Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbedd043b70fd1b3…

MALICIOUS

PDF

101.7 KB Created: 2021-03-22 20:10:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 278dd390a28a04e3a1221f15f48c0d97 SHA-1: 96727eb5defd40bbe98d33a66ead542075bcd4d1 SHA-256: cbedd043b70fd1b3072e535d3758b657c27ed88cf50543083bf7bab45bf1e330
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one prominent URL disguised as a movie subtitle search. This indicates a phishing or scam attempt to redirect users to malicious content. The ML classifier and ClamAV detection strongly support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=le+petit+nicolas+movie+online+english+subtitles
    • https://cdn.sqhk.co/nedovipirumu/vVhdsNQ/gesuwawanusejupumez.pdf
    • https://cdn.sqhk.co/dodazija/VmZJrGd/fashion_week_hair_stylist_jobs_2020.pdf
    • http://melofuwi.getenjoyment.net/36665896937.pdf
    • https://cdn.sqhk.co/sifalavuxozo/jjtdidF/evolutionary_perspective_of_human_motivation_mcat.pdf
    • http://suzamajotibe.mywebcommunity.org/garmin_541s_flush_mount_kit.pdf
    • https://cdn.sqhk.co/jedesawu/geibgig/cherry_was_white_as_a_sheet.pdf
    • https://cdn.sqhk.co/tebefaravuz/gjT5gdY/gezotuxewigobofalak.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://e966359d-176b-477a-9ad9-c314bea94227.filesusr.com/ugd/fa6f14_c39824289572420d9628b0599537a6b9.pdf?index=true
    • https://899154e9-876a-4ab4-94d5-c8ef2aed10f2.filesusr.com/ugd/dcf9ad_3ca73c07bdf1470fa56cd0aca308a21a.pdf?index=true
    • http://bajupigirosinaf.atwebpages.com/79375209783.pdf
    • https://7c8f45b7-e058-4e27-bccd-8ee7dcb26900.filesusr.com/ugd/d5cf39_1ff36469f5c74ae1bfb1dbe45d8b3f3c.pdf?index=true
    • https://d427386d-3434-45d9-8802-370857a594f4.filesusr.com/ugd/accd1f_9a7f3175f1dc4596813b615ef1720f87.pdf?index=true
    • https://a91873a8-1f5b-4151-915d-af39eb211f25.filesusr.com/ugd/3f80ec_8c666f49a3b947099aeebc57e4a8c0e2.pdf?index=true
    • https://66166ed5-207d-48ad-a5ac-83b7e977862f.filesusr.com/ugd/0d0d42_5b988ea7a9bc442da7646aea1ae5591d.pdf?index=true
    • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_1ea74caa3427440aaaf804dc3b664abe.pdf?index=true
    • https://92fed17e-af34-466b-b3fe-38cd9ef27699.filesusr.com/ugd/192d58_ee1ea945887445edac0be978c2a41687.pdf?index=true
    • https://7605d98d-8b17-4a41-9383-f5c8d5af9bcc.filesusr.com/ugd/2bed4c_05bcccd1f5b04fec8de70271db259214.pdf?index=true
    • https://03234a85-d811-4a68-a1f9-f7315bf9ccb2.filesusr.com/ugd/079591_8cd7cf07aac54285873984575bc5abca.pdf?index=true
    • https://4465b75e-e642-4f53-8c89-e22f0b9d4994.filesusr.com/ugd/ecd213_6057e0b8288e4ea196cc6798166de69c.pdf?index=true
    • https://f13dd0f9-fe0a-4257-a88d-d9af1a1cf0e3.filesusr.com/ugd/d954c5_ba416884298f4106b92d2197ff2be5c1.pdf?index=true
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_6d94e0d00e224ffdab776b3b8ff16638.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011551.bin
6beb117551cea9ab693896d662f7dbad5a1b0ea64bcaecf8931b028d0221540c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11551 5272 bytes
font_01_sfnt_off00012713.bin
854dbd6cefc4e0d4af30083b3090ca87dfa41eac536fce2d68ae9203356f6ad1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12713 3368 bytes
font_02_sfnt_off000134df.bin
feca9168fafa16ce577c71ef6af4b51734fe27dc894c68074a7e29f45bec4662		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134DF 12492 bytes
font_03_sfnt_off00015d20.bin
170b86c401fb9d67c647f6ee6247e108413631215c7f20db3b1efe7ad6602c44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15D20 17688 bytes
font_04_sfnt_off00017830.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17830 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.