Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf67a9d8a6a048e4…

MALICIOUS

PDF

81.7 KB Created: 2021-04-01 00:43:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 85869f29452e6301b832687586e48dd8 SHA-1: 1c7f276d585da329dc95b5c969442306bbec93b6 SHA-256: bf67a9d8a6a048e41626ef16a047dff19d6dc9c6e33bc9234bacd4a8ca942cfd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm designed to distribute other PDFs. The document body, though heavily obfuscated, suggests a lure related to 'assessment answers'. The presence of external URIs and the link farm heuristic strongly indicate a phishing or malware distribution attempt, likely leveraging spearphishing attachments as the initial access vector. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=level+2+bksb+english+diagnostic+assessment+answers PDF link annotation
    • https://gokatejasefe.weebly.com/uploads/1/3/4/6/134650338/98759f61e.pdfIn PDF document text
    • http://rowaxuxot.22web.org/examples_of_comments_for_kindergarten_report_cards.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450730/normal_6052f1430d4a4.pdfIn PDF document text
    • http://kowezuzapine.66ghz.com/how_do_i_reset_the_icemaker_on_my_samsung_refrigerator.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410976/normal_601be673e9a37.pdfIn PDF document text
    • https://lolemifazez.weebly.com/uploads/1/3/1/8/131871650/nigorijifonikatopow.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403689/normal_602695c4ac938.pdfIn PDF document text
    • https://tugemizibu.weebly.com/uploads/1/3/0/7/130739278/1190460.pdfIn PDF document text
    • https://tekuxarutupun.weebly.com/uploads/1/3/0/7/130775258/bde199edf5a.pdfIn PDF document text
    • https://gidixolatuloxag.weebly.com/uploads/1/3/1/0/131071157/texixakunukofilede.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415321/normal_602fbff15010a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390371/normal_5fe2d8892adca.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gozifep/dukogujixiw.pdfIn PDF document text
    • https://s3.amazonaws.com/tevomenil/wovawitatugasitanewamet.pdfIn PDF document text
    • https://s3.amazonaws.com/saxefi/vusigili.pdfIn PDF document text
    • https://s3.amazonaws.com/tarajix/80794522921.pdfIn PDF document text
    • https://s3.amazonaws.com/defipedibe/endocannabinoid_system.pdfIn PDF document text
    • https://a8fdb364-3865-4521-a36b-e12f4de7752f.filesusr.com/ugd/e20637_63a626ec3fff4483818962bf290aaedb.pdf?index=trueIn PDF document text
    • https://aa700e4b-9450-4a85-8b7e-8c92ffe47626.filesusr.com/ugd/de972d_8253e2731e0940a2bb94b9bf7cd7a94e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wuzalugiseto/are_all_coroners_reports_public.pdfIn PDF document text
    • http://joxepivebafugig.epizy.com/agricultural_machinery_and_equipment.pdfIn PDF document text
    • http://getijus.epizy.com/83895472604.pdfIn PDF document text
    • https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_8bb14bae84d24cb5a7ff2b01019eea25.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nuvukivaxiren/gozolimuputupikiso.pdfIn PDF document text
    • https://d4a58959-25bc-41ae-a48c-99f47e3c4711.filesusr.com/ugd/4dab1e_c5afb54cb5cb47eea33a21bd469544c3.pdf?index=trueIn PDF document text
    • http://rozejogore.rf.gd/warlock_5e_patrons_great_old_one.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010026.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10026 5784 bytes
SHA-256: 4507345c2ebb6245764c414a3f282a5abf348e250a759589ef9f0b7e6dafced1
font_01_sfnt_off000113c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113C5 10844 bytes
SHA-256: 0edf6454e6462a081a72f17755cb7d088924686723e8c68bfa32ccfa59bda5e6