Malicious PDF — malware analysis report

Static analysis result for SHA-256 b4cb837036bff4b9…

MALICIOUS

PDF

96.7 KB Created: 2021-03-23 22:10:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93b3fc9d4721fb62cb5e16397f850e02 SHA-1: 72ed69f7c1631413f838400566020edf542809ca SHA-256: b4cb837036bff4b92f6ea189ab19241a10567ea5667eac4487c9c547b6a5c2fc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, with the primary suspicious URLs being https://crophysi.ru/award?keyword=sama+veda+mantras+in+telugu+pdf and http://jibifiva.22web.org/jomiwizodupug.pdf. The presence of a link farm suggests an attempt to direct users to potentially harmful content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=sama+veda+mantras+in+telugu+pdf
    • http://jibifiva.22web.org/jomiwizodupug.pdf
    • https://ritipovilij.weebly.com/uploads/1/3/4/6/134650849/mimajovajuritogez.pdf
    • https://cdn-cms.f-static.net/uploads/4478655/normal_5fdbe9db44efd.pdf
    • https://cdn-cms.f-static.net/uploads/4475987/normal_5fd102d7bfe3b.pdf
    • https://cdn-cms.f-static.net/uploads/4404741/normal_6022d0a2d0ead.pdf
    • http://ragesedanem.iblogger.org/road_traffic_accident_reports_uk.pdf
    • https://sawuvuvexefiz.weebly.com/uploads/1/3/5/9/135964560/fed44.pdf
    • https://cdn-cms.f-static.net/uploads/4369322/normal_60392dd8605d7.pdf
    • https://sumikoxivabozo.weebly.com/uploads/1/3/3/9/133997645/bunegumizewavi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://488a161d-122f-4e25-b35e-34d1d0e27b34.filesusr.com/ugd/bbc910_f83c6ba1b8c74376b558810bf5712fe2.pdf?index=true
    • https://s3.amazonaws.com/xufujofaleki/42603896449.pdf
    • https://s3.amazonaws.com/vaxebisapesi/technical_instructor_guidelines.pdf
    • https://18d8f76e-0bdd-4b96-b744-fee987eed1b0.filesusr.com/ugd/1486c8_11bdf28681d240fda774c424fd6a65b8.pdf?index=true
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_2fe8a55e214f4746a24c954ddfb88c19.pdf?index=true
    • https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_ab5c7aa26927414a880e645d73f30ae0.pdf?index=true
    • https://s3.amazonaws.com/vonutavekip/wajukenovinamezogove.pdf
    • https://538d8494-0c7d-401a-b890-0485f6bc7bca.filesusr.com/ugd/29c71c_bf1424414cab46a8b22d40d45a4379d3.pdf?index=true
    • http://jilagikudi.rf.gd/batho_pele_white_paper.pdf
    • https://98771922-91e4-4673-aa0d-7794f4435593.filesusr.com/ugd/b6aaa0_de707d54d776471683f200794276063d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001190a.bin
d5393e1282c935bedc9032bd6d7e19bea84a8e278ac56f9ca4fa2b9d02c51509		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1190A 5524 bytes
font_01_sfnt_off00012bbe.bin
13f1c1acb04f6a2c0c7809b473bb32c2578594c6ef10021f571feb2e59bba7cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BBE 3772 bytes
font_02_sfnt_off00013764.bin
abc65c6031a96d4e6a2a0242c47e905469cd527b78017484c106ff53ff1f6136		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13764 12152 bytes
font_03_sfnt_off00015e39.bin
78f29757d86695551fb3aea4013bced1102418f616ff843188bf3579ad26db50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E39 6684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.