Malicious PDF — malware analysis report

Static analysis result for SHA-256 a472688d5d566df4…

MALICIOUS

PDF

75.9 KB Created: 2021-04-09 14:24:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fb595fd159fde8e4fadc81f76900cc3c SHA-1: d7722c5f3c869996a287003678b4035e21fb9be1 SHA-256: a472688d5d566df4a9fba2c3c239394c928f0b130c464fe527b75acde5200e34
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, detected as a link farm, suggesting a malicious intent to manipulate search engine results or redirect users to potentially harmful sites. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. The document body is heavily obfuscated and contains no clear textual lure, but the sheer volume of outbound links is highly suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=effective+communication+means+business+success
    • http://dexaputanit.mygamesonline.org/how_big_is_1_10_scale_rc_car_in_cm.pdf
    • https://static.s123-cdn-static.com/uploads/4412183/normal_60021fc5629c8.pdf
    • https://cdn.sqhk.co/ramekodetuwe/ajdjjfP/water_slide_bounce_house_combo.pdf
    • https://cdn.sqhk.co/woberimi/evt3ijI/xodipodewevakiliv.pdf
    • https://cdn.sqhk.co/pusuvizodez/idSrhar/mizopenokosopagabalug.pdf
    • https://static.s123-cdn-static.com/uploads/4499309/normal_5fcaae7acae33.pdf
    • https://cdn.sqhk.co/dudugetogi/ghmjdKq/best_minecraft_exploration_maps.pdf
    • https://cdn.sqhk.co/zinumazak/iOXifjN/basketball_courts_near_me_public.pdf
    • https://cdn.sqhk.co/mogudekusab/S5icVWc/wowirizomo.pdf
    • https://cdn-cms.f-static.net/uploads/4372707/normal_6013748d672fb.pdf
    • http://fekosuse.getenjoyment.net/mizapunomonobuli.pdf
    • https://cdn.sqhk.co/bizujutenifo/iZiisgh/wagakejelim.pdf
    • https://cdn.sqhk.co/mexovaru/IjvSggp/zizopepojeli.pdf
    • https://cdn.sqhk.co/xosujopi/cHhgfVe/winofubowonubu.pdf
    • https://static.s123-cdn-static.com/uploads/4476135/normal_5fdf9d6d95e4b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4868a29a-6d77-448d-a9c5-bc5c6a1713c3.filesusr.com/ugd/060e50_f19a2e74b0b94b628d3e2130388441d7.pdf?index=true
    • https://5c3e38fa-bf2d-4cda-bfdc-19e9a39f2227.filesusr.com/ugd/b3ada4_92103038fe64418d8c9730ef24b29e62.pdf?index=true
    • https://4f65703b-d4c0-4c9c-9e30-73c8cc83ec5d.filesusr.com/ugd/54fa57_4e0575abf91c4a1195fb91da02537e83.pdf?index=true
    • https://9eff4bf0-55a5-42b9-a65a-250f23c32afd.filesusr.com/ugd/80978b_05857c026f134218835bd33bfe584e73.pdf?index=true
    • https://a6f18165-9bfd-46c9-8f51-0ab50cd0b687.filesusr.com/ugd/265c7a_7d3780958957431ba7c9a2b7b160a683.pdf?index=true
    • https://ec2d952e-5494-46d8-b841-fee222248b17.filesusr.com/ugd/9713d5_3ba2cf30aa3949cf96686f0437d8d574.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edb4.bin
0523c00274da1da4f6594802d5554895867de8cb5e3c0d17c1dc9588ab87ff6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDB4 5056 bytes
font_01_sfnt_off0000fee6.bin
82c7f083a72dbdf03298617610fac98d8079d87425dede0822b8f8a8f97128d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE6 10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.