Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6dedd3de6b6e56f…

MALICIOUS

PDF

86.3 KB Created: 2021-03-07 17:50:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: e3fadd32d933105d9f83c869bc157c09 SHA-1: 00994ba1f1fd98def03e9af2e26323077e6e674d SHA-256: b6dedd3de6b6e56f1377d94fb306f628bc3cff6cda873523713a5b820052a473
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to disposable hosting and are likely part of a link farm designed to distribute malware or phish users. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to a "combo guide", likely to entice clicks on the embedded malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=riven+fast+combo+guide PDF link annotation
    • http://beamorem.com/haier_portable_air_conditioner_heaterauyav.pdfIn PDF document text
    • http://money-team.site/4613667865856wp4.pdfIn PDF document text
    • http://optarfes.com/43970638912rl07o.pdfIn PDF document text
    • http://bilkaita.space/kftc_voter_guidegj9wx.pdfIn PDF document text
    • https://cdn.sqhk.co/bodorosuzuta/cfgciet/transformers_robots_in_disguise_bumblebee_x_grimlock.pdfIn PDF document text
    • http://verifedform.com/lattice_method_with_decimals_worksheet8k4vg.pdfIn PDF document text
    • https://wubepifumemav.weebly.com/uploads/1/3/4/1/134109226/xafeg-pagidefiwezigik-vexaged.pdfIn PDF document text
    • https://tusemebi.weebly.com/uploads/1/3/4/3/134316443/9effd0ac7c96.pdfIn PDF document text
    • https://cdn.sqhk.co/dusivubeleza/icnjdjf/components_of_strategic_management_process.pdfIn PDF document text
    • http://usblighter24.site/223017746030ugfs.pdfIn PDF document text
    • http://devlp.club/nujasixigikik9buzf.pdfIn PDF document text
    • https://cdn.sqhk.co/zidulibu/ijhaibN/xegedugumobobabupan.pdfIn PDF document text
    • https://pijutizomi.weebly.com/uploads/1/3/4/6/134686964/donuxeposuwu_rowaku_fewafovij_sujovafenekude.pdfIn PDF document text
    • https://cdn.sqhk.co/xuzuvazol/gxoWA5K/22124638927.pdfIn PDF document text
    • http://rezltml.xyz/57548381504sp8pc.pdfIn PDF document text
    • http://shoop-ff.ru/8985223575058b1f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_21cd544125aa451e8ee0b46e12a3cb03.pdf?index=trueIn PDF document text
    • https://bf68d742-fb98-404a-ab47-1dcf24f7df52.filesusr.com/ugd/83e7fd_63b0a62663d84eacb3f39874fd91e012.pdf?index=trueIn PDF document text
    • https://c7fb3737-a2fb-4e06-b71d-f78b648bb0a4.filesusr.com/ugd/a9248e_1000949583e942c99f56938718985d52.pdf?index=trueIn PDF document text
    • https://580b68e3-2104-4118-ae5b-4f285de1c062.filesusr.com/ugd/dad7b5_0776b1ff77424081852727a6835d3665.pdf?index=trueIn PDF document text
    • https://9a4b5e96-23fe-4021-9525-787506808755.filesusr.com/ugd/b3318b_5054d9a6f70a4a5a8d4dcfd2acd417a9.pdf?index=trueIn PDF document text
    • https://336ddc11-c37d-4cd6-9685-7accad2975f7.filesusr.com/ugd/479fa9_476656a4ee38448ebc819cd6d441db4d.pdf?index=trueIn PDF document text
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_2f59224f6bc5495296c52d0a35bb7e19.pdf?index=trueIn PDF document text
    • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_9eda0df2429445b48ac8e50497c11c63.pdf?index=trueIn PDF document text
    • https://ac734925-007a-49fa-9a6b-2340142042ec.filesusr.com/ugd/ea78e0_7d5f4bfe7d0947ba813a020edea26080.pdf?index=trueIn PDF document text
    • https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_51315c52a5df445ab3b566414843c0be.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010773.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10773 5304 bytes
SHA-256: 6b1d9a76c184bde85c8174c73bc19489215b53bb9c0d2e616142f9a8bc6196c3
font_01_sfnt_off0001196f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1196F 10516 bytes
SHA-256: 9095318e8e8116da2db03a19ce19a8250714599e8aae1d258b66dac4e5897a20
font_02_sfnt_off00013d5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D5F 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.