Malicious PDF — malware analysis report

Static analysis result for SHA-256 c40c08808cca3a31…

MALICIOUS

PDF

69.4 KB Created: 2021-02-22 11:05:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-03
MD5: f29f5a2773114708365c79cb6f26a9ac SHA-1: dfc46d8ff04055c12f5bd2628f9d44c5798cfc98 SHA-256: c40c08808cca3a314d7c717dd02e72e40abd400c3dfa6f29c2aff63fedc48085
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML classifier and ClamAV detection strongly indicate maliciousness. While no scripts were explicitly extracted, the presence of numerous external URLs points towards an attempt to redirect the user to potentially malicious sites, possibly for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=samsung+q7+55+wall+mount PDF link annotation
    • https://bigifami.weebly.com/uploads/1/3/1/4/131407708/ba234cd819.pdfIn PDF document text
    • https://todilotifobaw.weebly.com/uploads/1/3/2/7/132712516/tikakusadime-tamumeditev.pdfIn PDF document text
    • http://soinjaga.ru/how_bad_can_i_be_but_screaming_the_lyricscagrd.pdfIn PDF document text
    • https://foxewazijibaj.weebly.com/uploads/1/3/1/3/131379544/6854126.pdfIn PDF document text
    • http://themarkuzmusic.com/ct_guided_sacroiliac_joint_injection_technique4yz0n.pdfIn PDF document text
    • https://rokojilezel.weebly.com/uploads/1/3/2/3/132302907/nuvifet_kotopon.pdfIn PDF document text
    • https://fidimamafiw.weebly.com/uploads/1/3/4/6/134624465/3a56d5037a0.pdfIn PDF document text
    • https://kikosizijup.weebly.com/uploads/1/3/1/3/131379594/9843921.pdfIn PDF document text
    • https://dujuwugad.weebly.com/uploads/1/3/4/7/134721680/c36e92d6d.pdfIn PDF document text
    • https://cdn.sqhk.co/takularozo/ciaibJ9/walkthrough_for_human_fall_flat_tips.pdfIn PDF document text
    • https://cdn.sqhk.co/wajuletixex/hfgjhar/penguin_runner_next.pdfIn PDF document text
    • https://fasuwilobavofe.weebly.com/uploads/1/3/4/4/134489762/rijiwuse-bixirufobunaliv-xelagaram-woxodavikuje.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xukonakefules/laxmi_aarti_song_pagalworld.pdfIn PDF document text
    • https://s3.amazonaws.com/biwubeleba/embed_report_server.pdfIn PDF document text
    • https://s3.amazonaws.com/kiremefegonar/clavier_arabe_keyboard_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/zebarufuridorur/7276171927.pdfIn PDF document text
    • https://s3.amazonaws.com/bewibiwat/fomoxulewugosudozixomow.pdfIn PDF document text
    • https://s3.amazonaws.com/pogolo/tigoriviwot.pdfIn PDF document text
    • https://s3.amazonaws.com/ritoma/breaker_mitsubishi_catalog.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF27 5432 bytes
SHA-256: a7011de094364e1683224b928372bfc1d760ee498979c84bf2e17ee5f7ffe3ec
font_01_sfnt_off0000e1ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1AD 11528 bytes
SHA-256: 6e0f47fc11fea902848deb484ed5a883e1f4dae4e032af78846f0b0fee0c2bc6

Open this report in the interactive analyzer, or submit your own file for analysis.