Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3cee16f76801baf…

MALICIOUS

PDF

76.9 KB Created: 2021-04-08 09:36:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4f46fec85aa2c853adab7cfe95b51f7 SHA-1: b44f00a8d1bf57c7ff544fc14109f3c5f73ccf8b SHA-256: c3cee16f76801baf8e1fa5179171c33c6c3376d6ec60de6b5fb25bcd61e0540c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are dynamically generated and point to potentially malicious content, as indicated by the 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' heuristics. The ClamAV detection further confirms its malicious nature. The primary attack pattern involves directing users to a network of websites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=halted+stream+camp+iron+ore
    • https://cdn.sqhk.co/mewixamok/DhbgdPV/all_star_soccer.pdf
    • https://cdn.sqhk.co/modesinilofe/jd9Siff/shiny_breeding_guide_sword_and_shield.pdf
    • http://copyright-security-ig.com/rabufokugiwepafotudogu434ll.pdf
    • https://fiduludebiwoki.weebly.com/uploads/1/3/4/3/134317875/60026adaf7.pdf
    • https://rakonudiboxenej.weebly.com/uploads/1/3/4/8/134874851/litevusukozelifib.pdf
    • http://giocodigital.fun/free_lds_sheet_music_vocal_solot3hdf.pdf
    • https://cdn.sqhk.co/kinifukix/DAjegiZ/management_guidelines_for_penetrating_abdominal_trauma.pdf
    • https://mosuvixixe.weebly.com/uploads/1/3/0/9/130969854/kosimub-zigelojewili-jezejujif.pdf
    • https://cdn.sqhk.co/molodomo/j2n0geB/9747349685.pdf
    • http://nikaold.site/revedifarexezektov.pdf
    • https://cdn.sqhk.co/rekosiseweno/Jrjeytk/70240798205.pdf
    • https://cdn.sqhk.co/zipaduteki/c5z0Yic/cars_for_sale_under_3000_facebook.pdf
    • http://arenda-comp.space/67140347084253ty.pdf
    • http://poverkavoda.website/forbes_travel_guide_quotesr268m.pdf
    • https://jejavogizapivi.weebly.com/uploads/1/3/5/3/135388932/15cf7778b2c.pdf
    • https://cdn.sqhk.co/dewufidabo/ohd7Azy/descargar_dinosaur_hunt_shooting_games.pdf
    • https://cdn.sqhk.co/rubekafux/j0T0Pif/52971845198.pdf
    • https://dosijusesuxola.weebly.com/uploads/1/3/4/3/134305349/ece885d438e.pdf
    • https://cdn.sqhk.co/xamitarerivu/ix4NGUk/can_you_escape_adventure_room_level_9_solve.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1cdd1dcb-54a5-4750-95ad-c4cce9a68cd1.filesusr.com/ugd/1e32c2_1bce777ee66f408bbd2f5f45d038eb29.pdf?index=true
    • https://d6477b75-8e4d-4453-8bbc-a86a6009e57c.filesusr.com/ugd/261d41_7de7bf34c51940909591879d113fc972.pdf?index=true
    • http://posugez.epizy.com/visual_identity_system.pdf
    • https://7c8f45b7-e058-4e27-bccd-8ee7dcb26900.filesusr.com/ugd/d5cf39_3978a3c7ba9940a1ac00ac103b182b9f.pdf?index=true
    • https://167c8e7b-8160-49a2-a88e-f26749d647c8.filesusr.com/ugd/1ad47d_40ec82f833564ec4b451a57d3fefc03c.pdf?index=true
    • http://nobosatif.epizy.com/rerojinukagare.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec6a.bin
ebad14ca94f633f735f077ed391dc18db3489ba354db2679330df278d50cf642		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6A 5180 bytes
font_01_sfnt_off0000fdec.bin
0e2fe7ee66c9a6de57de2ee5efe1e0dff5151cc07f7ee4f460f91be43d846bd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDEC 11596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.