Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbebcfda7642816a…

MALICIOUS

PDF

91.8 KB Created: 2021-04-23 22:01:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: cf2c80e07e6975ab3c1cfeab0e87b076 SHA-1: e278e9defeae20093499607a4c220f4f444d2077 SHA-256: bbebcfda7642816ad4aad7399851d9c89db706fedf2d578cafb63c633c300e9e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=easiest+expert+plus+song+beat+saber PDF link annotation
    • http://psyhologrzn.ru/itil_v4_foundation_certification_study_material1h45s.pdfIn PDF document text
    • http://rusakova.space/real_love_test_game_online1mf9n.pdfIn PDF document text
    • http://ecoservice-vlad.ru/xuvamafadebimibifozeloxa2n3lg.pdfIn PDF document text
    • http://esparks.ru/zativigosa220bb.pdfIn PDF document text
    • http://wersita.space/palozojajafonanuvosekeca0kz.pdfIn PDF document text
    • http://hydrofthol.space/bitiwegurojajokasei4pcy.pdfIn PDF document text
    • https://cdn.sqhk.co/miloniwuwave/giU6k1k/slingplayer_free_for_phones_apk.pdfIn PDF document text
    • http://upgrade4me.com/posizifaralipedid4tpu.pdfIn PDF document text
    • http://itgermany.net/how_to_set_plug_in_timern8pa2.pdfIn PDF document text
    • http://circleshtang.xyz/how_does_time_relativity_work_in_interstellar18k4o.pdfIn PDF document text
    • http://blockingscenery.com/how_to_write_a_cv.pdf_free_downloadsvn8n.pdfIn PDF document text
    • https://cdn.sqhk.co/towinomer/gijeiaK/brazil_women_s_football_world_cup_wins.pdfIn PDF document text
    • https://cdn.sqhk.co/zapusukajev/bgi4jc9/highway_to_hell_movie_poster.pdfIn PDF document text
    • https://cdn.sqhk.co/kivipemo/gciihgY/luzelak.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/91ee0a93-94d6-466a-bee5-5b027a31e3f7/netbeans_java_in_file.pdfIn PDF document text
    • https://d1ced4a1-fa29-4c66-b583-77209f32159a.filesusr.com/ugd/c88d8b_14c1ec26258d4a22bee391092cfe2f8b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/797fcc38-7313-4b3a-a466-3777197ce7f2/what_topics_are_in_cell_biology_gcse.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abda047a-024f-471c-b0fb-3706bb6f82f7/82974688408.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3463a22f-801a-4d12-ac36-4131a8fb5686/is_cadillac_cts_a_reliable_car.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45c3d82c-81de-4242-9aa9-95f6ff4cf119/63376530462.pdfIn PDF document text
    • https://c0e8410b-c394-4b36-8083-179878a46647.filesusr.com/ugd/d4b1dc_1a83f662f63040e2b1d9861cf956f9ae.pdf?index=trueIn PDF document text
    • https://c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com/ugd/957c7b_f0d78ec2744944f7b721ac496ab58362.pdf?index=trueIn PDF document text
    • https://21d44941-995c-48b9-956b-8145330e20d5.filesusr.com/ugd/577b75_d3aa8e29d44e4244be567d065ff39546.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7c3835b-f3b3-415e-999f-afc3db7edb2e/members_mark_fire_grilled_chicken_breasts.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012459.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12459 5152 bytes
SHA-256: 830d97747b23deed6720c4c357af2e50e09e00a9dedd2552bc8869cbcff123d0
font_01_sfnt_off000135f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x135F0 13348 bytes
SHA-256: 501616ac146774f628e9bd907fe38e299bf4eb38e389ea8becec8c1e77b32600