Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3fc210b5b50beb9…

MALICIOUS

PDF

104.4 KB Created: 2021-03-16 07:41:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9507e16a2d2a6e6c1b2eb7af66c3ec07 SHA-1: 22fd2b1a1553616d64d91461bfe538cfc2080096 SHA-256: b3fc210b5b50beb94a44ac3a9e181833199fa81f6986ac8c2506ccdec7b74331
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which point to PDF files, suggesting a link farm or SEO poisoning tactic. The embedded URLs, such as 'https://kuzutuzo.ru/award?keyword=gnostic+book+of+changes+pdf', are likely used to redirect users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=gnostic+book+of+changes+pdf
    • http://samubed.iblogger.org/inbody_results_sheet_interpretation.pdf
    • http://laitlabs.pro/84372934145yz2i6.pdf
    • https://bodokevusigow.weebly.com/uploads/1/3/2/7/132740435/tunow.pdf
    • http://distornyup.site/bujibirugeal4i3.pdf
    • https://tonavamajarow.weebly.com/uploads/1/3/4/6/134694337/wevenunevusodo-kifunekolisobu.pdf
    • https://pesirirovozag.weebly.com/uploads/1/3/4/3/134316115/eb8dcf9c40a.pdf
    • https://kixefumikek.weebly.com/uploads/1/3/1/4/131437490/810718.pdf
    • http://lovewaits.ru/paint_sprayer_rental_medford_oregondojgp.pdf
    • http://zofapojofiwifi.iblogger.org/wapking_full_hd_1080p_video_songs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://99442e0c-e188-470f-b1e9-a2082f9e7f28.filesusr.com/ugd/2274a7_b288dff318e4487abb33a39d6fa36fce.pdf?index=true
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_e7e8dbe307264313a968af969d8d3923.pdf?index=true
    • https://55d63786-14d6-44de-84d0-33f1fb383c44.filesusr.com/ugd/45fd81_38c6c61992c84b2f9491bcf95173dd5f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/567613f9-8484-44fa-90a7-de6a1aa82b7c/resumen_del_libro_el_arte_de_amar_de_erich_fromm.pdf
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_41fdbeea754c43d88fb6a706d3323a17.pdf?index=true
    • https://s3.amazonaws.com/lurutopobi/que_es_propuesta_de_valor_brainly.pdf
    • http://tuzibepunu.rf.gd/free_christmas_flyer_templates_word.pdf
    • http://rirusivinudi.rf.gd/buffettology_workbook.pdf
    • http://xumasadepa.epizy.com/sewing_machine_parts_crossword_answers.pdf
    • https://uploads.strikinglycdn.com/files/c9fd4018-ca24-4329-a31e-1fdbf2b52700/ryobi_cordless_chainsaw_not_working.pdf
    • https://s3.amazonaws.com/xonobijikivo/37823728807.pdf
    • https://s3.amazonaws.com/tumasun/watonilimazafozafak.pdf
    • https://s3.amazonaws.com/nuxomigo/how_to_clean_needle_of_keurig_2.0.pdf
    • https://03386fec-e341-46be-bf9f-2f2bd19f9bfe.filesusr.com/ugd/bf57b5_beb03e2b55ec4177895fa6ff24616bff.pdf?index=true
    • https://s3.amazonaws.com/nedijowewoded/application_form_for_citizenship_card.pdf
    • https://uploads.strikinglycdn.com/files/9544c03f-f392-4b5a-b817-5d817965e775/how_many_types_of_mental_diseases_are_there.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000159ee.bin
2f4f4c75b5c26269fa4c7a98ce6bebf79a31c3223c9b7f66b8f6a36f0580ef08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x159EE 5524 bytes
font_01_sfnt_off00016cc0.bin
af0c4880962d02bc00e736b18ee6ec788d57dd309ab3f724c565f7d3c451de14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CC0 11324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.