Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1d76a17952cf505…

MALICIOUS

PDF

85.3 KB Created: 2021-03-24 18:46:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b3cf1f4071e4b313723e384dcb139517 SHA-1: 2c24cf6afae2a221c83cf57372e09f7a9c038620 SHA-256: b1d76a17952cf50522d2c518e4e67dbc834c6d6a0c51f92bb62c857df9dfee6b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to other PDF files, indicating a link farm or SEO spamming technique. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic confirm the attack pattern of luring users with seemingly legitimate content to download further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=atomic+mass+of+elements+list+pdf
    • http://mbfsopg.com/the_snack_shack_menu_belton_mo7cvqq.pdf
    • http://pemotutafid.mywebcommunity.org/fafomedamalej.pdf
    • https://kesakoti.weebly.com/uploads/1/3/1/0/131070149/fetejepuriza.pdf
    • https://jarivilil.weebly.com/uploads/1/3/4/0/134012847/zolalu.pdf
    • http://lunatan.medianewsonline.com/88816390799.pdf
    • http://fuxanujibiz.mygamesonline.org/king_of_thorn_movie_explanation.pdf
    • https://dixatuwep.weebly.com/uploads/1/3/5/3/135398053/nofolisagomaki-rafiduvuve.pdf
    • https://xapefawisago.weebly.com/uploads/1/3/4/7/134771693/sefozujisabovakam.pdf
    • http://hot-money.fun/list_of_air_borne_diseasesf6v37.pdf
    • https://rofaxebawo.weebly.com/uploads/1/3/4/7/134750080/6943630.pdf
    • http://akillidestekbasvuruformu.online/8094425919613h0t.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/boduxatavepe/angularjs_ui-_router_templateurl_function.pdf
    • https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_d42d584333274a45a84e8c9b2cbfd58b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c2e8a38d-c1f3-4b08-bee0-2722ea6e47bc/fight_club_full_movie_hindi_2006_hd_free_download_filmywap.pdf
    • https://uploads.strikinglycdn.com/files/120163b9-daef-44b8-9c87-be6ac36f0e2c/tijatisiputotimalo.pdf
    • https://e7306aa7-70d3-4aff-b6e2-c532630d1c1a.filesusr.com/ugd/cbe325_3f12e4e5497c4300898074799fae86ad.pdf?index=true
    • https://7605c768-a471-4169-85a9-0dab509fd250.filesusr.com/ugd/20ab23_6f1baf1db2a444eb9db9671c600fd06f.pdf?index=true
    • https://3cd6846c-369c-4875-9c63-132df726a2dd.filesusr.com/ugd/7ab50f_25b368da4c9b4ed39f3e3dde8f8d5687.pdf?index=true
    • https://68420551-d949-41c4-975b-2ae86aa6d062.filesusr.com/ugd/09c3c7_c4001e53980b44e08837282aa5639904.pdf?index=true
    • https://s3.amazonaws.com/sowewazulejewi/31711510668.pdf
    • https://s3.amazonaws.com/pidufozu/jovajodogafexepukawoj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010efe.bin
e54f1355cd2e3f42c490f22f6a845dcb72c46ef8b276f567239aff7e1d6ddc70		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EFE 5196 bytes
font_01_sfnt_off0001209e.bin
07d3419fe8e34747f69a8af80f3911df44920f763a96c3b8ddbcebf3b5fbb3e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1209E 11552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.