Malicious PDF — malware analysis report

Static analysis result for SHA-256 c485227618b361fd…

MALICIOUS

PDF

97.7 KB Created: 2021-03-20 01:26:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e92e7569f3867cbb6f76ad91013241cb SHA-1: 96763e3870f557364830bf26f03ddcb1936a93df SHA-256: c485227618b361fd3d7eb57a5ee97f4aa95bea629fb3b96e1e14451360c1d478
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified as a link farm, suggesting a malicious intent to redirect users to potentially harmful websites. The ClamAV detection and ML classifier strongly indicate this is a phishing or malicious document. While no scripts were explicitly extracted, the presence of embedded URLs and the PDF structure itself points towards an attempt to exploit users through external content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9968

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=cinderella%2527+s+sister+ost
    • http://xuxuxib.iblogger.org/35910443791.pdf
    • https://barurusijibipek.weebly.com/uploads/1/3/0/7/130740419/betere.pdf
    • https://fivefijoxiwu.weebly.com/uploads/1/3/1/4/131453543/vusix-tixiwa-dujozafesan.pdf
    • https://kowenijog.weebly.com/uploads/1/3/4/0/134096242/figojagizujofo.pdf
    • https://lewesasegejawu.weebly.com/uploads/1/3/5/3/135315787/9098081.pdf
    • https://tekeginisexufu.weebly.com/uploads/1/3/1/3/131381150/1465292.pdf
    • https://luroxonigin.weebly.com/uploads/1/3/1/4/131406321/6318307.pdf
    • http://viwimewi.22web.org/91806215662.pdf
    • https://sanokigoj.weebly.com/uploads/1/3/4/8/134863934/pilisob-divetil-bowobi-xeloredirumil.pdf
    • https://nopolojeg.weebly.com/uploads/1/3/5/3/135349815/05701d8529e4724.pdf
    • https://kiragidemi.weebly.com/uploads/1/3/0/7/130775435/wumewaxefuribo-wufojikusivoxi-zukitezebik-jabuxov.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • http://www.daltonmaag.com/
    • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_09f7db94c79448aa8631af94dd19eb9d.pdf?index=true
    • http://vubixegigag.rf.gd/jopuwotugigon.pdf
    • https://s3.amazonaws.com/patilawasu/20394369996.pdf
    • http://gogewarixisude.epizy.com/maxunude.pdf
    • https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_3845c0395f1d4138a1c7e8d2abe5027c.pdf?index=true
    • https://724418e0-3ace-43c1-abd8-628b4820fc71.filesusr.com/ugd/6df952_2824a744ec234c0c99f7d962d4037c13.pdf?index=true
    • https://s3.amazonaws.com/tikofaketonub/80900858816.pdf
    • https://s3.amazonaws.com/sesijesule/sap_bi_interview_questions_and_answers.pdf
    • https://d23eb412-52e1-45ef-a32a-0c032022daee.filesusr.com/ugd/03485a_e7105f2ff0624a27861c5d1158f4902d.pdf?index=true
    • https://s3.amazonaws.com/najipavez/jack_and_the_beanstalk_the_real_story_full_movie_online.pdf
    • https://764dfaed-7091-4b1c-a8ff-ceb5b694923f.filesusr.com/ugd/4bafdb_141750b8f50747c789702d9ddf3de127.pdf?index=true
    • https://s3.amazonaws.com/wuvepilamamuse/88093664215.pdf
    • http://vofolosozoz.epizy.com/a_modest_proposal_selection_test_b_c_answers.pdf
    • https://9c50f6df-e9c1-453e-a208-eff1cefe231f.filesusr.com/ugd/44b3dc_0907e0f9140943bb8e3e88cf78077c4f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5ec.bin
0b51673726b14adf9ed1c101667f82da1c2d5dc74ec247cf40628c85e8304c64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5EC 11916 bytes
font_01_sfnt_off00011bfa.bin
60e015ab4388c0c225d16802fe44bdfb333bb1e26e2a66deec716f2b73364558		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BFA 4664 bytes
font_02_sfnt_off00012bcb.bin
7a9ad36efa4536577e9d9027089120a494d6eac35fe18e2c5776d5fe8695cbdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BCB 8528 bytes
font_03_sfnt_off000143a5.bin
7814975663762f48acf9ceb3241e22ec2d08bd6e8856b097986e3ae7730b8de1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143A5 11320 bytes
font_04_sfnt_off00016a30.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16A30 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.