Malicious PDF — malware analysis report

Static analysis result for SHA-256 b431925fb7dc955f…

MALICIOUS

PDF

69.3 KB Created: 2021-04-05 09:47:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 084a422afc9e07c5b1baaa48b2ed5d00 SHA-1: b0ab772bc3fd03e5da416b2643d68c34534facd2 SHA-256: b431925fb7dc955facba6daf5b2128ea9146ac449bc5c8e692854e8d872016ae
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to potentially malicious domains. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. The embedded URLs are likely used to redirect users to sites hosting malicious content or phishing forms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=365+fairy+tales+pdf
    • http://sexedate69.site/define_contract_law_in_marketingllq8u.pdf
    • http://hotita.space/insinkerator_444_3_4_hp_garbage_disposall9mgu.pdf
    • https://zewalomoweso.weebly.com/uploads/1/3/4/5/134588134/ae3bc8.pdf
    • https://lajojadarexod.weebly.com/uploads/1/3/4/5/134506383/fikuxekod.pdf
    • http://mitipuwade.22web.org/votesibus.pdf
    • https://vebupefipi.weebly.com/uploads/1/3/4/4/134497137/xolorumajewik.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5457524e-bace-410a-9ce7-c8d8bc0eedea.filesusr.com/ugd/f0ffd0_6704761f8c7a4a5dada393dcaefd9dc0.pdf?index=true
    • https://1416a32c-f91c-4ec3-9c10-bfdf610c7df7.filesusr.com/ugd/76de1a_f7c0c587c9dc45c896ff62720a2dea02.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c31539b1-12d1-432a-9121-4c1326ebba4d/lg_air_conditioners_fault_codes.pdf
    • https://uploads.strikinglycdn.com/files/32b10315-c57f-4665-9e39-a63e90ada562/35699855616.pdf
    • https://uploads.strikinglycdn.com/files/ac1a25a5-c2cf-43e1-b31d-96732deb6abc/19416304905.pdf
    • https://uploads.strikinglycdn.com/files/8865a51a-f304-48ec-aea4-f79398f627df/death_note_characters_lights_sister.pdf
    • https://uploads.strikinglycdn.com/files/d450aebb-e11f-4312-a6ee-c84f8d3a8c30/feliros.pdf
    • http://jawamamabob.rf.gd/science_form_2_kssm_chapter_3.pdf
    • https://uploads.strikinglycdn.com/files/5980efc3-0318-4c25-ab33-0fe5799083a6/tameverudufokerop.pdf
    • http://julonagakumer.rf.gd/39491532777.pdf
    • https://uploads.strikinglycdn.com/files/ba1a541b-01de-48e5-b2ff-9952498664f4/leguwijurex.pdf
    • https://uploads.strikinglycdn.com/files/f516e8d9-cd08-4526-80c3-4d466d763404/playtex_diaper_genie_how_to_put_together.pdf
    • https://9a86171b-24d8-4f43-8717-687e75280c8f.filesusr.com/ugd/6234e8_490399cfb1414595ba7b286227ffe2d5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb76.bin
5803bb78b62ad853c6a547b0027024124432cee549467c5b97d5e6c59b2ceea2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB76 5484 bytes
font_01_sfnt_off0000de3b.bin
7ba6538cda1427a10ad4d455296522fd51cd725888bf357754f067fcaf9f49f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE3B 15056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.