Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2e55c3cfa117c4e…

MALICIOUS

PDF

78.4 KB Created: 2021-03-24 13:58:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f682b9b1e5c302df80fa0908011f6bdc SHA-1: 88d2b255425093c6d7cf3a761b6d9672a71269a3 SHA-256: b2e55c3cfa117c4e254efbe493db2f7dd64b0735d3f61b848892b37d0c5b9455
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO link farms or to redirect users to malicious sites. ClamAV and ML classifiers identified this PDF as malicious, specifically as a phishing trojan. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' indicate a strong likelihood of the document being used to drive traffic to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=sample+application+letter+for+teacher+pdf
    • http://mebelrostov.ru/el_caballero_dela_armadura_oxidada_capitulo_1_resumen_cortorbxd8.pdf
    • http://prizinsta24.space/88278167585ir23o.pdf
    • https://dapapakutuluj.weebly.com/uploads/1/3/1/3/131384169/ad0d3e12229861.pdf
    • http://arenda-comp.space/hognose_snake_morph_guidet8b3h.pdf
    • https://dovezoluwebib.weebly.com/uploads/1/3/4/0/134017866/gaxuzipum.pdf
    • http://tikovg.xyz/lycoming_0-320_overhaul_cost_australiap9khe.pdf
    • http://tradestaroffice.com/zeroleta6eqrd.pdf
    • http://kreativoblako.com/ramejiwolisimurejejejagg4vz.pdf
    • https://tuxutumixebapi.weebly.com/uploads/1/3/1/4/131438514/bofaxaxut.pdf
    • https://sarejazaxixosib.weebly.com/uploads/1/3/4/6/134633098/funuwibujilawiz.pdf
    • http://sait-ok.ru/stand_alone_shop_meaning_in_tamilouah9.pdf
    • http://1xbet-football.fun/philips_dreamstation_bipap_autosv_advanced_with_humidifierr9cg1.pdf
    • https://buvitefano.weebly.com/uploads/1/3/4/1/134131500/xivixuwitazude_bugagi_xaruveferap.pdf
    • http://ighelpcenter.xyz/fotevepanujikudidogodari8m4yf.pdf
    • http://probmake12.xyz/xmeye_not_working_on_phoneh3ov3.pdf
    • https://xurobogi.weebly.com/uploads/1/3/1/1/131163732/kawuseg.pdf
    • https://jegivobepumo.weebly.com/uploads/1/3/4/4/134444156/zumilogedi.pdf
    • http://crysety.xyz/33110529904vdabl.pdf
    • http://criticcxck.space/9949765306tkwzf.pdf
    • https://bodosimif.weebly.com/uploads/1/3/3/9/133999894/zexutu_ditixaxa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7bd9f2a8-fe3c-450e-87de-3eb1c4a0133b/kukaxapubenovebokijafofa.pdf
    • https://uploads.strikinglycdn.com/files/124122c7-601b-4aeb-8be3-9fcc4e80ca26/fegonoxubegefom.pdf
    • https://uploads.strikinglycdn.com/files/5c2a95d2-c304-4543-b298-26cd048750d0/buvigusaderixap.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b1.bin
cd50ec498c6bb6adfaef9c1b4bdd54aea4688a8718d708e072507e06fb61fb77		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B1 5320 bytes
font_01_sfnt_off0001059c.bin
30d03d69354c651c5fd7139c4daeca4daba1b1cbf7d2245bdea1a1a17f1ab099		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1059C 10856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.