Malicious PDF — malware analysis report

Static analysis result for SHA-256 b147c9665645d0e1…

MALICIOUS

PDF

69.6 KB Created: 2021-03-15 16:43:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e40e34a3e336a2506720e3b24228e4bc SHA-1: aefb3fc9d041f4397e84f5706beb51cc5a610d47 SHA-256: b147c9665645d0e153b6221b3d6b5ded49967a9986d6ced27187bfc0d82dfe98
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a mass external link farm, with one prominent URL leading to a phishing-related domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for a phishing campaign. No scripts were extracted, but the PDF structure itself is used to host and distribute links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=blackberry+key2+black+unlocked+android+smartphone
    • http://wobafobigo.mywebcommunity.org/how_much_does_it_cost_per_day_to_run_a_dehumidifier.pdf
    • http://saramofupoke.iblogger.org/41771873733.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_dba398d6f9da41cabaf2c0058368200e.pdf?index=true
    • https://s3.amazonaws.com/tedowafomaru/2002_ford_explorer_sport_trac_towing_capacity.pdf
    • https://s3.amazonaws.com/jufowokedunod/27129333850.pdf
    • https://s3.amazonaws.com/midaguvimabof/wokopesefuponije.pdf
    • https://uploads.strikinglycdn.com/files/174e3553-2ddf-4270-96fb-a28aad63b249/the_island_of_doctor_moreau_movie.pdf
    • http://merigodivibamot.rf.gd/88864610249.pdf
    • https://d4f4546a-a836-4b3d-8651-c56b89608eca.filesusr.com/ugd/3e9e83_dd57161af57f48dfb67d60859da3466a.pdf?index=true
    • https://adc67df4-9ac4-4169-8225-f8d60376216a.filesusr.com/ugd/a1c2c7_bad003971bec4e50a938a0f3d3ba0e9f.pdf?index=true
    • http://tipokeviti.atwebpages.com/crazy_color_creatures.pdf
    • https://6cdf8c5e-36a0-4b6d-987f-32d3d50030cd.filesusr.com/ugd/3c2e2e_fb3b16923d1d4abe83f8e96def2ce392.pdf?index=true
    • https://s3.amazonaws.com/zunaporam/migratory_beekeeping_reading_answer.pdf
    • http://lejorusajevi.rf.gd/the_shack_movie_book.pdf
    • https://s3.amazonaws.com/fadupazageraf/75600081541.pdf
    • https://s3.amazonaws.com/rufonali/85866743017.pdf
    • http://tifavamifikas.myartsonline.com/how_to_restart_my_fitbit_charge_hr_2.pdf
    • http://pezamax.myartsonline.com/convertidor_musica_gratis_mp3xd.pdf
    • https://s3.amazonaws.com/zumomasugipeno/ib_business_management_guide.pdf
    • https://uploads.strikinglycdn.com/files/842f983d-5654-4ebf-a947-688923d58fcd/does_logitech_k360_work_with_mac.pdf
    • https://s3.amazonaws.com/litunux/tufawegogi.pdf
    • https://s3.amazonaws.com/tevomenil/business_plan_template_word_mac.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd8c.bin
49d75801e42a80f2588fb4f67e452bd881f3d4870fb60ba6229cddd46bcf2281		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD8C 5800 bytes
font_01_sfnt_off0000e12a.bin
e01c2106dc92754d5186350be7e2e610b8d7291d3845254a3e54eec50d2ee7f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE12A 11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.