Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbee15bc5b179f0e…

MALICIOUS

PDF

99.5 KB Created: 2020-12-15 08:40:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f74b4dcc9514f17b9a5762ddd7bc1fc SHA-1: 54e126482911abbdb68e503954fb9967ee4c4dcb SHA-256: bbee15bc5b179f0e1f9c123121b4ff6509ea4a8434af09b195d295887f8f20ea
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO manipulation or directing users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a large number of external links, with one prominent example being a Weebly hosted PDF. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=seven+knights+arena+mastery+guide
    • https://kaperimivegorew.weebly.com/uploads/1/3/4/3/134371305/fukatijunezo-saxowitokemavez.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static1.squarespace.com/static/5fc0e88b8139af0376454bd0/t/5fc35990e18c5c478e6634bb/1606637971242/nikogulexoxesavirewoxolow.pdf
    • https://s3.amazonaws.com/zodawanuror/duration_excel_template.pdf
    • https://uploads.strikinglycdn.com/files/310c0d94-80ce-4b7a-977f-a8a16660c951/bejatogaw.pdf
    • https://uploads.strikinglycdn.com/files/233a9c53-81b1-4cfa-b6cc-4dc152efacec/rock_country_los_mejores_temas_ps3.pdf
    • https://s3.amazonaws.com/salosibejodod/android_sdk_platform_tools.pdf
    • https://s3.amazonaws.com/tobojelusiwi/among_us_para_pc_de_graa.pdf
    • https://static1.squarespace.com/static/5fc3769dc89e1c4b8fcecae8/t/5fcdbf37e43f2b00a8c8348c/1607319351819/drink_bubbles_quotes.pdf
    • https://s3.amazonaws.com/purawuma/kellin_quinn_biography.pdf
    • https://static1.squarespace.com/static/5fc5b3e09955c744b55c34f9/t/5fd638dc267c8d0ace4121ef/1607874781429/hyperkalemia_guidelines_aha.pdf
    • https://s3.amazonaws.com/pujirageg/guwilewu.pdf
    • https://static1.squarespace.com/static/5fc781e15c272238a81a89ed/t/5fd086112f29925fbb510003/1607501334042/hit_it_tiktok_song_lyrics.pdf
    • https://static1.squarespace.com/static/5fc165e488c99b6d37aa9f7e/t/5fc6aa2d4f98375720cb196d/1606855213263/ikea_chairs_living_room_canada.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012362.bin
f2ac2e415b5aff05f8b2b831c3b74ae19383a0e1ec3cb283fdf2e106e7a5e304		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12362 5308 bytes
font_01_sfnt_off00013544.bin
2b22f5d4aa63518f679eeab3011cc5e20524b3ccd9efc065af86372920acea40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13544 11528 bytes
font_02_sfnt_off00015cc3.bin
31210c78638ced3ad00f4ea4cad371e8620555a628cbbdf8f1878fe60601f515		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15CC3 16236 bytes
font_03_sfnt_off00017230.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17230 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.