Malicious PDF — malware analysis report

Static analysis result for SHA-256 c06b975a5b68ca96…

MALICIOUS

PDF

78.7 KB Created: 2021-04-02 22:28:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4b0d11c903d32b88a587ccd4c4206a93 SHA-1: 741511f7c03e4cfd9fc005d829b6545fed7a79ed SHA-256: c06b975a5b68ca96ed90d0d5fa14c6078c4768bac82ffc3e85984e6ce74cd405
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including ClamAV and an ML classifier, indicating a phishing or malicious link distribution scheme. The PDF contains a large number of external links, suggesting it is part of a link farm designed to manipulate search engine results or direct users to malicious sites. No scripts were extracted, but the presence of numerous external URLs is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=batman+and+robin+parents+guide
    • https://bivesazi.weebly.com/uploads/1/3/4/6/134652180/ebf3e26fe.pdf
    • https://cdn.sqhk.co/vekasurox/Vjjgcs1/android_mobile_latest_ringtones_free_download.pdf
    • https://dopakuxapat.weebly.com/uploads/1/3/4/8/134895633/4410768.pdf
    • https://cdn.sqhk.co/bunigenozav/dYghcn5/jelly_youtube_subscriber_count_live.pdf
    • https://sumeropesoxiv.weebly.com/uploads/1/3/5/3/135316328/1729317.pdf
    • https://gifenatewa.weebly.com/uploads/1/3/4/4/134480542/kimumute_nexufe_rogikewibo_nozug.pdf
    • https://tetoxoji.weebly.com/uploads/1/3/0/9/130969306/dilipogu-pofovawum.pdf
    • https://kogozodibivuf.weebly.com/uploads/1/3/6/0/136094397/wuwosipunuf.pdf
    • http://kimujedat.mygamesonline.org/how_to_work_to_stop_human_trafficking.pdf
    • https://cdn.sqhk.co/gulizate/8Wjajj2/dodolenepagozovapug.pdf
    • https://xunitumewotoril.weebly.com/uploads/1/3/4/6/134612341/korol.pdf
    • https://cdn.sqhk.co/rutisifelom/EbDkihm/vesafupajivebufuvavenowe.pdf
    • https://gikudinok.weebly.com/uploads/1/3/4/7/134730402/molip.pdf
    • https://muberelikaxisax.weebly.com/uploads/1/3/1/1/131163953/24f16302724e.pdf
    • https://bitokulizawefe.weebly.com/uploads/1/3/4/6/134684274/lizadadak.pdf
    • http://jerimujolegem.medianewsonline.com/malaria_microscopy_quality_assurance_manual.pdf
    • http://vajukadezazi.getenjoyment.net/bsc_nursing_entrance_exam_paper_2020.pdf
    • http://zujewubowufonug.scienceontheweb.net/mitunetopisasesat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2a4065d7-883d-43e8-a524-7ce9aa4b4e88.filesusr.com/ugd/ccb1c6_4b2393c865964a0a822b4626e4fc9855.pdf?index=true
    • https://uploads.strikinglycdn.com/files/93688dd4-1b80-463f-b8c2-3c166b7cd06e/visus.pdf
    • https://uploads.strikinglycdn.com/files/6efa42a3-b1d1-4899-a4c8-385b2a1119ca/vinabelo.pdf
    • https://uploads.strikinglycdn.com/files/6e5e94e2-b018-4434-9b4a-f0fa8cea3748/28286511221.pdf
    • https://uploads.strikinglycdn.com/files/23dcedec-6b44-4009-be83-49fd3bf4fe50/didavaxa.pdf
    • https://ce55c564-0e79-48ac-bd91-a034cff8554b.filesusr.com/ugd/bd1fc0_dd15832064744db692efb8844c44df89.pdf?index=true
    • http://taberadajip.atwebpages.com/acta_constitutiva_de_una_asociacion_civil_en_mexico.pdf
    • https://uploads.strikinglycdn.com/files/fb4437ff-630e-49b1-8586-a820ff15fe86/how_to_playing_record_player_through_speakers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f41f.bin
763858a4b8d566f92b90e3d178019533c1ec9f9067027265c426cebde57b6a69		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF41F 5436 bytes
font_01_sfnt_off0001067f.bin
69b3b5cec6b8cdb9732aabf9934867bb383cf1c335c1bc3e55a203bf5aaa985e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1067F 11340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.