Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb8fbd4d748ea9b4…

MALICIOUS

PDF

80.3 KB Created: 2021-03-23 04:40:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 617aeed3c66bd8bf192529fe76fc582b SHA-1: 39d0c28e6fe031277a25af63146d6600425185fa SHA-256: cb8fbd4d748ea9b4dc05638ef6e3642a8c7ac8474576723a623fd1466d7f9ce2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL leading to a site offering free movie downloads, a common lure for phishing or malware distribution. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a malicious intent to redirect users. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/aws?utm_term=persepolis+pelicula+online+espa%25C3%25B1ol+latino+gratis
    • https://cdn.sqhk.co/xonarewu/ribjegf/download_comic_life_3_crack.pdf
    • https://cdn.sqhk.co/jifibipex/cjijecq/final_fantasy_iv_psp_pt_br_download.pdf
    • http://russianstravel.ru/13486322921g88x2.pdf
    • https://cdn.sqhk.co/nosilaxuziz/kKRjaiV/75670499019.pdf
    • http://tryraisins.pro/real_simple_magazine_the_power_of_lessu44w2.pdf
    • https://cdn.sqhk.co/folikulezig/hjeLPic/vijetelilamomepiwemape.pdf
    • https://cdn.sqhk.co/ruzaxube/hajglLP/crazy_town_halloween_party.pdf
    • http://soldatskaya6.ru/vuditejuwusofipgm7c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tetofamuxulil/80787704471.pdf
    • https://s3.amazonaws.com/towakog/number_format_php_comma.pdf
    • https://s3.amazonaws.com/ruzumeb/lotepasejijivol.pdf
    • https://s3.amazonaws.com/ximupuv/85563203260.pdf
    • https://uploads.strikinglycdn.com/files/5ffea158-46cd-4f86-9862-b7e2c94113e1/who_owns_shark_vacuum.pdf
    • https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_a33ed2a232a0408da07291754163d0ef.pdf?index=true
    • https://uploads.strikinglycdn.com/files/477ea760-3b48-472b-b49e-c0eaea7693c8/eisenhorn_trilogy_hardcover.pdf
    • https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_4ca3b2556ac24e508b00f5fffa8c57a3.pdf?index=true
    • https://s3.amazonaws.com/pulavokaxe/cheating_on_you_320kbps.pdf
    • https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_f0fd8f92a08240b19a1477fc3f02037d.pdf?index=true
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_124d0d4daf4e487184330c1eec084490.pdf?index=true
    • https://f8340159-69ce-4309-ac43-521e9a8475b4.filesusr.com/ugd/bc0b97_7781e53c2d564423bca4ac4f1a90b595.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e95f.bin
79fd21518639400a9e95eb436bf93af3e47597a531dc7ee68024458414ccb010		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE95F 5316 bytes
font_01_sfnt_off0000fb34.bin
7e716d077d21fcf73f2a713041178cceff03659370568db363b0e71b72bd66dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB34 2252 bytes
font_02_sfnt_off00010593.bin
91ebde09d96039dc12885334f6611500aefe34afc8f8c8b6fa1ff90a9436a7c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10593 13776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.