Malicious PDF — malware analysis report

Static analysis result for SHA-256 c82476e7a45796f8…

MALICIOUS

PDF

93.0 KB Created: 2021-04-02 22:51:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4a525f3cdc247edb94e05116f1b31295 SHA-1: dacaec3bfa2af258bb483cf7d4c0a9de6c1ef499 SHA-256: c82476e7a45796f8738c55a6c818323d24b1a3c7f350280f7a7cb866923cfb5f
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm with numerous external PDF URLs. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests a common tactic to bypass gateway scanning by encrypting payloads, although no explicit password instructions were found in the document body. The presence of embedded JavaScript, indicated by the 'PDF_SEO_LINK_FARM' heuristic and the 'T1059.007' technique, suggests the document may attempt to execute malicious scripts or redirect the user to further malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=online+graphic+organizers+interactive
    • http://najetaxu.mygamesonline.org/2009_hyundai_sonata_service_schedule.pdf
    • https://nepuvojikonutoz.weebly.com/uploads/1/3/4/6/134677469/dunigapezob_gudawajaxux_moforanas_miwasilapowu.pdf
    • https://dirusase.weebly.com/uploads/1/3/1/0/131070798/1548588.pdf
    • http://zemesod.getenjoyment.net/how_to_retrieve_facebook_password_from_android_phone.pdf
    • https://sutivekawexebe.weebly.com/uploads/1/3/1/6/131636655/1270983.pdf
    • http://jugatilewe.22web.org/fujeranuwajifuvime.pdf
    • http://moxilekulina.getenjoyment.net/cavinton_forte_ulotka.pdf
    • https://cdn-cms.f-static.net/uploads/4460460/normal_6034d8b127097.pdf
    • https://cdn-cms.f-static.net/uploads/4386824/normal_6063d7b2995f6.pdf
    • https://cdn-cms.f-static.net/uploads/4409413/normal_600a174080eb7.pdf
    • https://cdn-cms.f-static.net/uploads/4424027/normal_5fd92e46656c8.pdf
    • http://bipowilago.mywebcommunity.org/free_classical_piano_sheet_music_for_beginners.pdf
    • https://cdn-cms.f-static.net/uploads/4401994/normal_604a5a554f906.pdf
    • http://vapagugisozule.22web.org/boards_and_beyond_download.pdf
    • https://kisewosa.weebly.com/uploads/1/3/1/0/131070890/934c98465.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/508873c7-f349-4655-bd33-3dd87facc966/what_are_typical_settings_for_bipap.pdf
    • https://72858ab8-d36f-4bc2-b208-e5ec56e76d01.filesusr.com/ugd/3a4e0e_e0e73715cf584b91b19ba37354810803.pdf?index=true
    • https://d429d46a-6203-486b-8c9d-ede5597e1383.filesusr.com/ugd/419b00_c3c56f590f374595b7262471f9ede20e.pdf?index=true
    • http://xeziredo.epizy.com/mekedexared.pdf
    • https://9a89a7da-ede3-42eb-a537-7416be21eb2d.filesusr.com/ugd/aaaf79_a15a6145219b4bc1b79d4217214fb0bd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1fe9b64f-64cc-4c57-be95-003130cb91f7/tojufajavexus.pdf
    • http://zakamizorone.rf.gd/34665861584.pdf
    • https://48b7024d-7414-4593-b44d-ed892b96ad15.filesusr.com/ugd/3e5db3_d93d7b0e8bc8493a9242a953a1a9a417.pdf?index=true
    • http://pevunezix.epizy.com/zutevogatame.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012cc0.bin
0d0a2f6a9b0007cbd0b199846a77fa34d0d5c67a5eeae602c8a42bf3abfa0e46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CC0 5332 bytes
font_01_sfnt_off00013eec.bin
0dad7faee389ed37aae0e5d0fd21226215b06316a3e4738e8c36b628c7a5dac7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EEC 11348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.