Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1f5bc2bf2808678…

MALICIOUS

PDF

72.8 KB Created: 2021-04-09 03:33:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92503e2e40d6c92cc2d0c9a494ea43b1 SHA-1: ab133fadabf782281a138d0badab77459d54030f SHA-256: c1f5bc2bf2808678a0b603c88158f6c49d3929d98ead0f7359fa455ef5b2b412
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many pointing to PDF files hosted on file-sharing services, indicative of a link farm or SEO poisoning tactic. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically identified as phishing or a trojan. While no scripts were explicitly extracted, the PDF structure and numerous external URLs suggest it's designed to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=vistas+5th+edition+book
    • https://vafunaparixidi.weebly.com/uploads/1/3/4/6/134627598/dedewirotutedo.pdf
    • https://cdn.sqhk.co/dopebuxoz/2zZ0jhb/mubetugapizisuxadudit.pdf
    • http://hytri.com/metformin_hcl_1000_side_effectshv8yf.pdf
    • http://complerbnp.com/whatsapp_messenger_apk_for_jio_phone24d55.pdf
    • https://mofizuzu.weebly.com/uploads/1/3/4/3/134316779/fexogi_giwevafalu_vobopivirolak_lefanetomejibuj.pdf
    • https://majijajivetik.weebly.com/uploads/1/3/4/2/134265766/dd5bbb508fb.pdf
    • https://cdn.sqhk.co/lomasamube/zqgejad/stylish_fonts_app_download_uptodown.pdf
    • http://netewe5.xyz/43614117066htttc.pdf
    • https://kasewipiliri.weebly.com/uploads/1/3/4/9/134901701/db49b0fab95.pdf
    • https://cdn-cms.f-static.net/uploads/4422382/normal_6064b17e2bc27.pdf
    • http://teagreen.space/xamivogc9qxb.pdf
    • http://cybety.xyz/your_grace_is_enough_chords_no_capo66s7u.pdf
    • https://static.s123-cdn-static.com/uploads/4386607/normal_6008cd82219bb.pdf
    • https://cdn-cms.f-static.net/uploads/4386337/normal_5fe969d6171e9.pdf
    • https://cdn-cms.f-static.net/uploads/4412780/normal_606a424f3197d.pdf
    • https://static.s123-cdn-static.com/uploads/4462046/normal_5fc7ad5c39a9e.pdf
    • https://vumerajijo.weebly.com/uploads/1/3/2/8/132815742/0caf56.pdf
    • https://cdn.sqhk.co/korebuxaguz/hrjf3by/61799592727.pdf
    • https://cdn.sqhk.co/vokipidelad/Kphb2ib/buredunumuduxebusite.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nigugolesaxof.rf.gd/discovering_french_nouveau_blanc_textbook_answers.pdf
    • http://sotivefebaxo.epizy.com/realtek_high_definition_audio_driver_win_10_hp.pdf
    • https://780c8f77-0f51-49ab-8dd1-60a90eb210a4.filesusr.com/ugd/1b8612_05cdabcea5c44075a3611a60af4610b0.pdf?index=true
    • https://5e9c932d-19a8-4d5a-a970-d4bc0bcb832b.filesusr.com/ugd/bae0a0_319f5331147f4afbbffb8b684c6f187a.pdf?index=true
    • https://832c8a8d-f05d-46e3-9166-97d9de82ace4.filesusr.com/ugd/432509_a3ee3c563f8b4beea6375e9b0d9b2fcc.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbd4.bin
05ca825af77b5f01c45627cf8d15dbddb8e2a9f047f42b1ef16bd5a7c0d146da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBD4 5076 bytes
font_01_sfnt_off0000dd1b.bin
6e6cc8faa0b01c48f1582b63f45ac58c542795cc7f36cb444751721218cccb28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD1B 10312 bytes
font_02_sfnt_off00010051.bin
29b8095464fa9501f2379a4c43ca3ba1b1df604f87f2abcbe11fa9bdafb8ec10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10051 16084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.