Malicious PDF — malware analysis report

Static analysis result for SHA-256 b4de00ccac3e12d2…

MALICIOUS

PDF

80.6 KB Created: 2021-04-30 07:50:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 92b0c8d91b44df9f126b493b8fbd420f SHA-1: 5ac0b76a74c3d6dad41fa57c7ac32ad9d2c13f30 SHA-256: b4de00ccac3e12d2f0f512287529f4e04ad7bf747d505abdc1b1cbe3767d47bd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+do+you+reset+a+honeywell+gas+valve PDF link annotation
    • https://pevusipifo.weebly.com/uploads/1/3/4/8/134863194/gisigusadan.pdfIn PDF document text
    • https://mefupawex.weebly.com/uploads/1/3/4/3/134317460/ruwekidezoz.pdfIn PDF document text
    • https://betagoguf.weebly.com/uploads/1/3/4/6/134668965/nokatenemenuvat-wimadewaso-mifowu.pdfIn PDF document text
    • https://zafasasuk.weebly.com/uploads/1/3/4/7/134713251/351643293e3.pdfIn PDF document text
    • https://xitupiwe.weebly.com/uploads/1/3/4/4/134489196/2634878.pdfIn PDF document text
    • https://jowozulabu.weebly.com/uploads/1/3/4/0/134013075/mesurinuru-zowoliter-bimaguputetupef-botogogoge.pdfIn PDF document text
    • https://gobebirerelimi.weebly.com/uploads/1/3/4/6/134651667/8803621.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pipaneku/79220108024.pdfIn PDF document text
    • https://8ee4d174-735f-4cd7-9396-c3a65dbcc337.filesusr.com/ugd/5ac313_6e2ed50c38d3439a8630d9ed26ed070f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tometubufimopim/killing_floor_incursion_biotics_lab_walkthrough.pdfIn PDF document text
    • https://ff06b2c9-6223-4357-b4d5-1bf3807c749f.filesusr.com/ugd/717131_58505d60ebb74c22890d3d50a07af541.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lomogas/bootstrap_4_modal_form_submit_ajax.pdfIn PDF document text
    • https://849cba27-c1c2-4801-a47f-514a08c45c3c.filesusr.com/ugd/7f7a2c_eac3bfc6f3134a4fb8c32d1983700694.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gumagabu/pabopemonorupiwaxi.pdfIn PDF document text
    • https://9fbeb193-358d-48fe-b9d9-45f8b63f6b3c.filesusr.com/ugd/ab67b9_353f8f55d8af4bca9201230efa757188.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lopadivupudexa/what_was_canada_before_1867.pdfIn PDF document text
    • https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_ea6d9b6de6644e5fa0e9a6580c75f9d5.pdf?index=trueIn PDF document text
    • https://4eb3a9b5-ca6a-4b2a-896e-878abc754f3b.filesusr.com/ugd/f1ab86_1c2360a1cf294a7fa809ea0961bd516e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kufazete/bseb_12th_practical_admit_card_2019.pdfIn PDF document text
    • https://6323cc82-cf72-43ae-bc7a-f8d691a1d37e.filesusr.com/ugd/4f3578_701cbc050deb4f4398869d7c5370bf73.pdf?index=trueIn PDF document text
    • https://99ca13e2-8bf0-45b2-93fa-bbfb519f101f.filesusr.com/ugd/5392be_1e6965395920411c998f83881980095c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mefovu/dumavojuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE42 5304 bytes
SHA-256: 573b6d32cb9e0c653f0dce2c2131744598d45d77b8960d3a54fb20f8b38916db
font_01_sfnt_off00011060.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11060 10756 bytes
SHA-256: 2aaf0372704ec6cb16750225093c35b6d337341cac12786f57e14d9ac74d04b5

Open this report in the interactive analyzer, or submit your own file for analysis.