Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1837a0f5680f2c1…

MALICIOUS

PDF

120.2 KB Created: 2021-03-19 23:14:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: efc66f8f8bf8d4c028b2682b0921a22d SHA-1: 170a593afcea48f58623f7e151cc98dc817e7cee SHA-256: c1837a0f5680f2c1922fe2ef259861d40ea20c43ec13ec8938ed343c0fad0fa6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a phishing or SEO manipulation tactic. ClamAV and ML classifiers strongly indicate maliciousness, with a specific detection of 'Pdf.Phishing.Trojan'. While no scripts were directly extracted, the PDF structure and numerous external URLs point towards a malicious intent, likely to redirect users to phishing sites or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=adobe+premiere+pro+2019+tutorial+deutsch
    • https://cdn-cms.f-static.net/uploads/4406481/normal_6026a56e3bf53.pdf
    • https://cdn-cms.f-static.net/uploads/4369165/normal_604711bab1858.pdf
    • http://ruxuzosok.mywebcommunity.org/47350797887.pdf
    • https://suzonozumevudem.weebly.com/uploads/1/3/1/3/131379217/rujimabidatakinag.pdf
    • http://kobivoweder.mypressonline.com/basonaporunalu.pdf
    • https://xabisemegebo.weebly.com/uploads/1/3/4/4/134491474/sogedobepokes.pdf
    • https://kuburabet.weebly.com/uploads/1/3/4/3/134362545/1948851.pdf
    • https://cdn-cms.f-static.net/uploads/4417032/normal_60318c7a319dc.pdf
    • https://cdn-cms.f-static.net/uploads/4369936/normal_6049a5b3a1108.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gofiguj/50156816851.pdf
    • https://uploads.strikinglycdn.com/files/92e8e9e5-7de9-4bbb-93b6-434d478b37e1/kufuxipivevero.pdf
    • https://s3.amazonaws.com/muwemivumazulax/83406135567.pdf
    • https://uploads.strikinglycdn.com/files/7a27d548-dbdb-4147-8327-39e69b5ba0c8/powermatic_2_electric_cigarette_injector_machine_manual.pdf
    • https://s3.amazonaws.com/nakevoja/gapowasubiz.pdf
    • https://uploads.strikinglycdn.com/files/5545ac9c-f28e-4e1f-add0-30fd80113354/the_andromeda_strain_1971_full_movie_123movies.pdf
    • https://uploads.strikinglycdn.com/files/b306c128-9e40-4340-9762-704a94cbba1a/ninevimademedemeko.pdf
    • https://s3.amazonaws.com/jukezeluf/besiege_game_mac.pdf
    • http://lumosaneja.onlinewebshop.net/39427504240.pdf
    • https://s3.amazonaws.com/pesetufavo/kakaredanojukag.pdf
    • https://s3.amazonaws.com/vibasujefir/94098418410.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019582.bin
c7c479e417a7c281349c5a7f58aba219711bc2779c82e9234166ab3a98bf3517		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19582 5924 bytes
font_01_sfnt_off0001a976.bin
e8182df0890c4159d5f6b6e75043fd64745b153ac00acbe8c8a7651af8284395		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A976 12644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.