Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8c2d86d4667ec4c…

MALICIOUS

PDF

76.8 KB Created: 2021-03-16 21:48:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 359aa37fa13ad5ec6eab72e7094e9680 SHA-1: 9aaf24181b8fce056b4bcf7073eff406f79e2be2 SHA-256: b8c2d86d4667ec4c4f28dcd1cc62d23c3d48026f3b9db843ea412c8d485f71be
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and exhibits characteristics of a link farm, containing a large number of external URLs. The embedded URLs, such as 'https://pelibifir.ru/wix?keyword=hr+audit+checklist+2019+excel' and 'http://idealslimitalia-official.site/films_based_on_the_divine_comedy969hg.pdf', are likely intended to redirect users to phishing or malware distribution sites. The ML classifier also assigned a high probability of maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=hr+audit+checklist+2019+excel
    • http://idealslimitalia-official.site/films_based_on_the_divine_comedy969hg.pdf
    • http://indir-kazan.com/titulos_de_credito_privados_ejemplosql1nc.pdf
    • https://cdn-cms.f-static.net/uploads/4479224/normal_604c9689bfc2f.pdf
    • https://tekigeja.weebly.com/uploads/1/3/1/3/131384442/niwiber_vexoxoza_jituzifisil.pdf
    • http://memowelubi.mygamesonline.org/60759729717.pdf
    • http://womuvizitina.mywebcommunity.org/toefl_sentence_structure_test.pdf
    • https://kemigaguni.weebly.com/uploads/1/3/1/0/131070112/d650fa.pdf
    • http://dalifajebuxog.scienceontheweb.net/how_do_you_know_if_a_baby_is_done_breastfeeding.pdf
    • https://jabenawonidibe.weebly.com/uploads/1/3/5/3/135385032/wovajipafopula-dexinukuradijo-kodojebeb.pdf
    • https://static.s123-cdn-static.com/uploads/4486550/normal_5fc5cce9c567f.pdf
    • https://static.s123-cdn-static.com/uploads/4490265/normal_5fe04619e7fe4.pdf
    • https://tozafutesaf.weebly.com/uploads/1/3/4/9/134900259/253994.pdf
    • http://ipoteka.net/16271038035wdrs1.pdf
    • http://wegansit.space/pawuzorewewaruregaxwv2a4.pdf
    • http://kivolugog.mypressonline.com/56699311927.pdf
    • https://dedaxasufebix.weebly.com/uploads/1/3/0/7/130775271/wowasoper.pdf
    • https://cdn-cms.f-static.net/uploads/4387711/normal_60364c4d8499c.pdf
    • https://static.s123-cdn-static.com/uploads/4408343/normal_60024648bf462.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://21c505bb-01ca-4817-a549-4ed1ebba5040.filesusr.com/ugd/7d7105_6c6cce6545b9499fba5e74a60cddabfe.pdf?index=true
    • https://4c69d07c-928c-405f-a1ab-6436392658c4.filesusr.com/ugd/4c264d_adf259e9dff74fffb1a81b102553ae82.pdf?index=true
    • https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_eccaa46aa9fe40babb630de4f51f7022.pdf?index=true
    • https://5405d108-7f1e-482b-a10c-e06f62b7505d.filesusr.com/ugd/d941b1_5df271495aa347b3a5ebcd29965674e8.pdf?index=true
    • https://c9b0c9dc-51ad-46ec-84b2-dbc26df53712.filesusr.com/ugd/b6f588_50ea2617397948d3a4c2a0d3f0ce3852.pdf?index=true
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_c6dc5b0c3ad442aeb873bd2473a4228d.pdf?index=true
    • https://8c4778c4-ed17-4cf1-86f9-5448e21c5c15.filesusr.com/ugd/6da380_8affefa800a541d1acb45f049f90c555.pdf?index=true
    • https://aed022ca-8a9d-452d-9022-56a74a585a14.filesusr.com/ugd/4d548e_dd19b722ee0d484e8b7f30ba0744b412.pdf?index=true
    • https://cae2aa39-5014-47ec-b549-0fed73f36d02.filesusr.com/ugd/c8683e_fe94449f24da4eb4825f9f56edc2ddbc.pdf?index=true
    • http://gudugapapilile.atwebpages.com/accuair_elevel_sensor_install.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef83.bin
f77aa9d649ae8f8a1c34e08b664cf92094e51d4ecdadb804547740b49230971d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF83 5600 bytes
font_01_sfnt_off00010286.bin
9d423533054e48dfa1d5939196cdfd56bbd986c6bc0c84171d87f4dd64b227f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10286 10228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.