Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9ed8ab834f43263…

MALICIOUS

PDF

90.5 KB Created: 2021-05-13 09:08:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 990ec7d66c29d736a269988cc3947684 SHA-1: 146c860e5b40a71757648be4f6b127477ef1f587 SHA-256: c9ed8ab834f4326393fe03f5a27180565921cb88761f9fd1632a77fd272364b0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external links points to a URL that appears to be part of a malicious campaign, while others are benign. The ClamAV detection and ML classifier strongly indicate maliciousness, classifying it as a 'Pdf.Phishing.Trojan'. The document body is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf, which can be abused to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=what+is+co-curricular+activities+in+education
    • https://cdn-cms.f-static.net/uploads/4447273/normal_601daeb582f5e.pdf
    • https://static.s123-cdn-static.com/uploads/4403679/normal_5ff983f55aae1.pdf
    • https://static.s123-cdn-static.com/uploads/4443588/normal_5fcb59d0592f8.pdf
    • https://cdn-cms.f-static.net/uploads/4443799/normal_6043b12e13586.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nedijowewoded/application_form_for_citizenship_card.pdf
    • https://s3.amazonaws.com/debamijizozexo/17234156660.pdf
    • https://87da31d5-d184-45e7-a456-0ad082c8bd65.filesusr.com/ugd/55e94a_2a0a3e2c954e4d529a59b41c7f132dd2.pdf?index=true
    • https://s3.amazonaws.com/lorugipopuxe/sulipezutupemifokoseponu.pdf
    • https://s3.amazonaws.com/genijusemu/matudifeme.pdf
    • https://s3.amazonaws.com/vuforewebub/21706345959.pdf
    • https://s3.amazonaws.com/jinabom/simple_present_past_future_tense_exercises.pdf
    • https://uploads.strikinglycdn.com/files/b6d5168a-177a-477f-afe4-9e147142a849/99196389440.pdf
    • https://s3.amazonaws.com/takebemanijewok/whatsapp_gb_2019_atualizado_uptodown.pdf
    • https://64f3f273-fd79-4cea-bc15-92b2431614e2.filesusr.com/ugd/542254_86154c89488a4ba485b34e2b72bb546d.pdf?index=true
    • https://s3.amazonaws.com/gimisorixosu/financial_report_template_excel_free.pdf
    • https://d0f5cf02-e55f-42e7-ba97-8a4d5a2b8368.filesusr.com/ugd/7f59a0_d75d2c777ab14e198b4583d098148b38.pdf?index=true
    • https://s3.amazonaws.com/fosawef/78564673870.pdf
    • https://4e33067b-0f13-4bed-bb9c-ea95f768fd7c.filesusr.com/ugd/23924c_f57f7dcd1d3a4054a5adb0d8d6c8b546.pdf?index=true
    • https://s3.amazonaws.com/dowadotiju/essay_ideas_for_college_applications.pdf
    • https://30f21d72-2b41-4965-a7bc-2abb02bf1ded.filesusr.com/ugd/47e66e_c4b66f3258574b1baf5dae8759727443.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b08fd5a6-0fd4-45bf-9e77-52fe0dd6bee2/62987927611.pdf
    • https://s3.amazonaws.com/fazujo/james_baldwin_a_talk_to_teachers_citation.pdf
    • https://s3.amazonaws.com/jasipefulaxiduj/popadusanalonezujomafetil.pdf
    • https://s3.amazonaws.com/lixisariwulo/xorivikimosamadovewu.pdf
    • https://s3.amazonaws.com/wurivuve/google_chrome_for_xp_32_bit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012602.bin
5d6c8a1afe989ee1737c1e812ea88cb4a4bf0bbeff67b8c09775f4dcebdbdc6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12602 5132 bytes
font_01_sfnt_off00013786.bin
bc3af22e7b63191602cb15798da7e362bba809fa6668db8cee21286db6dc19a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13786 10724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.