Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5cad6d482da84a0…

MALICIOUS

PDF

76.8 KB Created: 2021-03-10 21:58:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a6a9ebe4f9ce7972b752454695938764 SHA-1: 9f035bf85d6ed5fae7a8503b91f5c8e31a964e5d SHA-256: b5cad6d482da84a05b1770a882bedd86f2927f5f3f614b41da218ee9fd3df91e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, with a significant number pointing to external resources, indicative of a link farm or phishing lure. The heuristic 'PDF_SEO_LINK_FARM' specifically highlights this behavior, suggesting the document is designed to drive traffic to a large number of external PDFs. ClamAV detection and ML classification further support its malicious nature, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=zoo+animals+flashcards+pdf
    • http://ig-objectionform.com/pijefedobitaxutuz1k98s.pdf
    • http://opensol.xyz/hisense_air_con_remote_instructions9xoev.pdf
    • https://static.s123-cdn-static.com/uploads/4498997/normal_5ff2772041125.pdf
    • https://static.s123-cdn-static.com/uploads/4426687/normal_5ff970d124a21.pdf
    • http://gabubixaj.22web.org/28259094726.pdf
    • https://static.s123-cdn-static.com/uploads/4489583/normal_5fe1c0e7586ea.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://ac402fee-74f4-49a6-b5a4-6a03c6a057de.filesusr.com/ugd/b0cd75_b6ab3c8d07e644d4ae62ba7e399f7c00.pdf?index=true
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_2505e3f7e9f34ca0bad13a60da8c9d01.pdf?index=true
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_258e60c454a94a46a5539f7c3ce37e9a.pdf?index=true
    • http://taxadip.epizy.com/time_management_worksheets_for_middle_school_students.pdf
    • https://645c32c3-7e99-4959-b93b-7980205539d7.filesusr.com/ugd/30a31c_4e929c0978e740108c8607bf9af49eb5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/55909373-c501-47c8-a8ff-bdecd59947b2/how_to_replace_igniter_on_ge_gas_stove.pdf
    • https://c3145b97-73ac-4615-99dc-c7e26a5bcf55.filesusr.com/ugd/7ab50f_a1a5e2518e2846fdb36538f6aaa0d7c7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c23b24d0-7ffe-495a-a632-6be043930cfc/bojixosukubimekifawaduteg.pdf
    • https://uploads.strikinglycdn.com/files/da43cf9b-7846-49a2-9e93-e0a16d80f252/la_casa_de_bernarda_alba_chapter_summaries.pdf
    • https://uploads.strikinglycdn.com/files/178e0fd6-c1f6-435a-ab2b-43f116a5e0b0/advanced_python_3_code_examples.pdf
    • http://zavimefetemif.epizy.com/64471027569.pdf
    • https://8c805f22-5240-4a8e-9b4d-8499607ff1fc.filesusr.com/ugd/76156b_6d56db0ba06441d89384e0eb070f3cff.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2d1.bin
a54de72347ea8bbfb940d62b7068b988f1630ac04967033aa3976bd7458398d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2D1 4944 bytes
font_01_sfnt_off0000f359.bin
a85cda5140e22eb97c707276538e62c31bef4528d0b46159fac4befae9ee13c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF359 10736 bytes
font_02_sfnt_off00011834.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11834 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.