Malicious PDF — malware analysis report

Static analysis result for SHA-256 a768706995f8e9d6…

MALICIOUS

PDF

77.9 KB Created: 2021-05-22 14:42:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: d287a94f1f9e7907d1160a544240ddbd SHA-1: da53a2b33a70ab3f4ea7973f7edd28bf804ac06c SHA-256: a768706995f8e9d690d4b0e8a46cecff26e34b6e32a99d22041edbf4621416f4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to baby sleep, but its primary function is to act as a link farm, directing users to numerous external PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a campaign to drive traffic or distribute further malicious content. The presence of external URIs and the ML classifier's high confidence score support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+to+get+baby+sleeping+12+hours PDF link annotation
    • https://begagezegitajaj.weebly.com/uploads/1/3/1/3/131398046/1655110.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488335/normal_604f6bdfe61f2.pdfIn PDF document text
    • https://bixaguvukimub.weebly.com/uploads/1/3/1/8/131872105/befetubegakobedasulo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365627/normal_6069b65e9cef2.pdfIn PDF document text
    • https://munopufunorari.weebly.com/uploads/1/3/4/8/134881547/lusojijogef-tawusupogidezab.pdfIn PDF document text
    • https://loxeramulerizal.weebly.com/uploads/1/3/4/4/134476298/4944608.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451229/normal_5ff31d6040b14.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451049/normal_6052fda376b7c.pdfIn PDF document text
    • https://budoxaku.weebly.com/uploads/1/3/0/8/130873914/zeretaxateguku.pdfIn PDF document text
    • https://relotevifinedu.weebly.com/uploads/1/3/2/6/132683264/xolajuvagemovu_denifomipamake_xujeseb.pdfIn PDF document text
    • https://mubafuzolifuben.weebly.com/uploads/1/3/4/6/134644730/828674.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382418/normal_606e65d28385a.pdfIn PDF document text
    • https://dekamukovesu.weebly.com/uploads/1/3/5/3/135324216/tepojuludi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411926/normal_605c958066e28.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391335/normal_6062e0d469879.pdfIn PDF document text
    • https://fadufavibog.weebly.com/uploads/1/3/4/8/134889314/zuxofezu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449987/normal_602576c8ba774.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/saziwijaxodav/assignment_abroad_times.pdfIn PDF document text
    • https://s3.amazonaws.com/vigevot/wpf_tutorial_youtube.pdfIn PDF document text
    • https://s3.amazonaws.com/tixeligufokup/interim_report_card.pdfIn PDF document text
    • https://s3.amazonaws.com/vexosafugunu/77490584096.pdfIn PDF document text
    • https://s3.amazonaws.com/lulelepese/google_sheets_api_range.pdfIn PDF document text
    • https://s3.amazonaws.com/wujodibu/telugu_old_love_feeling_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/gonima/bepinevugep.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F4 5560 bytes
SHA-256: 82d6723b3d72b5c5419ce5f013cc9432d0b761b05d6d8ffe93eb92ec2cc81536
font_01_sfnt_off000104fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104FA 10892 bytes
SHA-256: c44a14a433ac8b7110c993304c9b27f8071dd8896501598c1039b3e998421c1a

Open this report in the interactive analyzer, or submit your own file for analysis.