Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8b0871f24c6d506…

MALICIOUS

PDF

108.8 KB Created: 2021-05-09 21:31:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: ff88252a4b1baa79e1ada593c184b069 SHA-1: 2f3373a5a7cb2b23b44f362691755254c8fdc0ef SHA-256: b8b0871f24c6d506db035a6261a42cb060b5b373e6ac004c742831882e45def2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=why+is+ethanol+more+polar+than+acetone PDF link annotation
    • http://hristogrigorov.com/reading_plus_answers_level_j_marvel_man18tlb.pdfIn PDF document text
    • http://energytik.net/kafogonix8p8g7.pdfIn PDF document text
    • http://zirekafeti.iblogger.org/what_are_the_miracle_morning_steps.pdfIn PDF document text
    • http://kindraretterath.com/90861974030uc86c.pdfIn PDF document text
    • http://busibear.com/720227325350na2u.pdfIn PDF document text
    • http://lirelejavebot.iblogger.org/31079381879.pdfIn PDF document text
    • http://priz24.site/beautiful_in_white_ringtone_freeed30u.pdfIn PDF document text
    • http://tifowudadu.22web.org/51960845321.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://b0b8c8c5-0de0-49ea-8337-0a56b8a4e65f.filesusr.com/ugd/bf9dfc_4458a54fae904583bec685748734a086.pdf?index=trueIn PDF document text
    • http://barazaduxobuta.epizy.com/beverage_processing.pdfIn PDF document text
    • https://s3.amazonaws.com/vuxagixil/the_fall_of_the_house_of_usher_quotes_about_fear.pdfIn PDF document text
    • https://s3.amazonaws.com/gudukupir/innisfree_sheet_mask_review_malaysia.pdfIn PDF document text
    • https://s3.amazonaws.com/fupanabivote/adobe_acrobat_reader_9_full.pdfIn PDF document text
    • https://s3.amazonaws.com/xoxaneral/disuxametosuwatin.pdfIn PDF document text
    • http://zujakogi.onlinewebshop.net/62238563992.pdfIn PDF document text
    • https://203e7bc3-08d7-4ecc-a8df-f797e0d4a079.filesusr.com/ugd/d4579c_55051239b21044f286d597a8bd556136.pdf?index=trueIn PDF document text
    • https://cd489911-dc6d-4439-b408-84622343fb93.filesusr.com/ugd/d8e941_8fd4807d26804746abcf8d671e348b36.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sitok/matlab_online_free_for_students.pdfIn PDF document text
    • https://03a45e23-20c9-4b13-8d21-50c2609e56df.filesusr.com/ugd/502f3d_b7066ffa71604fcbb1ca55e6650c1eb5.pdf?index=trueIn PDF document text
    • http://libejojas.epizy.com/vapilasi.pdfIn PDF document text
    • http://tagijonegularol.myartsonline.com/anatomy_of_fetal_skull.pdfIn PDF document text
    • https://s3.amazonaws.com/xebuvuwov/grammar_checking_apps_for_android.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000156b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x156B9 6492 bytes
SHA-256: d2077f5d6d5b1d677d9b6d000eb087611a047961d42ceeb980acba3b54af8b85
font_01_sfnt_off000166ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x166EE 5288 bytes
SHA-256: f21fe8b074c24ba6088eb0e874cfc8194b9ff4241cc4ed6cc544714c004d6634
font_02_sfnt_off000178d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x178D0 13452 bytes
SHA-256: 053065211ebf81ec34dd133319d46ed9f4c7bf0fe33461f17759cf2acf387715

Open this report in the interactive analyzer, or submit your own file for analysis.