Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4ae28d0632cf205…

MALICIOUS

PDF

86.8 KB Created: 2021-03-11 05:00:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0876b81873b72a7d28a0dcd8cfc98b80 SHA-1: 2bc678f74f282c2acb132d0028a2d3ab7edfa62f SHA-256: a4ae28d0632cf205896167b4eab2aeea6a506454d98e33a31688a7a7d7bb2f31
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a technique often used to redirect users to malicious websites for phishing or to download further malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, suggesting an attempt to game search engines or distribute content widely. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=accounting+for+merchandising+operations+practice+problems+pdf
    • https://tabogivazosepa.weebly.com/uploads/1/3/1/8/131871767/26c742.pdf
    • https://guzepebizosi.weebly.com/uploads/1/3/4/8/134880367/pijofakubexuwawetif.pdf
    • http://gakagebir.mypressonline.com/13372004386.pdf
    • http://mitutepoka.medianewsonline.com/definicin_de_marxista_de_modo_de_produccin_capitalista.pdf
    • http://xifadezuzurap.medianewsonline.com/sign_of_the_beaver_chapter_11_and_12.pdf
    • http://yewes.fun/421393221735k2md.pdf
    • http://detonicufficiale.website/venuvajevur3tnb.pdf
    • http://myluckybet.xyz/lapapomelajosobezoi7d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_8c21dbc8e51447edac468b853af4909a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4bc923fc-ead2-48fd-a8c8-f88af0552388/lg_hbs_910_price_in_india.pdf
    • https://uploads.strikinglycdn.com/files/86fa4d10-9f91-481f-aa66-6ae75cc93976/64240990959.pdf
    • https://uploads.strikinglycdn.com/files/25435914-8268-45e3-be32-08dc6047527c/14716196388.pdf
    • http://bupalim.atwebpages.com/muerte_por_asfixia_mecanica.pdf
    • https://9526c93a-d340-4dca-b5fd-2864ff0888c4.filesusr.com/ugd/4c3d6a_988c4c95b69a4e69a7fbf6cfea82c11b.pdf?index=true
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_4ca60d2ae1374c5bb9003a81b395451b.pdf?index=true
    • http://xizoxenefodage.epizy.com/bhula_dena_song_free.pdf
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_f199c974a0394ecea4e7030239808b0f.pdf?index=true
    • http://newewixojarulup.epizy.com/28139953769.pdf
    • https://uploads.strikinglycdn.com/files/e94ea8b8-c0ef-4921-8982-296ef525ac7f/xujupukodikemakawowigimax.pdf
    • http://rigawuseterozow.epizy.com/android_secret_codes.pdf
    • http://fozikabev.epizy.com/3867526581.pdf
    • http://zadesejofugo.epizy.com/36463354363.pdf
    • https://3a0d5408-2ea1-4258-8d29-5d96341cad2c.filesusr.com/ugd/79cb75_7118fd1dfa2a46558048adddb6cc2053.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011466.bin
16bd20ab0a9b76f53136d61d75149423366f2bb41df6b36bb61838cd1a03a93f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11466 5700 bytes
font_01_sfnt_off0001279f.bin
a61a328531719c9e914496956439772de05da900b06c451c4e81ba346d63a1f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1279F 11040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.