Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca5c0c51c3f9cc4d…

MALICIOUS

PDF

77.5 KB Created: 2021-03-29 06:53:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 874a5061960d38c22515b57e4318b81d SHA-1: 77daf899d10f349e2df5e5a4445f0550a1b95dfd SHA-256: ca5c0c51c3f9cc4d54363baa53f36987ae2ca9922d60e8a71e45ade77c1674b3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious or unknown domains, indicative of a link farm or phishing operation. The presence of ClamAV detection and ML flagging further supports its malicious nature. The embedded URLs suggest an attempt to redirect users to malicious content or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=12+pack+abs+pictures
    • http://vugalox.22web.org/jorinikojelufetedeguz.pdf
    • http://twoup-viktoria.online/nifudateraborip9kih.pdf
    • https://tufelovewojamex.weebly.com/uploads/1/3/4/3/134331554/xurelavixadik.pdf
    • http://tofuvuniz.iblogger.org/13715644984.pdf
    • https://zasevolonuto.weebly.com/uploads/1/3/5/3/135335071/beviwodesujuvoza.pdf
    • https://tugemizibu.weebly.com/uploads/1/3/0/7/130739278/kuvikorowirete.pdf
    • https://jitogomufe.weebly.com/uploads/1/3/4/5/134588764/1974043.pdf
    • https://kurupatasewa.weebly.com/uploads/1/3/5/9/135958836/6ecf20907ca.pdf
    • http://familyit.info/zedetez5aaul.pdf
    • http://copalofa.site/181383855744rier.pdf
    • https://fosevagepuvuro.weebly.com/uploads/1/3/1/8/131858592/929b62d0da2.pdf
    • https://dorijalasenotom.weebly.com/uploads/1/3/5/3/135327318/8231197.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_687c4bc772484abcb6c63b0f1c35ce3c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8458fec3-2202-45c6-a67d-4dd894f1bd4f/nafivajovepajuji.pdf
    • http://refipazak.epizy.com/amrita_nayak_odia_songs.pdf
    • http://fasujenijasezos.rf.gd/nugewidebifevarikule.pdf
    • https://uploads.strikinglycdn.com/files/837a26fa-8dee-44e0-8f26-4493e45fdccb/xirikewo.pdf
    • https://uploads.strikinglycdn.com/files/09f9347a-949e-479e-8e08-077c9b3571bf/nenitatepitozujatevojop.pdf
    • https://ede36962-9452-4451-b182-fa4236ba9bc6.filesusr.com/ugd/83b1b3_b64f8e41a63a4af3ba2cecdc4e9d7ebf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5059cecb-72bc-4609-b46c-664653dd0c35/puraninununujemi.pdf
    • https://9505ca4c-dfdc-4941-8fde-ded35496d0c9.filesusr.com/ugd/2097ab_d23a7e89b9924426a7705908810f14ea.pdf?index=true
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_bdf9191c9bc640b8a348318dde16cba3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1c8.bin
95ad04836d902a10773a9b553c3173579be4b0530a66aef7dd56fda55b3cbbda		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1C8 5188 bytes
font_01_sfnt_off0001037d.bin
3cea5b51307834baeedaa7fc02dd1885f4b5e5c311ccc602f4b85ab1004689f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1037D 11300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.