Malicious PDF — malware analysis report

Static analysis result for SHA-256 c290c702c77d9c32…

MALICIOUS

PDF

83.6 KB Created: 2021-03-19 14:33:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 274945e5f7f254bf71f5a9c054ffc7f3 SHA-1: 7bd30d03550f856f4db02910992c0bf5ca8f69c6 SHA-256: c290c702c77d9c32e743d7594bc662fcb624b7f111a135d061caa750c4ef1743
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF_SEO_LINK_FARM' pointing to 'http://godidab.epizy.com/acoustica_mixer_free_cnet.pdf'. The ML classifier and ClamAV detection strongly indicate maliciousness, classifying it as a phishing trojan. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristics suggest a phishing or malware distribution attempt, likely using a spearphishing attachment vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=bsc+nursing+2nd+year+syllabus+2020+pdf
    • https://static.s123-cdn-static.com/uploads/4464082/normal_60081aad076f6.pdf
    • https://cdn-cms.f-static.net/uploads/4461497/normal_603f2a276b2c2.pdf
    • http://pozarekape.iblogger.org/what_is_the_difference_between_fiqh_and_usul_fiqh.pdf
    • https://cdn-cms.f-static.net/uploads/4421473/normal_5fd94066004df.pdf
    • https://zepinimokibe.weebly.com/uploads/1/3/4/3/134373719/pexuxutigelaf_jimovaxuxusazu.pdf
    • https://nizakibete.weebly.com/uploads/1/3/4/3/134386075/7643866.pdf
    • https://rikekipodoze.weebly.com/uploads/1/3/0/7/130776447/milogizuwol_sujome_xevunofawedote_fozixezusibu.pdf
    • http://kiruvoxexuk.iblogger.org/tabela_de_nomenclatura_da_ordem_dos_mdicos_dentistas.pdf
    • https://bapefakujina.weebly.com/uploads/1/3/4/4/134483882/2806938.pdf
    • https://static.s123-cdn-static.com/uploads/4472486/normal_6004fa6f382c6.pdf
    • https://maninidepot.weebly.com/uploads/1/3/4/7/134702581/ginewukoz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://godidab.epizy.com/acoustica_mixer_free_cnet.pdf
    • https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_f9444033024849aba08509cfa79167d6.pdf?index=true
    • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_13b722940e464db0a91b7b99357bb8f7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/01590577-b1f8-46b4-b05e-e00a13f60457/59413838167.pdf
    • https://uploads.strikinglycdn.com/files/730e8adc-4508-4ff5-871e-7abb9c7aaacd/ropemupujozidejil.pdf
    • http://jozazumuluvos.epizy.com/arcane_trickster_5e.pdf
    • https://aa4de0c4-a7fb-47f6-97fe-5721705e71c1.filesusr.com/ugd/824332_58c6014939e04c87af329f5e1a4d8af9.pdf?index=true
    • https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_030e39e7e4574a3bbefbea0f2d81a9fb.pdf?index=true
    • https://cf2e1f24-e5f1-4289-9567-3affce9c164e.filesusr.com/ugd/a4ea6c_e9ad9d757b264ef4800d9a72f30f3c9e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/54cdcf20-3708-4c27-b4e6-6ca919953c1d/66191384709.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb66.bin
1d7e7f0ecafeb8fcdd13430c23d370270fbb083c066aecb0f8c6833e8079a423		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB66 5580 bytes
font_01_sfnt_off00010e60.bin
d87db4bb6a2ec0f69c7f0dc5408a939dacbc545603ed50a40cc3bde9145b86c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E60 10944 bytes
font_02_sfnt_off00013325.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13325 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.