Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc093a771db4eec9…

MALICIOUS

PDF

76.8 KB Created: 2021-03-20 09:45:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 7a20bfb15fd02e93484789d76044ce5d SHA-1: 26bb11e04b012a0cbe5bbbcb7bdb03461995453f SHA-256: bc093a771db4eec93cf8dc93bc36b2def20b3b1c07c6ce0422325d51da5d1153
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or malware distribution scheme, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=chammak+challo+pahari+song+free PDF link annotation
    • https://zajilonuxiwez.weebly.com/uploads/1/3/4/8/134871265/zibigaga.pdfIn PDF document text
    • https://sirukume.weebly.com/uploads/1/3/0/8/130814715/66cdf4a64.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385633/normal_601d7cb3184c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382408/normal_602d2eb286de9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404953/normal_605223288f425.pdfIn PDF document text
    • https://jiwejezagaxu.weebly.com/uploads/1/3/5/3/135325467/bojexim_kexan.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447912/normal_6036f7b532a4d.pdfIn PDF document text
    • http://xanuxif.22web.org/9871616097.pdfIn PDF document text
    • https://sukaxivex.weebly.com/uploads/1/3/4/8/134895869/5208479.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403814/normal_5fcbe00758940.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zagubip/business_plan_template_for_nonprofit.pdfIn PDF document text
    • https://315736c7-1030-4200-8d24-05c9f4951019.filesusr.com/ugd/d19ca0_1b1dc8eeb25844f586f14a0ec3be32b6.pdf?index=trueIn PDF document text
    • https://04a80c79-134c-446e-801b-0c1635678e59.filesusr.com/ugd/5cebf8_5f526dd625754136884491a2e9d8a77c.pdf?index=trueIn PDF document text
    • https://28481333-1ef2-46fb-8ebf-d56c3f24acbc.filesusr.com/ugd/314c35_d48c4520a37047d3a0e6990ce8ad7763.pdf?index=trueIn PDF document text
    • http://pagovogezafub.rf.gd/poxijogurezukotanon.pdfIn PDF document text
    • https://s3.amazonaws.com/nosepevozux/google_sheets_single_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/kisimujuk/brinkmann_flashlight_manual.pdfIn PDF document text
    • https://2a009ac4-5770-49f2-ae16-4ce107243443.filesusr.com/ugd/59deca_bb1d5734dbe24b9294a54e741a11ee50.pdf?index=trueIn PDF document text
    • https://777dd155-384c-4f1d-a337-8f27b94bb056.filesusr.com/ugd/1ecdae_06d9f4d484a2434fad54fd7fb62df8c8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fikuvine/houston_police_report.pdfIn PDF document text
    • https://s3.amazonaws.com/lizuseguwix/64125441156.pdfIn PDF document text
    • https://s3.amazonaws.com/gimufesajo/broan_range_hood_light_bulb_cover.pdfIn PDF document text
    • https://s3.amazonaws.com/meludav/update_ti_84_plus_c_silver_edition.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2A0 5400 bytes
SHA-256: 5ca8fd2e20cba86341bc397609cc9e81ead3e3c61c2ccd00b6bd5af91d8a79ed
font_01_sfnt_off000104ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104CE 9768 bytes
SHA-256: 187052d5a63e42b2660f873d9478823381137ca7e2d30a8f62cf878b7ed22604

Open this report in the interactive analyzer, or submit your own file for analysis.