Malicious PDF — malware analysis report

Static analysis result for SHA-256 b4c6d3979062b6b3…

MALICIOUS

PDF

95.5 KB Created: 2021-03-25 01:11:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 991b0a06bb64aff5e8d0b647b933211d SHA-1: d689ccf4e8456625f1695456f018a32de79bc19e SHA-256: b4c6d3979062b6b315eabe504895ff03b04836d088921c40db1d7448deee8d2b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are disguised as educational content or answer keys. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to distribute malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, with the primary goal appearing to be directing users to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=springboard+algebra+1+unit+5+answer+key
    • https://fezugewibopav.weebly.com/uploads/1/3/5/3/135346468/vuwel.pdf
    • http://safagiko.iblogger.org/64304955177.pdf
    • https://jitolubupiloz.weebly.com/uploads/1/3/4/6/134637312/4ea6b229b61ab46.pdf
    • https://nudiwosesi.weebly.com/uploads/1/3/4/3/134317077/8819388.pdf
    • https://ruxabetuju.weebly.com/uploads/1/3/2/7/132740595/tufamon-nezikefawux-runekinol-tuxub.pdf
    • http://muzotom.22web.org/kegoraboletogidanu.pdf
    • https://roxobirunuj.weebly.com/uploads/1/3/4/0/134096027/af383b2d90250.pdf
    • https://juxapokidopelif.weebly.com/uploads/1/3/1/6/131606881/gizapa-zevilagepomewal.pdf
    • https://gaduforijap.weebly.com/uploads/1/3/1/3/131381464/bivikixupovusom.pdf
    • https://xijafidul.weebly.com/uploads/1/3/2/3/132303061/garuve-wubalenesilosa.pdf
    • http://nagegomub.22web.org/bernoulli_differential_equations_examples.pdf
    • https://jitebogegamoma.weebly.com/uploads/1/3/4/7/134761197/f5b1f7d0304.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/dorobukasawituw/kafidunuguxune.pdf
    • http://lutubipejor.rf.gd/rakafodasavutisonimixab.pdf
    • https://s3.amazonaws.com/jupevuxirapi/havana_piano_sheet_music_easy_free.pdf
    • http://pulilidason.epizy.com/venous_lymphatic_malformation_mri.pdf
    • http://gavilisijev.rf.gd/lirokajid.pdf
    • http://tunivepusage.epizy.com/suluvuwonuluvuvogobejif.pdf
    • https://s3.amazonaws.com/viwoxuz/what_does_the_term_broad_statement_mean_num1_num2__get_num.pdf
    • https://711a90e7-97f2-4eab-8690-3003ec1e9b64.filesusr.com/ugd/a0905b_ee5a3901dbaf468cb5c1d99e7fc81d4d.pdf?index=true
    • https://5fdaa9e0-ad6d-443b-8779-beb8e45026dc.filesusr.com/ugd/05301a_2261165fe7be455386904d5c592eedc8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101e2.bin
a79afa9a69f41ddafc269e345965579b670b8b10eab71fd3524a17524cc18026		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101E2 4124 bytes
font_01_sfnt_off00011082.bin
424b9a659a27ecd053dab7a5330b6f1c46ed74e68f00a51ba978f2a9e4d676d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11082 5688 bytes
font_02_sfnt_off000123fe.bin
f7895d619e6f1d33e94d6c71c5a25926358de41f724af43abf41352fe6ba0c0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123FE 11452 bytes
font_03_sfnt_off00014b43.bin
08e6fd509ce0e8fd661e72d558977be7ea64c5038ee1d404f000794581f78e52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B43 16436 bytes
font_04_sfnt_off00016149.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16149 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.