Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa8c61dac6a26a73…

MALICIOUS

PDF

73.5 KB Created: 2021-05-23 08:06:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: cd62f492d98543d512a0347a2244b578 SHA-1: d3ab8d106f920b20ffed16c647ce63687bf38726 SHA-256: aa8c61dac6a26a733497140892e7b232cf02ded63d8c30a9ac833b42f3edf13b
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for PDF_SEO_LINK_FARM, indicating it is part of a link farm. It also contains an external URI pointing to a suspicious domain, and ClamAV detected it as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, appears to contain text related to a syllabus, likely a lure. The presence of numerous external links, many pointing to benign S3 buckets but one to a suspicious domain, suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=class+11+science+syllabus+2020-21 PDF link annotation
    • https://losewilim.weebly.com/uploads/1/3/4/8/134854933/683e4fc0.pdfIn PDF document text
    • https://paxedobopesenun.weebly.com/uploads/1/3/1/3/131398064/tugupize_gudam.pdfIn PDF document text
    • https://febelozo.weebly.com/uploads/1/3/4/5/134599394/4625343.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nawosineromigi/dujavurogajeredopi.pdfIn PDF document text
    • https://s3.amazonaws.com/dowesitobuga/financial_flash_report_example.pdfIn PDF document text
    • https://s3.amazonaws.com/muwomapotumugi/presonus_studiolive_24.4_2_firmware_update.pdfIn PDF document text
    • https://s3.amazonaws.com/luramamelolem/44556912247.pdfIn PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/48601409211.pdfIn PDF document text
    • https://s3.amazonaws.com/jozetej/wow_authenticator_app_android.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/fejibogurajowaje.pdfIn PDF document text
    • https://s3.amazonaws.com/juzinaramip/paediatric_sepsis_guidelines_ireland.pdfIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/16838682797.pdfIn PDF document text
    • https://s3.amazonaws.com/taturi/unpacking_common_core_standards_6th_grade_ela.pdfIn PDF document text
    • https://s3.amazonaws.com/belapawerezuju/remstar_pro_m_series_water_chamber.pdfIn PDF document text
    • https://s3.amazonaws.com/bejokazemur/la_la_land_free_watch_full_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/jovekus/.pdfIn PDF document text
    • https://s3.amazonaws.com/dudigonifu/25625106226.pdfIn PDF document text
    • https://s3.amazonaws.com/meludav/is_percy_jackson_on_netflix_2020_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/nolarifaforuxop/kusurisosasibed.pdfIn PDF document text
    • https://s3.amazonaws.com/zusevamasor/77250207376.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/rusonirenafazojifiga.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2C1 5200 bytes
SHA-256: 205777bfc5a564cc2730cadef49ab5dab64aea385c1acf583a58e5ddf8761b4d
font_01_sfnt_off0000f494.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF494 10652 bytes
SHA-256: 4b31035b73151cc065ee57233a046a464d7f2adfcfcc1bb9e2a8e4e1926702fe

Open this report in the interactive analyzer, or submit your own file for analysis.