Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6ec2667515b9c5a…

MALICIOUS

PDF

86.4 KB Created: 2021-04-02 11:25:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2ef25f17763366f46d95f43dfff5ae31 SHA-1: 5584b8ba8e8bfc9201bc26ddb4669a4ef5c37224 SHA-256: b6ec2667515b9c5a9c7a94f1301bb7377abc004a8c8ac2d3ef629d29b60e978c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with one heuristic specifically identifying it as a 'PDF_SEO_LINK_FARM'. The ClamAV detection and ML classifier also indicate maliciousness, pointing towards a phishing or SEO spam campaign. While no scripts were directly extracted, the presence of numerous external links suggests an attempt to redirect users to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=classic+wow+troll+priest+leveling+guide
    • https://cdn-cms.f-static.net/uploads/4376086/normal_603acadbc7d9a.pdf
    • https://cdn-cms.f-static.net/uploads/4388067/normal_600e5798d9564.pdf
    • https://static.s123-cdn-static.com/uploads/4369316/normal_5fe340371976e.pdf
    • https://cdn-cms.f-static.net/uploads/4471082/normal_6015003ca8985.pdf
    • http://razvivatel.blog/film_festival_submission_guidelinese53jq.pdf
    • https://cdn-cms.f-static.net/uploads/4392463/normal_6052b0416e6a9.pdf
    • https://static.s123-cdn-static.com/uploads/4408323/normal_6006b03116ce6.pdf
    • http://espacecmb.xyz/plantronics_backbeat_go_600_series_wireless_headsetuxln3.pdf
    • https://cdn-cms.f-static.net/uploads/4443357/normal_60437db759c86.pdf
    • http://kyhni.site/muduxilhc8y9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4c5ad993-366d-4b3a-aa99-9b6f56583180.filesusr.com/ugd/01e791_2a0892bd1bb64ffaa8b463d9d24a4ca4.pdf?index=true
    • https://fecd0c08-032d-4b8b-b26c-6108aca7a00f.filesusr.com/ugd/a87c8b_977d7aa1283b429681fbac7706245019.pdf?index=true
    • https://s3.amazonaws.com/bomifabipi/brother_of_the_year_movie_free.pdf
    • https://uploads.strikinglycdn.com/files/5266e7d6-f060-4ded-bde3-c6ba5715401e/pifafelirir.pdf
    • https://e60c805d-b9e1-47fc-b045-983511e9ac1f.filesusr.com/ugd/116bb2_2c49d587c1bb4766a26c817ca547af0e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ff87808c-0086-459e-9fef-c65069605424/netgear_wndr3700v2_specs.pdf
    • https://uploads.strikinglycdn.com/files/5ab32947-a5ec-41a6-929e-e046514a74b4/pokemon_mystery_dungeon_red_rescue_team_strategy_guide.pdf
    • https://s3.amazonaws.com/wajibile/english_conversation_class_online_free.pdf
    • https://s3.amazonaws.com/sakaburepagase/52521845888.pdf
    • https://uploads.strikinglycdn.com/files/38e14062-c996-42ef-9675-651a12950c8b/napivexuvagojedev.pdf
    • https://uploads.strikinglycdn.com/files/6b789530-6463-4b52-85e6-b4d8714d3427/lugafexikofomuneneviraz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011673.bin
397e36b2c592263f4d9f4315033ffcd089c3098ca5913a6d1dc16589b579bf12		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11673 5296 bytes
font_01_sfnt_off0001289c.bin
200d5462d7da6198c52d5081dca139b950ab10cdf0f0041e44469043ecf4c4d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1289C 10464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.