Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbe826efb0487dd4…

MALICIOUS

PDF

86.8 KB Created: 2021-03-22 03:56:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d6458f47e0c1321224a558df12b2d285 SHA-1: 99961a618259247be780a5b4af82bf4b26bc98ce SHA-256: bbe826efb0487dd444baf87fb97db94dbf53961a0f2fceea9b9c4b4a1a94e0b8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious and phishing-related. It contains a large number of external links, many of which point to SEO-optimized PDF files on various domains, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, contains keywords related to a product manual, likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=black+and+decker+36v+cordless+mower+manual
    • http://ubzvp.com/gw2_map_completion_guide_20208iify.pdf
    • http://limezage.scienceontheweb.net/contact_angle_wettability.pdf
    • http://reduslimitaly-ufficiale.website/pinuzogimoxupiluybt3y.pdf
    • http://garantiya62.ru/dixobaneocnjw.pdf
    • http://blockhcain.host/whats_a_bardobs4bf.pdf
    • http://tactical-jacket-sale.shop/gabaginimajenejuneglmn2.pdf
    • http://vittorguxx.site/femuvunodukuvezaroruwilcaifi.pdf
    • http://ru-payment.casa/sony_nex-fs700r_4k_sensor_high-speed_camcorderer1cm.pdf
    • http://natorg.fun/does_tai_chi_help_back_pain2kao7.pdf
    • http://zimezobot.getenjoyment.net/60552682806.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2daccc73-8708-4113-a26a-4f38906335d9.filesusr.com/ugd/f65175_1c84bc714b20470aaa36195e3f6ae32a.pdf?index=true
    • https://6d5fec37-5936-4ae8-8938-03a86e982f09.filesusr.com/ugd/d4da64_ae7b1d04b4b94b1ea2f1b5415def0e06.pdf?index=true
    • http://jomimil.rf.gd/62495348659.pdf
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_113c6929038b4117aba927d162b5b92a.pdf?index=true
    • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_ae08dd76a6664e5390a222fef9911ec1.pdf?index=true
    • https://5fb42ee6-a9be-400a-98f2-f9d4b9f720c8.filesusr.com/ugd/1813b3_3c50a5c1520b4745b529736c6f9ebabf.pdf?index=true
    • https://234a0c07-d908-4261-bb83-16b3c96a9b04.filesusr.com/ugd/73e0e6_2e29c3612dbc499abd1a85ee30dd3955.pdf?index=true
    • https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_a5041484fb5c4e39a734d6d2e498e171.pdf?index=true
    • http://zimifad.epizy.com/convert_to_word_plus_crack.pdf
    • https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_b51763e1a96542bcbf0d6eefaaa3daa7.pdf?index=true
    • https://c4a5d104-04f9-44e6-b03f-1f5edac3680f.filesusr.com/ugd/f23921_b4a21493c517416db9b43913c78eefa1.pdf?index=true
    • http://fidalanono.myartsonline.com/zejenezenemizoronoku.pdf
    • https://44dd6259-7513-41c7-b2f1-b2b1fc385d2e.filesusr.com/ugd/63022f_53b1bee4736b4cfc94ce666cc4e9f140.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001075d.bin
19b606867124f6eb0b13baee5d9834db3f8c32a88034b276cf192036806f8998		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1075D 5420 bytes
font_01_sfnt_off000119b1.bin
6b60b0372ab7b85195607aa308a3a0f38739aa85e15cba7ca3426bc05d382a31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119B1 11124 bytes
font_02_sfnt_off00013f87.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F87 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.