/tuxutedi/equations_and_inequalities_notes.pdf
    • https://09ec9d85-9312-4337-94d0-b84080e05f2e.filesusr.com/ugd/ac0094_bd88aaeaacb3404fac183b03c8ba5123.pdf?index=true
    • https://s3.amazonaws.com/retisovojor/76747472866.pdf
    • https://ce55c564-0e79-48ac-bd91-a034cff8554b.filesusr.com/ugd/bd1fc0_16f1d43f18094bdf93606373474692c5.pdf?index=true
    • https://s3.amazonaws.com/gupojakami/ganuruzobenobewe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017542.bin
8ec202259d5610d046c3bc203667fab92d47a5913034f306f2f255bd5b037864		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17542 5396 bytes
font_01_sfnt_off00018780.bin
03c8c4e359a5647a7869e27b58ee2f8cedfc5149f69170c20b8391f3f52b7fe4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18780 12060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.