Malicious PDF — malware analysis report

Static analysis result for SHA-256 bac168f1187f4e8b…

MALICIOUS

PDF

80.8 KB Created: 2021-03-09 13:00:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 08ab2ade8c92f5a2111a43a761321537 SHA-1: 4173dae50e3b968b7b721aec1d6cd2aca17a9b50 SHA-256: bac168f1187f4e8b6270a79e6eab4383b8249bff8636ede2d70bac716dd8f5b3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for PDF_URI pointing to a URL that suggests a download for Facebook Messenger. Additionally, a critical ClamAV detection indicates it is a Pdf.Phishing.Trojan. The presence of embedded URLs and the ML classifier's high score further support a malicious phishing intent, likely to deliver a trojanized application.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=download+latest+facebook+messenger+apk
    • https://cdn-cms.f-static.net/uploads/4369150/normal_6030195481158.pdf
    • http://vemololuwejab.iblogger.org/accessing_and_ing_your_facebook_information.pdf
    • http://kobopez.mygamesonline.org/91000133046.pdf
    • https://cdn-cms.f-static.net/uploads/4421969/normal_5fd79a27ac9d2.pdf
    • https://fisujurij.weebly.com/uploads/1/3/1/4/131437504/7514379.pdf
    • http://tonopexoni.22web.org/12578208765.pdf
    • https://cdn-cms.f-static.net/uploads/4392867/normal_5fdc529934e8a.pdf
    • http://lukiduxipapep.mywebcommunity.org/bigenimojatujazo.pdf
    • https://joguwezur.weebly.com/uploads/1/3/4/5/134500750/cf8bf8d1fb.pdf
    • https://cdn-cms.f-static.net/uploads/4464732/normal_6041031b9581e.pdf
    • https://static.s123-cdn-static.com/uploads/4475999/normal_5ffb3c837465e.pdf
    • http://gajaxujifusokul.mygamesonline.org/how_to_get_free_rp_lol_2019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://samesesodore.onlinewebshop.net/bidabukowi.pdf
    • https://bb55feb6-a0c4-48ae-8f72-aea2c45912f8.filesusr.com/ugd/b9801a_bccb229876ca4315be85a3f77b649b0a.pdf?index=true
    • https://b86313a8-447b-404d-ae6d-bc69740d899e.filesusr.com/ugd/e54fc7_3a9cf099397443a1899b31ad3f5dcd86.pdf?index=true
    • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_571f841fdf7b49a5814aa4ef0b66647d.pdf?index=true
    • https://8dfd47f4-e591-4377-92a3-bdbf91d41e5a.filesusr.com/ugd/a58b01_7b96971814a94f139ea52e2b2b0ec04c.pdf?index=true
    • https://9e2b3e3a-6a02-4d3b-8ba9-5acc01041672.filesusr.com/ugd/66c878_3047d1651e3a4a38944d559c49cb1132.pdf?index=true
    • http://fiforeru.atwebpages.com/28529488375.pdf
    • https://uploads.strikinglycdn.com/files/e3784da9-9ef2-4cd4-9568-11fbf3093058/1981_honda_express_sr_carburetor.pdf
    • https://uploads.strikinglycdn.com/files/719e6e3e-3aa5-483d-8846-b40930f15d9c/who_is_the_main_character_in_enemy_pie.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f161.bin
5a5e1859f2e2e7818ceb4a234daa4c0719694cc195a2090c7d9b5d7ed2202514		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF161 5768 bytes
font_01_sfnt_off00010506.bin
6aa22c3bf9a0068018409847e798d3299f90018a28d0bc74371a36eee25ee443		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10506 3340 bytes
font_02_sfnt_off00011288.bin
b8ba39855693cc10c5280daf5303e53f47aeca56b9b36b6f774a14e31c849995		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11288 10196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.