Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb6a1c4af4e87b26…

MALICIOUS

PDF

78.7 KB Created: 2021-05-21 08:41:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 128854bd6f398b70f8c2bb31811a8367 SHA-1: 5884be566b88c10539010c7028d6a687ba1e77fc SHA-256: cb6a1c4af4e87b26335fef8f2f73e4c357274647549e548340e944af2ed1767c
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a malformed exploit stream and a large number of embedded external links, indicating a malicious intent to redirect users. The ML classifier and ClamAV detection strongly suggest this is a phishing or trojan delivery mechanism. While no scripts were directly extracted, the PDF structure and embedded URLs point towards an attempt to exploit vulnerabilities or lead users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=what+is+ad-hoc+and+monkey+testing PDF link annotation
    • https://vawudida.weebly.com/uploads/1/3/4/8/134890241/gegereloporixotes.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365649/normal_6029dc0c43cb9.pdfIn PDF document text
    • https://kikurebimeko.weebly.com/uploads/1/3/0/8/130814200/6655318.pdfIn PDF document text
    • https://wanalupegekiful.weebly.com/uploads/1/3/4/8/134879682/pejujulirataru_wagukinorejok.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450870/normal_601456ad1f0c6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479236/normal_5ffbe2dbda7af.pdfIn PDF document text
    • https://peziwotikiju.weebly.com/uploads/1/3/4/6/134602895/tejarenupusut_wetuzigurexigu_dizomex_rinezujus.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad6e50f1-6072-4a33-8311-3802de2bbc7e/how_to_recharge_a_sodastream_bottle.pdfIn PDF document text
    • https://s3.amazonaws.com/xesigeze/twas_the_night_before_christmas_words_free_printable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12cf80da-7bff-4d3a-92b1-102128bf54b0/what_is_osha_30_certification_good_for.pdfIn PDF document text
    • https://s3.amazonaws.com/gomaxod/garmin_gpsmap_64_vs_oregon_600.pdfIn PDF document text
    • https://s3.amazonaws.com/womirofop/83508100181.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/xibepupivipul.pdfIn PDF document text
    • https://s3.amazonaws.com/lejivugeleguwod/naming_polyatomic_ions_worksheet_with_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/94641031184.pdfIn PDF document text
    • https://s3.amazonaws.com/tumuzu/xuxaxipadomolobogabojo.pdfIn PDF document text
    • https://s3.amazonaws.com/kudufigunabi/411266927.pdfIn PDF document text
    • https://s3.amazonaws.com/kavugusepe/pirilazuxowupizug.pdfIn PDF document text
    • https://s3.amazonaws.com/bopuxosavubare/british_english_books_free.pdfIn PDF document text
    • https://s3.amazonaws.com/lekezaru/deepak_chopra_21_day_abundance_meditation_day_17.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f699.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF699 5436 bytes
SHA-256: e2bb3e6ba11797f3c8bfcf3dc5c5d4245c0512fdb42f3b5ad74de8f92e1c33f0
font_01_sfnt_off00010913.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10913 10696 bytes
SHA-256: ed80fd829cac363f6076c51b8c97594da9ff4216ec584820f83047db91979f24

Open this report in the interactive analyzer, or submit your own file for analysis.