Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7e829510cd8d32e…

MALICIOUS

PDF

77.1 KB Created: 2021-03-25 16:03:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9f2f15b13f36474336a71cf3a08d5308 SHA-1: 82b00e52b6b62367805489608ae8719b49f305aa SHA-256: b7e829510cd8d32ec4a52933668f6fd5b8bb60a7a40e1a9b00cd566628a07c8e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-themed, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious content. While no scripts were explicitly extracted, the PDF structure and external links point towards a malicious intent to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=guitar+easy+chords+pdf
    • http://ziratonis.iblogger.org/ragnarok_eternal_love_m_priest_guide.pdf
    • http://lebepufu.mypressonline.com/why_is_my_dishwasher_not_cleaning_uk.pdf
    • https://cdn-cms.f-static.net/uploads/4454286/normal_6031819381298.pdf
    • https://static.s123-cdn-static.com/uploads/4479938/normal_5feb87949fc16.pdf
    • http://jajotagesawize.iblogger.org/convert_to_editable_word_android.pdf
    • http://wajazenizur.mywebcommunity.org/blues_rock_soloing_for_guitar.pdf
    • https://static.s123-cdn-static.com/uploads/4410414/normal_5ffdb086deebd.pdf
    • https://cdn-cms.f-static.net/uploads/4465003/normal_6042d896037da.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dagasopones/que_es_un_mecanico_de_mantenimiento.pdf
    • https://s3.amazonaws.com/fopalew/exercicios_poriferos_e_cnidarios.pdf
    • https://78905da9-dd21-4190-abaa-c894c042e703.filesusr.com/ugd/851c7c_e925f4744a6a413bbb261ed6a9ed2c14.pdf?index=true
    • https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_56057a5d59e84007a5027b0729b4207d.pdf?index=true
    • http://jumepenitujox.atwebpages.com/86442057649.pdf
    • https://s3.amazonaws.com/benubapopikaj/72111294344.pdf
    • http://namerunu.rf.gd/73294041159.pdf
    • http://nanixalo.rf.gd/ladegert_battery_tender_waterproof_800.pdf
    • https://s3.amazonaws.com/sugowubuf/gopusixe.pdf
    • http://gumomexad.onlinewebshop.net/10001006944.pdf
    • https://s3.amazonaws.com/wuvepilamamuse/xizanadufaj.pdf
    • http://wozimape.onlinewebshop.net/guzeze.pdf
    • https://59cf682b-6680-4a08-8b8d-0472bab64ef7.filesusr.com/ugd/d7d6cd_a07e054d5adc43e997bf9930b0c92f13.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee7e.bin
b827de4d2b4f47560552e12fd5280ba565f917e0461d3214b3a318252daa69ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE7E 5344 bytes
font_01_sfnt_off000100b3.bin
3fdddd6ec6d5328dbe2265ce8992b31480f3e28a982c1be966a63d7970a20a39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100B3 11320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.