Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca75e4475230cf40…

MALICIOUS

PDF

79.7 KB Created: 2021-06-10 20:53:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fc6e4c2f402b85a353354859b82c2755 SHA-1: e0c84dab74b218e24dcbc9d417653b8fbf865a5f SHA-256: ca75e4475230cf40fd70ad46db6ac17ae585d627b164c4c98fdc0bc6c84aa1bb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or link farm attack. It contains numerous external links, including one pointing to 'https://chcial.ru/pbw?utm_term=general+knowledge+quiz+for+15+year+olds+with+answers', suggesting a lure to trick users into visiting potentially harmful sites. The presence of many PDF links and the overall structure indicate a campaign to drive traffic to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=general+knowledge+quiz+for+15+year+olds+with+answers
    • https://cdn-cms.f-static.net/uploads/4483604/normal_60bb80f4e2522.pdf
    • https://luvikexixof.weebly.com/uploads/1/3/4/4/134481561/75c58.pdf
    • https://pedekibitu.weebly.com/uploads/1/3/4/6/134669881/wejixonezitaxi.pdf
    • https://lozezuxugi.weebly.com/uploads/1/3/4/0/134016676/f4bab6c073b.pdf
    • https://cdn-cms.f-static.net/uploads/4445116/normal_60c1297fef851.pdf
    • https://cdn-cms.f-static.net/uploads/4368238/normal_6059cd9628f86.pdf
    • https://cdn-cms.f-static.net/uploads/4471474/normal_6009c34caaada.pdf
    • https://xonedanafesiliw.weebly.com/uploads/1/3/4/6/134633415/ee59788334d.pdf
    • https://zalatedaduliwa.weebly.com/uploads/1/3/4/8/134881590/0b6ddbd12aa8.pdf
    • https://nijasofefovo.weebly.com/uploads/1/3/4/7/134719995/desiwofanejomonamur.pdf
    • https://zulezinema.weebly.com/uploads/1/3/0/7/130776370/7b9cff3782ddcf6.pdf
    • https://mesajenijapab.weebly.com/uploads/1/3/0/9/130969967/1266709.pdf
    • https://cdn-cms.f-static.net/uploads/4373522/normal_6010675882871.pdf
    • https://voxapinave.weebly.com/uploads/1/3/2/7/132740917/turetozijop.pdf
    • https://static.s123-cdn-static.com/uploads/4420924/normal_5fe154a719b4b.pdf
    • https://cdn-cms.f-static.net/uploads/4382406/normal_5fe730e64707a.pdf
    • https://cdn-cms.f-static.net/uploads/4416796/normal_60bfe4fa5833d.pdf
    • https://static.s123-cdn-static.com/uploads/4455645/normal_5ff8c640a1d44.pdf
    • https://cdn-cms.f-static.net/uploads/4448339/normal_600e2f6a882fb.pdf
    • https://static.s123-cdn-static.com/uploads/4404739/normal_5ff116514da20.pdf
    • https://cdn-cms.f-static.net/uploads/4366308/normal_60bae67dd1b38.pdf
    • https://cdn-cms.f-static.net/uploads/4412763/normal_600d98f2a99b2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://ziduzobif.pbworks.com/f/46239981063.pdf
    • http://gamaxidad.pbworks.com/w/file/fetch/144535434/salatowufigu.pdf
    • http://jaxonewu.pbworks.com/f/how_to_register_in_afpsat_online.pdf
    • http://mukibilevejo.pbworks.com/w/file/fetch/144468837/epicgames.com_account_rocket_league_2fa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e866.bin
330784140170aad4459543ff2391f0171303dd4376f7a0b654f3077ced0ff2b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE866 5692 bytes
font_01_sfnt_off0000fbe6.bin
162198e7e98d78dfdce33ed471f39526347a850fd0da5ea58bfa2717f3bb26d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBE6 10740 bytes
font_02_sfnt_off0001202c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1202C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.