Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6368e7d0e30e5ac…

MALICIOUS

PDF

90.5 KB Created: 2021-03-28 02:52:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a40a7f8a44361f15715c7a4c44d8c8e6 SHA-1: 49cc795018482a8e3a8b265f7d5cdb6c2f7fc8fc SHA-256: a6368e7d0e30e5acba96ccc724efa313beef2823c049ec9efc59113aa5a7fde7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many of which point to benign-looking PDFs, suggesting a link farm or SEO poisoning tactic. One of the primary external links, 'https://ponafet.ru/award?keyword=formulaire+3916+pdf', is likely the intended destination for users, potentially leading to a phishing site or further malware download. No scripts were extracted, but the PDF structure and link farm indicate a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=formulaire+3916+pdf
    • http://xejeboge.22web.org/82095872309.pdf
    • http://rotixumuzu.22web.org/brushes_for_procreate_pocket.pdf
    • https://cdn-cms.f-static.net/uploads/4427097/normal_5fd60cdda998d.pdf
    • https://cdn-cms.f-static.net/uploads/4377924/normal_6041324848b11.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/waxegatulo/92789159057.pdf
    • https://s3.amazonaws.com/punurum/cd4093be_ic_datasheet.pdf
    • https://e0271a52-a7af-48e9-8a99-924ce320ec62.filesusr.com/ugd/be5703_04ebbc5813604cc488edd768f550605d.pdf?index=true
    • https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_1946929b7a824ca08e3006c7c87eaec3.pdf?index=true
    • http://forafunivotefu.rf.gd/are_dc_museums_open_on_easter_sunday.pdf
    • https://s3.amazonaws.com/jaxesabi/vabodesororababefox.pdf
    • http://fidotetunuxezi.epizy.com/facebook_apk_mod_revdl.pdf
    • https://s3.amazonaws.com/regovadeje/65026970830.pdf
    • http://figopovu.epizy.com/riello_gas_burner_manual.pdf
    • https://19a39513-20cc-49d1-a75c-e30ce0314142.filesusr.com/ugd/f99735_b51c6240aace43a088d8b706cc1cfc6f.pdf?index=true
    • https://s3.amazonaws.com/lofese/gojopalovodevazojikigiga.pdf
    • https://11484d69-1612-41b9-9199-165df1f08223.filesusr.com/ugd/e2f197_d0a47e4678b84a0eb4979edb84fb3283.pdf?index=true
    • http://zosejanukapub.rf.gd/patent_search_and_analysis_report.pdf
    • https://627ea4a7-3f28-4bf3-8c99-6a9da7dacf48.filesusr.com/ugd/1970e2_f70c73d2584e420db886a0a154ccfc17.pdf?index=true
    • https://s3.amazonaws.com/tifuwuw/begopekisapigovexogub.pdf
    • https://s3.amazonaws.com/marimejerebo/24414610116.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9ab.bin
e8eae1d334a12df3d6adf1e73899f94edecf968eade9ca375737d5d9ed6c99ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9AB 5488 bytes
font_01_sfnt_off00010c34.bin
c2417db54e10d26ef1190903a8d58c6304bc4479e451db6247f08d7b3c074ac8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C34 3632 bytes
font_02_sfnt_off00011a69.bin
7c19ebb0f51f159cf11d76e9cd7283adeb1010810b90ce6df3e195f13b6ba977		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A69 13532 bytes
font_03_sfnt_off0001451e.bin
3b60b84f554398af14c4ebb484939287515345ca9e6929e6e2fbb436f7be1588		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1451E 16208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.