Malicious PDF — malware analysis report

Static analysis result for SHA-256 b75bc2140a0e0657…

MALICIOUS

PDF

81.6 KB Created: 2021-04-02 18:02:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93ebd943842a601b92014dc26a0f385c SHA-1: 1dd101524f3aafc823248f2ff91767b4e2832cec SHA-256: b75bc2140a0e06577e1de4d0f64eba835dc98ea2ab60044d152c3bda05564813
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains numerous external links, with one pointing to 'http://rupevapunalude.rf.gd/compound_area_problems_worksheet_answers.pdf'. This indicates the document's primary function is to redirect users to a collection of other PDFs, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=what+are+the+features+of+fitbit+versa+lite
    • http://tokio-2020.fun/wosomop93f81.pdf
    • https://wogalipa.weebly.com/uploads/1/3/4/3/134316604/xizalulokelevexevufe.pdf
    • http://milanomoda.site/candide_voltaire_page_counthv02c.pdf
    • https://cdn-cms.f-static.net/uploads/4451350/normal_605006e32199f.pdf
    • https://static.s123-cdn-static.com/uploads/4427514/normal_6005793956de3.pdf
    • http://barbanapoli.moscow/jekipezuropatojelevosathnutw.pdf
    • https://cdn-cms.f-static.net/uploads/4413707/normal_604784766b0c5.pdf
    • https://bekedurid.weebly.com/uploads/1/3/0/8/130874189/lanamiseru_vesotubo_mixasofudukiwu.pdf
    • https://burakatotofok.weebly.com/uploads/1/3/1/8/131871829/wonasotivazafofe.pdf
    • http://gatorama.fun/basic_electronics_textbook_download5ge1e.pdf
    • http://neyroskakalka.site/53786792765uflzg.pdf
    • http://argo-tourism.com/531237545837lqvx.pdf
    • https://bumobuzeki.weebly.com/uploads/1/3/4/4/134477779/267484c4.pdf
    • https://ropexosuwewi.weebly.com/uploads/1/3/1/3/131380205/836928.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rupevapunalude.rf.gd/compound_area_problems_worksheet_answers.pdf
    • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_0b626627cec445d28c7dd924d62aac4c.pdf?index=true
    • https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_8b2c0331c63146f98472f0cb5a23a160.pdf?index=true
    • http://keporumutiwem.epizy.com/jegovifixonanozojifameder.pdf
    • https://9fbaa0db-fe9e-443e-b503-3d02ea494c21.filesusr.com/ugd/d417e9_619008aac6fd4b54892551a1e143c882.pdf?index=true
    • https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_36d1e657765a4f6cada9395a7c011b15.pdf?index=true
    • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_20dd0eb913b5433ba7f17e6292547403.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100e2.bin
bd97c37928f9c872f2994877cf6c62617f0b0019add1bc31fafd2bb4fa10ffb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100E2 5068 bytes
font_01_sfnt_off0001122d.bin
d7189a933f55c2b32ff5cb4308b7c1ac61ec036c0ab89074b858e4d5ed03ad07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1122D 10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.