Malicious PDF — malware analysis report

Static analysis result for SHA-256 b96616908420074f…

MALICIOUS

PDF

80.4 KB Created: 2021-03-16 17:18:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75c2e161e00e811ec4b4c82c82262621 SHA-1: 40df197196ef81da5142cec538a5d4def7534865 SHA-256: b96616908420074f818c213ca658bc7be0181490fd4d7751935dc4024cb2a53a
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM'. One of the primary URLs, 'https://maypoin.ru/award?keyword=anatomy+sketchbook+pdf', suggests a lure for potentially malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=anatomy+sketchbook+pdf
    • https://nasuzezigoma.weebly.com/uploads/1/3/4/5/134587751/30497a.pdf
    • https://vumirexow.weebly.com/uploads/1/3/2/7/132740730/3070755.pdf
    • http://dufigep.scienceontheweb.net/62519345531.pdf
    • http://xikisavi.scienceontheweb.net/sebodejojixisulijeluk.pdf
    • https://tumunuwixa.weebly.com/uploads/1/3/1/3/131384432/dotojapageleji.pdf
    • https://zakuxaposud.weebly.com/uploads/1/3/1/3/131382531/4960958.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://71f68c9c-1037-483c-a0ca-f268b7ddd3c8.filesusr.com/ugd/87fdc7_921326e464184c2c84dda1ca1ca1ac72.pdf?index=true
    • https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_787330d96c504f0186fa1ffa87bf9638.pdf?index=true
    • http://gipebevu.atwebpages.com/10232208332.pdf
    • https://f3874c2d-c116-49c2-b7b6-9300dc8fc43e.filesusr.com/ugd/b11f6d_cdafef9f92a64605abf94c67679565d2.pdf?index=true
    • http://nuwumexuxesi.epizy.com/nuzatiretadi.pdf
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_849b447d322e4206a1a9519919b28ea7.pdf?index=true
    • https://s3.amazonaws.com/gogunabones/7081159269.pdf
    • https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_272430d38d244d38b9536f2a7b1634bc.pdf?index=true
    • https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_8c6e050086f148beae2397f9d341d59f.pdf?index=true
    • https://s3.amazonaws.com/tiluwisulepam/sanlam_balanced_fund_fact_sheet.pdf
    • http://sojizodujibibo.epizy.com/fedexakapekivewel.pdf
    • http://fovawipemezipu.myartsonline.com/61693537476.pdf
    • https://af431a04-9ebc-4ea4-a98d-45e4ffbfad14.filesusr.com/ugd/485053_e3a1e28254e74239aecab1171511fdf6.pdf?index=true
    • https://s3.amazonaws.com/bipepezuwed/hvac_electrical_symbols_chart.pdf
    • https://s3.amazonaws.com/mevuzokekenojab/pebozovujegalilisas.pdf
    • https://s3.amazonaws.com/jejulurowev/aaja_mahiya_song_pagalworld._com.pdf
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_55f6a1ee2beb41908830ae43cd997c16.pdf?index=true
    • https://5b3fc17b-a4fb-4144-9a53-ff617e35bc6a.filesusr.com/ugd/696117_73d4f4c44c8140c6a529b6fe05ad8f59.pdf?index=true
    • http://kubomefewofumim.atwebpages.com/ansys_18_help.pdf
    • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_87436d718e0b4b579b32753bb419bc00.pdf?index=true
    • http://bajivuselome.epizy.com/94386292411.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f00d.bin
7d639b642b4f9748eb69ecfd2056d2a04943152ffa7dd5e1c2877332460d9483		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF00D 5304 bytes
font_01_sfnt_off000101ee.bin
810d930a55ee98e1f1213290eb3370951290acfaaebb6f6cdccfb7dd9ad08e92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101EE 10532 bytes
font_02_sfnt_off000125fa.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125FA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.