Malicious PDF — malware analysis report

Static analysis result for SHA-256 b91de0a8d49e7606…

MALICIOUS

PDF

78.5 KB Created: 2021-03-26 09:52:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f5a085c12fb833831cf490a605d61a4b SHA-1: 219b49c4ca664be997221c6045c6efa2c176332c SHA-256: b91de0a8d49e7606d9e4125f249cb1b40144eb0e7282ac96f39085e1b53da505
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded external links, suggesting a link farm or phishing attempt. The document body is heavily obfuscated and contains metadata indicating it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, which could be leveraged to disguise malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=what+needs+fcc+certification
    • https://kelebewo.weebly.com/uploads/1/3/4/3/134359650/4939016.pdf
    • https://valabonef.weebly.com/uploads/1/3/1/3/131379230/tatafezusid_sudugonog_mofobisekel_tumodanuzeto.pdf
    • http://icub.tech/edtpa_practice_task_3_educ_606gzwzk.pdf
    • https://nogurutofuxuj.weebly.com/uploads/1/3/4/5/134525281/6997337.pdf
    • http://sodaapp.pro/68712299642nbt4m.pdf
    • https://mutixuvuv.weebly.com/uploads/1/3/4/6/134665255/wemenumuw-repiligu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ralirajuz.atwebpages.com/45908265800.pdf
    • https://s3.amazonaws.com/dubiditiginowo/debozanavekazuzapite.pdf
    • https://041f977c-1598-48cb-b578-3d63f550c8ab.filesusr.com/ugd/524ae3_94d66acce29b4956817e0dda5cdaaac5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/451f0a9e-c8e7-4844-8b9e-765e948e56c9/maxaso.pdf
    • https://s3.amazonaws.com/zifilobesumafi/fimiwiwezawefegedadom.pdf
    • https://ff536187-e25a-4bd2-965b-ff1113cf40b0.filesusr.com/ugd/bfcccc_fc0c1b73d355411281224af662cf0ae2.pdf?index=true
    • https://s3.amazonaws.com/gekojulog/dark_souls_3_mad_covenant_location.pdf
    • http://nufiwimuzobo.onlinewebshop.net/52044982442.pdf
    • https://uploads.strikinglycdn.com/files/0c543cd2-145c-4079-ba5e-a27a82991d1e/gimufugugutowe.pdf
    • http://wuragumok.atwebpages.com/vexafanogoz.pdf
    • https://uploads.strikinglycdn.com/files/0028ef61-29ed-4a6a-8f82-a8347fd49474/32116879554.pdf
    • https://s3.amazonaws.com/jexijer/lavukalisago.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f482.bin
e3bed8638356e919f81acd9a766ad710c109e58874c4a2cc7261049e28f6cf18		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF482 5088 bytes
font_01_sfnt_off000105d9.bin
fd243e54bcf2ae4b80bed5622d04a5dfcf97f39732f4ca5e810eb2f637dcdd10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105D9 11632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.