Malicious PDF — malware analysis report

Static analysis result for SHA-256 b59487942c7d338a…

MALICIOUS

PDF

91.3 KB Created: 2021-03-17 00:32:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12df2b717eeab2ff581b893da1f60eac SHA-1: 2f2a9cc3541572c43fb220025faf9a713da0d05e SHA-256: b59487942c7d338ad04749bcf72b8eb3e358dbcb39badb59c9298612413fee3b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting a link farm or phishing attempt, with one primary URL being https://dafemum.ru/123?utm_term=coliformes+totais+e+termotolerantes+artigos. The document body, though heavily obfuscated, appears to be related to the 'Coliformes totais e termotolerantes' topic, likely as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=coliformes+totais+e+termotolerantes+artigos
    • http://uscarinsurance.info/arabic_keyboard_apps_android_market2win4.pdf
    • https://guvikaki.weebly.com/uploads/1/3/4/5/134519546/2536400.pdf
    • http://vvvvvvvvvvvvvvvvvvvvvb.xyz/how_to_program_bearcat_scanner_bc345crs75p8m.pdf
    • https://bexusisase.weebly.com/uploads/1/3/4/5/134596812/nuvovakifexezevux.pdf
    • https://cdn.sqhk.co/tatidukigag/bhfjajb/samujadu.pdf
    • https://cdn.sqhk.co/marixefe/qQjehhJ/zezisirak.pdf
    • http://idealicaitalia-ufficiale.site/30017254957w4msf.pdf
    • https://latapelubatute.weebly.com/uploads/1/3/5/9/135960370/b07cbeab14c6b1.pdf
    • https://static.s123-cdn-static.com/uploads/4490736/normal_5feb8a1e78206.pdf
    • https://static.s123-cdn-static.com/uploads/4390371/normal_5fec5c69efcd2.pdf
    • https://zorisurirumu.weebly.com/uploads/1/3/4/6/134600588/9916498.pdf
    • https://cdn.sqhk.co/jopolemuge/BJgiXd6/84831359261.pdf
    • https://cdn-cms.f-static.net/uploads/4375210/normal_6042c796aee58.pdf
    • https://cdn.sqhk.co/merodobiweve/bidijmu/othello_character_development_essay.pdf
    • https://mefufexuwi.weebly.com/uploads/1/3/4/0/134019004/7043713.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_741814d6abec41b59c5c0e89d1e777c4.pdf?index=true
    • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_596b809d08ef4abb83db60ac9609fce6.pdf?index=true
    • https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_e3065cd3bccc4d9180d20ed25cd8a44f.pdf?index=true
    • https://bed2d873-735b-46bb-a8a3-264d0455df4e.filesusr.com/ugd/03ede2_46d8b2b48e3f458288e454e01447b299.pdf?index=true
    • https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_9438d269fd8a4b5e9765e0783c6a0547.pdf?index=true
    • https://57933e30-1e86-4cbe-ad2b-777cb72f9932.filesusr.com/ugd/235f1a_82eda555e8ea46849d0f6e5c7caeba42.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000125ec.bin
fb6c23173fecb17f953ce4b8058716a43e76a5cd52bfb648f7137f01a43e000c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125EC 4992 bytes
font_01_sfnt_off000136cb.bin
e7dc317cf74d2d52661aaa5c93b361e50c32a79261f44842e866fd94f57c16d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x136CB 13576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.