Malicious PDF — malware analysis report

Static analysis result for SHA-256 c94fbec6acca3680…

MALICIOUS

PDF

87.9 KB Created: 2021-04-09 11:23:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 220a3506fdd2746838317d5f7571332c SHA-1: 46cee4a6514aa5fa3a62e221e7cfa1be1464f7c1 SHA-256: c94fbec6acca368002305dfdc5e36d6ca6c1df7597bfbe46354715a7aa7e51b1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or malware distribution. The embedded URLs and the document body, which appears to be a garbled search result, support the attack pattern of luring users to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=what+does+social+exposure+mean PDF link annotation
    • http://about-central.com/75313527200lulb7.pdfIn PDF document text
    • https://setixifofu.weebly.com/uploads/1/3/1/6/131606861/6603fa56860cc21.pdfIn PDF document text
    • http://gimepar.22web.org/bazudopepuz.pdfIn PDF document text
    • https://vifefafu.weebly.com/uploads/1/3/4/8/134876142/bomowodinu.pdfIn PDF document text
    • http://gukimunejorupod.iblogger.org/why_greek_gods_were_created.pdfIn PDF document text
    • http://kogawanitikip.iblogger.org/zexobuze.pdfIn PDF document text
    • http://ultra0.space/59276970130ajdfd.pdfIn PDF document text
    • https://worubagazew.weebly.com/uploads/1/3/4/6/134639575/ab5d1a89259.pdfIn PDF document text
    • https://bagawilikazukir.weebly.com/uploads/1/3/1/0/131070307/831bc7ce.pdfIn PDF document text
    • http://businessoutsourcing.info/lereporaxibenajaxodibaldap0j.pdfIn PDF document text
    • https://volifinidolil.weebly.com/uploads/1/3/0/8/130873876/metoz.pdfIn PDF document text
    • https://suxozunepewax.weebly.com/uploads/1/3/2/8/132814427/sodigukotakenuf.pdfIn PDF document text
    • http://nowexevor.iblogger.org/71072180779.pdfIn PDF document text
    • https://famonusowofem.weebly.com/uploads/1/3/4/3/134349488/mavupeja.pdfIn PDF document text
    • http://folotexuxopig.iblogger.org/b._ed_ignou_entrance_form_2018.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/mibiwivanetuj/9867273747.pdfIn PDF document text
    • https://s3.amazonaws.com/nupotukig/luxury_travel_guide_jobs.pdfIn PDF document text
    • http://melukibojenubud.rf.gd/hunchback_of_notre_dame_name_pronunciation.pdfIn PDF document text
    • https://s3.amazonaws.com/lanubili/descargar_gratis_zacarias_ferreira_los_recuerdos.pdfIn PDF document text
    • https://s3.amazonaws.com/bibejovixapis/39542617860.pdfIn PDF document text
    • http://jonokib.rf.gd/makita_lithium_ion_battery_msds_sheets.pdfIn PDF document text
    • http://zujogesa.rf.gd/derozukasetulesadubawavok.pdfIn PDF document text
    • http://xufenazaliwe.epizy.com/how_to_control_pump_speed.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010844.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10844 5276 bytes
SHA-256: ae5940877e3ea4fa24835c604d16926cb635082e4f7bc4bd540fd8dc96e20f8a
font_01_sfnt_off00011a18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A18 11756 bytes
SHA-256: 98a8429a46f98e92c1d26bcc503cfd0ae9aca9eaa396c9c59e778e7e42046cc8
font_02_sfnt_off0001421d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1421D 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.