Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1123a20e7fc8cbc…

MALICIOUS

PDF

86.9 KB Created: 2021-03-08 16:56:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 735d037d63a6b97a0eb1013ff89a37c5 SHA-1: 53d05a5ab1a86f7b49d12442a18deaf18e7079d9 SHA-256: c1123a20e7fc8cbc075db374a23482e6aee29e575517f882931c6b159d3e1fde
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a lure related to a PS4 update, directing users to a suspicious URL. The presence of a large number of external links and a high ML classifier score indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the document structure and embedded URLs strongly suggest a malicious campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=update+file+cannot+be+used+ps4+6.50
    • https://cdn-cms.f-static.net/uploads/4444644/normal_601f23aae72b1.pdf
    • https://cdn-cms.f-static.net/uploads/4460682/normal_6022f6b485919.pdf
    • https://cdn-cms.f-static.net/uploads/4413223/normal_601dbb262eaad.pdf
    • https://static.s123-cdn-static.com/uploads/4470821/normal_6006ab6b62f03.pdf
    • http://hotel-engels.ru/synonyms_and_antonyms_tricks_in_hindipbhp6.pdf
    • https://static.s123-cdn-static.com/uploads/4444102/normal_5ff45489435ad.pdf
    • https://cdn-cms.f-static.net/uploads/4465144/normal_6029df38e32e2.pdf
    • https://cdn-cms.f-static.net/uploads/4368759/normal_6041b121c8c81.pdf
    • http://helpcenterbusiness.xyz/what_is_the_best_20_hp_outboard_motoryfjuo.pdf
    • https://cdn-cms.f-static.net/uploads/4448731/normal_5fda2f03ca71c.pdf
    • https://static.s123-cdn-static.com/uploads/4413122/normal_5fe0bb0a7065b.pdf
    • http://ledimpress.biz/55168877596l1maz.pdf
    • http://logoped-samara.ru/excel_print_to_landscapeo7t2k.pdf
    • https://static.s123-cdn-static.com/uploads/4409394/normal_5fcafb35275b1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6255000b-a056-4af1-8d4a-ae8a0cacee76/live_action_role_play_mental_health.pdf
    • https://s3.amazonaws.com/muxegeza/educators_guide_to_the_mtop.pdf
    • https://uploads.strikinglycdn.com/files/e3ca62bc-9c63-4779-bcb7-a0982736f14d/how_to_deactivate_rosetta_stone_account.pdf
    • https://uploads.strikinglycdn.com/files/7fa631cc-0da2-43d8-bbc1-5fc80288848a/weber_spirit_2_grill_3_burner.pdf
    • https://c0cead0d-5248-483d-940e-95cc3acd9bde.filesusr.com/ugd/20d83a_594ee5662c1a4ccf8bbe077e085681f8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/401bec56-e4ca-4c80-a47c-dda1671cd957/supowinazab.pdf
    • https://s3.amazonaws.com/viwoxuz/game_dev_tycoon_guide_wikia.pdf
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_618779d29e7440d9983a7e263eaf294a.pdf?index=true
    • https://c480cc3d-c044-45b7-a7fa-747782367dcd.filesusr.com/ugd/a26f59_19ec57a0b2414f708fe0d0b5d86c7bdc.pdf?index=true
    • https://uploads.strikinglycdn.com/files/24df5f1a-20f0-4cf6-bcf9-e654e1670d32/amharic_bible_commentary_download.pdf
    • https://48cc712b-de5e-493e-a198-f8962849e22b.filesusr.com/ugd/d2751c_ca8f1c80cbf74b54bbe504a94bfc7cdb.pdf?index=true
    • https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_81b0d573029c49d1b84a064509a26bb1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011620.bin
8fff0ef5cea7b0af3c08c99df7fba1c477381ebb2e7a5b85d75988f7b3c22738		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11620 5724 bytes
font_01_sfnt_off000129c3.bin
8b883e02e5a5ad38c39d72a8bc64c038f33df0451e24590218695eb9dbe0f608		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129C3 10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.