Malicious PDF — malware analysis report

Static analysis result for SHA-256 bff8566adce995f1…

MALICIOUS

PDF

78.6 KB Created: 2021-04-13 09:12:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: daa0f1d6a7bad4913d6ca3b44fcb0d2f SHA-1: 63bdf977d25c45c2b0125ae08687e1815a3d361a SHA-256: bff8566adce995f1d454e5746419614feb4a0b90febaa6cca4c6d511ab365716
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, with several pointing to unknown or potentially malicious domains, suggesting a link farm or redirection scheme. The presence of PDF_SEO_LINK_FARM heuristic further supports the idea that the document is designed to drive traffic to external sites, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=ford+borg+warner+4+speed+transmission+identification
    • http://xirapanagix.getenjoyment.net/annexure_d_for_passport.pdf
    • https://static.s123-cdn-static.com/uploads/4493545/normal_5ffe6f6f84ed3.pdf
    • http://tegisuro.22web.org/conductive_materials.pdf
    • http://gugolufixa.mywebcommunity.org/eight_days_a_week_tab.pdf
    • https://miremawa.weebly.com/uploads/1/3/4/6/134631892/runobinidugowuzagib.pdf
    • http://kilidivofafo.iblogger.org/zimiboruburerogutudujo.pdf
    • https://veralekixa.weebly.com/uploads/1/3/1/0/131069874/zubezijisozow-biziwobumoxuse-vozuxozerukole-funofajogavibu.pdf
    • https://vamawawu.weebly.com/uploads/1/3/0/8/130874524/1084170feb8.pdf
    • https://cdn-cms.f-static.net/uploads/4414867/normal_605d59cde5b0a.pdf
    • http://vegoletox.medianewsonline.com/zezuruperutoko.pdf
    • https://cdn-cms.f-static.net/uploads/4410962/normal_6038ba8447536.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/60c72c2e-cedd-4ec2-9479-dc365acfc094/xanathars_guide_to_everything_racial_feats.pdf
    • https://uploads.strikinglycdn.com/files/b6bd22d4-4da8-48ae-a575-ad5eb76632e0/kabuwubakak.pdf
    • http://simipibenafar.epizy.com/national_anthem_of_pakistan_with_lyrics.pdf
    • https://uploads.strikinglycdn.com/files/61e64591-35b3-4ee2-925f-ec82d8c7ded5/mississippi_drivers_permit_test_2020.pdf
    • http://pakefuvusenoz.rf.gd/titulo_de_credito_oq.pdf
    • http://widifusi.myartsonline.com/gatabodumiboletaw.pdf
    • https://uploads.strikinglycdn.com/files/5b39f6bc-cdb8-436e-8c6f-753236161a1e/70551838879.pdf
    • https://uploads.strikinglycdn.com/files/96494bbb-0a60-4f56-a909-4b6f798bcabc/15972628477.pdf
    • https://uploads.strikinglycdn.com/files/4601b14b-e383-4197-aeb8-8cbfd4e0f439/ratafabudufifabepewep.pdf
    • https://uploads.strikinglycdn.com/files/65fb19c3-b84b-4c00-b12a-198ab66f87af/dudubixo.pdf
    • https://uploads.strikinglycdn.com/files/8a049625-bdd1-4c6e-86d8-6b406e01b925/manirezewizadelo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5e0.bin
f8a4a43e62bd6f4043b55b344929f66d73a8b988365d7c5f79301868cf2d3bf8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5E0 5720 bytes
font_01_sfnt_off0001095f.bin
2f3e582b064c9892843a07a4183f38093f4cd75401c37108fc78e0ac8fe19012		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1095F 10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.