Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5d12c0ef9d3a026…

MALICIOUS

PDF

102.4 KB Created: 2021-03-12 01:29:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c3ef361299af763cdacb7dd7fe6df63 SHA-1: e06ad25f7c869872e327e93bad03215740c8140c SHA-256: b5d12c0ef9d3a026446c9299ef22d6b32bfce0a217fd3cf86dcfa2707d826657
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics as containing a link farm and was classified as malicious by an ML model and ClamAV. The document body is heavily obfuscated, but the presence of numerous external links suggests an attempt to redirect users to potentially malicious websites. No scripts were extracted, but the PDF structure itself is being leveraged to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=application+of+geometric+mean+pdf
    • http://alluniversity.fun/sundance_spas_hot_tub_instructionshwx7z.pdf
    • http://copyright-notice-ig.com/restaurant_fontainebleau_guide_michelinuu6ol.pdf
    • https://cdn.sqhk.co/nugilatunu/rieMChj/knights_fight_2_honor_glory_mod_apk.pdf
    • https://nagipunewemog.weebly.com/uploads/1/3/5/3/135315215/91c54.pdf
    • https://gifidutuv.weebly.com/uploads/1/3/4/6/134666467/6115544.pdf
    • https://pefeluleno.weebly.com/uploads/1/3/4/6/134698673/sezekeba_zejarirulu_sifawofi_juwaze.pdf
    • https://lutaxebibutemun.weebly.com/uploads/1/3/1/3/131380730/c5b4b79.pdf
    • https://vilewojux.weebly.com/uploads/1/3/0/8/130874250/ae909f8a6e48ca.pdf
    • https://cdn.sqhk.co/zafowavo/ahb41ie/used_cars_near_me_under_20000.pdf
    • https://pixelisikug.weebly.com/uploads/1/3/1/4/131407736/sejunopo_figetekoku_penudupiga.pdf
    • https://fagojature.weebly.com/uploads/1/3/3/9/133987822/nodukomem-molabimadoma.pdf
    • https://cdn.sqhk.co/vasibejovej/buXjehb/92343182388.pdf
    • https://cdn.sqhk.co/lanumakefu/nGjfhdI/33164100463.pdf
    • http://tibetterrier.ru/focusrite_scarlett_6i6_power_supplyynw7o.pdf
    • https://static.s123-cdn-static.com/uploads/4425217/normal_5ff58e79d736a.pdf
    • http://soldatskaya6.ru/pernyataan_standar_akuntansi_keuanganagfdt.pdf
    • https://cdn-cms.f-static.net/uploads/4450340/normal_600d589a0a72e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3c738500-3e67-4e96-99b2-41240c0f894d/iei_keypad_212i.pdf
    • https://uploads.strikinglycdn.com/files/de2c7146-1256-4b6e-aac4-278636c1c589/tovekop.pdf
    • https://uploads.strikinglycdn.com/files/bde04f91-3534-4939-8a38-5c152eacb75e/ending_of_araby_explained.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012bd9.bin
d574d3c9a0c398910cd60109385cf14cc780de3f8ffc95d95f9bf1a74574d1b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BD9 5284 bytes
font_01_sfnt_off00013d82.bin
c4caf660c5e4eed867bd265f78ab804edd47e82bbc5845baca6e4b3e50ce6bcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D82 6300 bytes
font_02_sfnt_off00014ce0.bin
efd430672bb903468fe066786cd6b2b5c54720629d0adaebd490ae9aa4400c29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14CE0 12056 bytes
font_03_sfnt_off0001764c.bin
68421c3228a054f3c554f3e8136665fa73c1f46743fd4c24271559bb96c6d569		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1764C 16172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.