Malicious PDF — malware analysis report

Static analysis result for SHA-256 c098f17b741437ba…

MALICIOUS

PDF

78.8 KB Created: 2021-03-24 08:58:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb4d926993d6fa71651082ea32b4f10a SHA-1: 7c41f41c77b2c2e5e6b0bffb8847fbfc07d32e73 SHA-256: c098f17b741437ba1ec4a138d02e24629ed3f9db3614d3e65d3ea3db3d37bb19
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a malicious SEO link farm, as indicated by the PDF_SEO_LINK_FARM heuristic and the presence of numerous external URLs. The primary intent appears to be directing users to a collection of other PDFs, potentially for traffic generation or further malicious distribution. While no scripts were directly extracted, the nature of the link farm and the ClamAV detection suggest a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=holley+manual+choke+kit+install
    • https://cdn.sqhk.co/tavevalurov/fQgiWia/all_football_live_scores_now.pdf
    • https://cdn.sqhk.co/taxuvoguraji/c0heTfW/advances_in_genetic_programming.pdf
    • http://malalefapop.22web.org/58284654253.pdf
    • https://cdn.sqhk.co/japewaturu/bD0jd7S/25100910152.pdf
    • https://cdn.sqhk.co/debefuki/iigiphc/spades_plus_app_not_working.pdf
    • https://cdn.sqhk.co/vuwewiwudesi/cOgi1hd/uk_small_business_continuity_plan_template.pdf
    • https://cdn.sqhk.co/gimovitax/iimjac2/puronodimuxogol.pdf
    • https://cdn.sqhk.co/wofikubid/Z4jjrha/15864974628.pdf
    • https://cdn.sqhk.co/vugiboba/hhc7geH/yeezy_700_v3_arzareth_glow_in_the_dark.pdf
    • https://cdn.sqhk.co/korulifesewa/nbwcIjf/xuzowupexikizoxezuzod.pdf
    • https://cdn.sqhk.co/xogeloke/ije2pjt/kiki_s_delivery_service_cosplay_wig.pdf
    • https://cdn.sqhk.co/tipusuzog/geja2ig/xekimewixejabesax.pdf
    • http://donuliwobem.iblogger.org/misubeginurutunebiteku.pdf
    • https://cdn.sqhk.co/sojowidaz/gy8Yfic/7585056827.pdf
    • https://cdn.sqhk.co/welosezu/jiavajd/singapore_osteoporosis_guidelines.pdf
    • https://cdn.sqhk.co/xejadukoxeta/gdhdP6R/66146135496.pdf
    • http://gunodopo.22web.org/29111281967.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wiwafejopof.epizy.com/autodesk_simulation_cfd_tutorial.pdf
    • https://0c17d2ad-06a2-4efd-9128-26148cac6670.filesusr.com/ugd/44320b_1d868ca7fb8c4f29876dc3d5e607f56a.pdf?index=true
    • https://97d49ff2-d914-4ae4-8ac8-5e5cf5f77cad.filesusr.com/ugd/6350c7_bbf4f4e2d21e404e816b4f63e40d1c17.pdf?index=true
    • http://wivifizurata.epizy.com/cbi_shankar_kannada_movie_video_songs.pdf
    • http://bevejege.rf.gd/juramopadozadizodivufup.pdf
    • http://pebulibupa.rf.gd/aashiqui_3_song_video.pdf
    • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_bb16a4bad51245e68d3b5a66e0a0b44e.pdf?index=true
    • https://5d3a3edc-1384-4eb0-a354-174dd54c13aa.filesusr.com/ugd/7f5dc5_033217051bd24623b7cb85fbf46fd6d2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea37.bin
788b91480e3f563489e9c5e83e896597f8c27294fc166e31b1edeadc58a8e88a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA37 4952 bytes
font_01_sfnt_off0000fae0.bin
0fdfc0475db0fdfe57cd42ed8f8df101fc312aa95e8768fc6485e96baefd81b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE0 10656 bytes
font_02_sfnt_off00011f74.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F74 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.