Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa3143b4a2bd7979…

MALICIOUS

PDF

74.9 KB Created: 2021-06-03 20:01:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 252c6b83647a413d29e7916fc158045c SHA-1: 99bf9d96e3ca8e1e33a5b571b483c938bd32cfa3 SHA-256: aa3143b4a2bd7979291e5aa6f9c7229a00f9a7dd57d7858621b26f3aa88e1223
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a disguised link that appears to be a search result for popular media, likely intended to trick users into clicking it. The PDF also contains a large number of external links, suggesting a link farm or phishing attempt. ClamAV and ML classifiers have identified this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=pokemon+season+18+all+episodes+in+hindi+download+hd
    • https://malugeko.weebly.com/uploads/1/3/1/6/131636988/4774b592d42.pdf
    • https://dusomekekonipa.weebly.com/uploads/1/3/4/5/134580960/tikositutator_xinorazipuk_xekika.pdf
    • https://bemafaparad.weebly.com/uploads/1/3/2/6/132681832/visus-wixekuxixaji-javunut.pdf
    • https://pegutezupo.weebly.com/uploads/1/3/2/7/132740329/9024254.pdf
    • https://savozajit.weebly.com/uploads/1/3/5/3/135320594/edd3a05.pdf
    • https://fejenugid.weebly.com/uploads/1/3/4/0/134016750/vavejujavidas.pdf
    • https://bidubemawekewar.weebly.com/uploads/1/3/0/8/130815124/586120.pdf
    • https://rosafuzumago.weebly.com/uploads/1/3/1/8/131857847/cd9f964.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1af467f4-d2ee-47cd-80fc-ee34e6ea8e14/jvc_kds79bt_manual.pdf
    • http://fijinatuzut.pbworks.com/f/72734860935.pdf
    • http://molosafokaji.pbworks.com/w/file/fetch/144544662/reciprocating_refrigeration_compressor_animation.pdf
    • http://luwivaj.pbworks.com/w/file/fetch/144517446/29599476463.pdf
    • http://fodorafirig.pbworks.com/f/why_is_my_cats_poop_soft.pdf
    • https://uploads.strikinglycdn.com/files/aaffb786-2f5f-4e44-8ce6-5ba0332bda12/how_to_get_alpha_symbol_in_powerpoint.pdf
    • https://uploads.strikinglycdn.com/files/b540c9ba-b5ab-4734-b418-23b7409c8bd4/41406375216.pdf
    • https://uploads.strikinglycdn.com/files/5f6d30c3-4ad7-4b2e-9795-d49012a92c61/25199640632.pdf
    • https://uploads.strikinglycdn.com/files/4cd08492-c4d6-4255-88f9-3b71d7a2abd4/neviritafawokubejuze.pdf
    • http://lekuzax.pbworks.com/w/file/fetch/144419187/do_blue_dye_tests_always_have_a_faint_line.pdf
    • https://uploads.strikinglycdn.com/files/154b72b6-c8dc-46de-917c-5f6eb726126b/how_to_extract_gmail_password_from_android_phone.pdf
    • http://xifilipisi.pbworks.com/w/file/fetch/144413715/66302139558.pdf
    • https://uploads.strikinglycdn.com/files/6cf2ce38-cff8-46a1-ac8b-75b01e84e07e/why_is_my_comcast_router_blinking_orange.pdf
    • https://uploads.strikinglycdn.com/files/f7f006a1-19fe-47a3-8b95-63b4c1de2942/pafepesimisogofesobipipen.pdf
    • https://uploads.strikinglycdn.com/files/e2657e2b-fc14-4765-9bb5-596bbceb91d1/irobot_braava_380t_robot_mop_vs_240.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e636.bin
7cc47e38f60ed3a5a49efc53203cca21defcdba3e4ee1330f20b5b2432b7564e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE636 5504 bytes
font_01_sfnt_off0000f8e2.bin
21242c526b4fc9824de45968af5a624a476b20b3face4ac8757fd8f246232161		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8E2 10656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.