Malicious PDF — malware analysis report

Static analysis result for SHA-256 c26638dbeb27d1a6…

MALICIOUS

PDF

81.1 KB Created: 2021-03-29 14:19:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe729f54c27a714b2adccde817d02ccf SHA-1: d7a66d11c4ce0ea8360f803912e833a83c6ffa3c SHA-256: c26638dbeb27d1a6e4685cd477549cf7f93cd127f5d3ee596b11ac78e16dd5f3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by multiple heuristics, including a critical finding for a 'PDF_SEO_LINK_FARM' and ClamAV detection as 'Pdf.Phishing.Trojan'. The document contains numerous external links, with a primary suspicious URL being https://pelibifir.ru/award?keyword=the+theory+of+island+biogeography+book+pdf. While no scripts were explicitly extracted, the nature of the link farm and the phishing/trojan detection suggests an attempt to distribute malicious content or phish users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=the+theory+of+island+biogeography+book+pdf
    • https://cdn.sqhk.co/kutogudofi/aejhuDr/74543021071.pdf
    • http://honey-love.ru/rise_of_christianity_in_rome_worksheetumnfl.pdf
    • https://cdn.sqhk.co/sadirorig/EhcQiei/pogapijobelipirejidazaxuk.pdf
    • https://cdn.sqhk.co/madufuxenuw/jdILdjb/lefisujokotawon.pdf
    • https://cdn.sqhk.co/lerapuraroke/tjjDhiX/bedabupiruxotanadi.pdf
    • https://cdn.sqhk.co/pabelemusib/OibGifd/78367624038.pdf
    • https://cdn.sqhk.co/xusarukave/GjfRIvS/fl_mobile_drums.pdf
    • https://cdn.sqhk.co/nupodamukoji/Yhf9eiD/coin_master_daily_free_spins_link_today_haktuts.pdf
    • https://cdn.sqhk.co/famuxina/fgehghc/77547700675.pdf
    • http://segway-wheelchair.ru/kpss_matematik_zml_soru_bankasiap2k.pdf
    • https://cdn.sqhk.co/nugunexinazo/XkBjbPC/write_adobe_file.pdf
    • http://sberbank.services/54779186899dvc7u.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c631a38b-c62c-4b3f-b5ad-8fbefd6d92c2/62373337418.pdf
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_0063197e2be94b889c8c1bd103cc452b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9d52514d-cc80-4001-8c40-481889ca9446/enamorame_de_ti_seor_abel_zavala.pdf
    • https://c11ab09e-384c-4904-8c79-5ef6f38008df.filesusr.com/ugd/7131a6_2d106dabc6574431b5e278bd38c5b330.pdf?index=true
    • https://uploads.strikinglycdn.com/files/16f9acc2-ba80-46b7-93cc-4251f6d2fb33/how_to_program_universal_remote_to_sony_blu_ray_player.pdf
    • https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_9d1d12a68d094db3af6039a64a7b5bd5.pdf?index=true
    • https://1138278f-e8d0-45ef-aef3-dbdd7428ac52.filesusr.com/ugd/5be868_4d24d61bbcda47f38a646c3dff09ff52.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea2f.bin
6c997e5642b5c53670f93151c0c6f78822182022b531b51011d123c48d81cca7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA2F 5560 bytes
font_01_sfnt_off0000fd18.bin
5b4178c264ad142377af7a662eb3b0b113b460867c4f8ab1a8ddb2be2fd5c643		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD18 11288 bytes
font_02_sfnt_off000122d2.bin
d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122D2 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.