Malicious PDF — malware analysis report

Static analysis result for SHA-256 bff413d19debac20…

MALICIOUS

PDF

75.4 KB Created: 2021-03-31 06:50:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11a783a026801246ae43738d7ff768ad SHA-1: dff21b30cc302ca4e7560e6b0754218673539ea3 SHA-256: bff413d19debac20fcdb2b055433a4842edba0ed8724780ce99e39415b6f7fcd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are dynamically generated and point to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The primary URL suggests a lure related to 'hubble telescope images pdf'. ClamAV detection and ML classification strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=hubble+telescope+images+pdf
    • https://cdn.sqhk.co/wadalibituge/jfcigw2/bimirunexumepamagik.pdf
    • http://center-about.com/when_is_ps5_coming_out_in_canadacc6bc.pdf
    • http://uspehdnyaaxyz.xyz/algebra_solving_equations_answerszfdez.pdf
    • https://cdn.sqhk.co/xexanodu/jFjcxYG/coffin_dance_meme_song_remix.pdf
    • https://bufigolumixi.weebly.com/uploads/1/3/4/2/134234787/f2ee64a2e946d.pdf
    • http://hookup153.fun/glory_ages_samurai_mod_apk_201977iug.pdf
    • http://nasty666.space/smashy_road_arena_apk_modc4zet.pdf
    • https://cdn.sqhk.co/letarezetap/Cm9jfWu/13324013923.pdf
    • https://cdn.sqhk.co/wosinuwukabu/HjapX4o/hindustan_aviation_academy_bangalore_application_form.pdf
    • https://cdn.sqhk.co/tobijoge/Fjhjjge/action_heroine_cheer_fruits.pdf
    • https://wibizoginoj.weebly.com/uploads/1/3/2/6/132681485/0fc5d20.pdf
    • http://peludofnor.fun/how_to_write_copperplate_calligraphy_alphabetj1phf.pdf
    • https://xalifabosivibu.weebly.com/uploads/1/3/0/7/130775217/boviki.pdf
    • https://lofokuvowuvi.weebly.com/uploads/1/3/4/3/134362742/3214850.pdf
    • https://cdn.sqhk.co/ragonujip/mVALid5/lucky_dube_song_lyrics_the_way_it_is.pdf
    • https://nefolebar.weebly.com/uploads/1/3/4/4/134400051/1065200.pdf
    • http://nomanodix.iblogger.org/fezepapefifegaj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wesaloxovep.rf.gd/45409160846.pdf
    • https://s3.amazonaws.com/pusori/vidmate_er_old_version.pdf
    • https://s3.amazonaws.com/dutimajizowa/indirect_function_excel_different_sheet_sum.pdf
    • https://s3.amazonaws.com/sojuravewi/47968162683.pdf
    • https://s3.amazonaws.com/gazitif/archpaladin_quest_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e67c.bin
a7cb63c9ac82e0b3f539b860395f1b139425e569efbab86ccb86e57e6a562d67		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE67C 5480 bytes
font_01_sfnt_off0000f90a.bin
0a9ef13a4ddc9ed43815a9d88f82860eb9f3e3f3a2e63dab7e1a1b61b55f3ed3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF90A 11336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.