Malicious PDF — malware analysis report

Static analysis result for SHA-256 afc5ed7a4c080f8d…

MALICIOUS

PDF

87.3 KB Created: 2021-03-29 12:34:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97c7d2cfb303a54c462691a8d360d71a SHA-1: f38fbdea7c968511d2e74b129068d16c7883e8e4 SHA-256: afc5ed7a4c080f8d1259c7eec2a9a9f589702d7f78aeff30790ccc59f5ef98ec
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms and phishing lures, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URLs likely lead to further malicious content or phishing pages, and the document's structure suggests it's designed to trick users into clicking these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=bams+second+year+syllabus+pdf
    • https://xokefinodoju.weebly.com/uploads/1/3/5/3/135316617/dexuviraki_melamodowarisig_jirenibedateza.pdf
    • https://xobopigo.weebly.com/uploads/1/3/1/4/131437845/8f18c308bf98a4.pdf
    • https://matixibufi.weebly.com/uploads/1/3/0/8/130873880/laxakedopup.pdf
    • http://item-mask.top/what_type_of_oil_does_a_2014_nissan_pathfinder_take9nfdl.pdf
    • http://leree4.club/consumer_reports_best_refrigerator_side_by_sidek2lfx.pdf
    • https://logesili.weebly.com/uploads/1/3/5/3/135389335/1131873fbab69.pdf
    • http://legobibeli.22web.org/revedadowodeneweponur.pdf
    • http://defexol.22web.org/zirirowasovis.pdf
    • https://sajulivos.weebly.com/uploads/1/3/1/1/131164476/lawuwo.pdf
    • https://lafowujokunoro.weebly.com/uploads/1/3/0/7/130738997/dosuwosazajaxede.pdf
    • https://gevanodapo.weebly.com/uploads/1/3/4/8/134887816/gutefimanojuzeka.pdf
    • https://tetoxoji.weebly.com/uploads/1/3/0/9/130969306/puper.pdf
    • http://sogikujuwawim.22web.org/answer_traduo_em_portugues.pdf
    • https://wedutigumufezeb.weebly.com/uploads/1/3/4/6/134659425/93c9334fd8e3.pdf
    • http://pasozabijegigus.iblogger.org/lezarelojafawuxinarokav.pdf
    • https://rojanebe.weebly.com/uploads/1/3/1/6/131637229/7919697.pdf
    • http://nekretnine.site/network_security_engineer_average_salary_uken480.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_550d274f23114f6e8e993491524f542d.pdf?index=true
    • https://f72b89be-0fa6-41ee-8162-331329ef78ce.filesusr.com/ugd/95089d_f3f4dfd2add44706aa4c42a411a41f8c.pdf?index=true
    • https://99f4a897-b223-4833-863a-50ad465ba5d5.filesusr.com/ugd/8e2371_0d57d412881d4d0d86a03963a186d729.pdf?index=true
    • https://5a20c861-23fd-468b-888e-078c5342874f.filesusr.com/ugd/924841_280e0cf28562439880228d54ff8312d2.pdf?index=true
    • https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_ec52083cfbc943029d088ff2f995fff5.pdf?index=true
    • http://bibikefogive.epizy.com/corona_sdk_game_tutorial.pdf
    • https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_436ce206a4a94b039bc019393c5539f9.pdf?index=true
    • https://dd3a609d-fcd9-461e-ae06-f7e9ec6f332d.filesusr.com/ugd/811c3f_dde162894c46458eade9901c30f4b2b3.pdf?index=true
    • https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_4f48a45d3640463e905791c9326a1543.pdf?index=true
    • https://656adf98-7a81-40bd-8d0f-2b9c27d09201.filesusr.com/ugd/268ab1_b25edf1835c349559ba727fd6d87d8f0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa85.bin
248612767b4d93cba0d7b90e81273699af90ddd33433b6ad7aacef601a2324a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA85 5592 bytes
font_01_sfnt_off00010d75.bin
913b44d390024e4a2cd0f870b4ba43d9d177bc20336bb73f3b3087fca8895df6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D75 12956 bytes
font_02_sfnt_off0001394e.bin
3eed582e64fc6fd1c6a8429bf562c15bc8f9668ec242c71f427df96d98d6b7ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1394E 16396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.