Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5178619b0494716…

MALICIOUS

PDF

78.2 KB Created: 2021-05-14 05:18:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 596e888f84f4a173d501ff7d5e453e71 SHA-1: db2ce8ec0f334149e274bedc6f2b8b819678e58a SHA-256: b5178619b0494716b6b1633e6f6d2b4e42cdb0283de82c577371ce052d689aca
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a primary URL pointing to a suspicious domain that appears to be part of a link farm or phishing operation. ClamAV and ML classifiers also flagged this file as malicious, specifically as a phishing trojan. The presence of embedded URLs and the overall structure suggest an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=active+and+passive+voice+examples+for+present+perfect+tense
    • http://nuwazomesesanok.mygamesonline.org/38204063717.pdf
    • http://lakujalinifibo.mypressonline.com/jomasumiseviluzafavar.pdf
    • https://jutabuja.weebly.com/uploads/1/3/4/6/134666284/9185511.pdf
    • https://cdn.sqhk.co/modonasuje/DCnjff1/video_y_tv_cast_chromecast_apk.pdf
    • https://cdn.sqhk.co/mirusopujame/CihxiVP/30809149680.pdf
    • https://cdn.sqhk.co/sujubowip/idiTghc/momupizotedigoxugatu.pdf
    • https://zaduguwage.weebly.com/uploads/1/3/0/8/130874015/0c6ef8266abc2.pdf
    • http://umdtheatre.ru/who_died_in_13_reasons_why_all_seasonsdij11.pdf
    • https://cdn.sqhk.co/medipevagopu/jghd8xF/the_princess_bride_adventure_book_game_ravensburger.pdf
    • http://50offstore.info/xelojixagukedemvx1m.pdf
    • https://pamimimafe.weebly.com/uploads/1/3/0/7/130775080/8394014.pdf
    • http://sitizinudex.getenjoyment.net/kenwood_dnx692_wiring_diagram.pdf
    • https://databuzub.weebly.com/uploads/1/3/4/3/134373368/kasavetopijanowos.pdf
    • http://lnstagramcopyrighthelps.com/como_saber_quando_um_homem_quer_terminar_o_relacionamentonowt9.pdf
    • https://cdn.sqhk.co/nebuwaxisiw/cnHhgid/96727842732.pdf
    • http://fibisazorowax.mypressonline.com/big_ideas_math_algebra_1_book.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3c199e1c-ff83-4553-a351-db1e9419129c.filesusr.com/ugd/424a74_fe274c04fa364cea803cde590c4444d6.pdf?index=true
    • https://aa5f33e9-793b-4807-a257-9eac84d314d0.filesusr.com/ugd/aa57b2_680254600a044511a92e345fcb7de350.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4df2e8f1-97e3-4367-aee4-5110c6fd0957/jawawurebexefifelo.pdf
    • https://19004eff-8f5e-45b0-b15a-9fbdbd99e39d.filesusr.com/ugd/578ea4_02f611e679834006a0d5a5a097418b0e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9370780a-4605-49dc-a08e-a79f14007f8a/what_is_tropical_climate_in_australia.pdf
    • https://6680615c-3592-42a6-94f3-b98e474b5330.filesusr.com/ugd/252546_c24db1c8a9e94be6bafc13014a95afa6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/90b0924e-7221-44ed-8ad6-7250053dbc9b/rufixugubemejadojimeb.pdf
    • http://rijemow.onlinewebshop.net/bangalore_route_map.pdf
    • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_3d139eb9997449c8b8d88800a33e0f6a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/91a840ee-23bd-43ba-8820-08b9ca89c2ee/how_to_troubleshoot_a_westinghouse_tv.pdf
    • https://uploads.strikinglycdn.com/files/3600a979-e75b-42c3-bd6d-ab9e70ff965e/xozejigipapaxima.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efff.bin
e9f4297f361328d4860a3a89d5d0cbf5741e9efa220c4a1ec76214e0374948e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFFF 5416 bytes
font_01_sfnt_off00010267.bin
835a835c3f209f18c14095017d3df1dd6084fdc2550537ee2237f80ca54c66b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10267 11052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.