Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdfb00655d1bb7ec…

MALICIOUS

PDF

92.0 KB Created: 2021-03-15 04:15:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d6b884e402e0ab37598cb838d9acbcdd SHA-1: d2cc143855d2d66096a1f7219daedf1bbf8d81aa SHA-256: cdfb00655d1bb7ec2120a7d0124bfc524ba1e1ef88e6b7b6c771e013bf08fc23
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains a large number of external links, suggesting a link farm or SEO manipulation tactic. While no scripts were explicitly extracted, the PDF structure and external links point towards a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=guide+spyro+3
    • https://mazogerivajusem.weebly.com/uploads/1/3/4/3/134341978/a37256.pdf
    • https://xaxusadusu.weebly.com/uploads/1/3/4/4/134497069/8942638.pdf
    • https://fasexonepagi.weebly.com/uploads/1/3/0/9/130969542/kanafiviso.pdf
    • https://xikisujegowo.weebly.com/uploads/1/3/1/8/131856166/fd50443c35cafe.pdf
    • http://zavulibalox.mypressonline.com/endoproteza_stawu_kolanowego_rehabilitacja.pdf
    • https://nogulakotu.weebly.com/uploads/1/3/0/9/130969216/toxekij.pdf
    • https://patewowuxafopon.weebly.com/uploads/1/3/4/5/134595548/9360456.pdf
    • https://gozuneputir.weebly.com/uploads/1/3/4/3/134345179/63869.pdf
    • https://bovuzujavus.weebly.com/uploads/1/3/5/3/135326818/xumujago.pdf
    • https://kodepifaz.weebly.com/uploads/1/3/4/7/134705681/visamaxutevuzes.pdf
    • https://jinobodusere.weebly.com/uploads/1/3/4/7/134722577/vimetevuwuj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rexogeguxosix/guitar_chords_to_sheet_music_converter.pdf
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_7053cfaf556e4e838c7605ec5657e4d3.pdf?index=true
    • https://dfdccaec-9019-42eb-ab8c-14eed22d5f88.filesusr.com/ugd/2e00cc_8729c0cbfc82499bb4609bace4530710.pdf?index=true
    • https://s3.amazonaws.com/fejififimaketo/bleacher_report_wwe_tlc_results.pdf
    • https://78fa80b2-8629-447b-ad63-53e91e8d4948.filesusr.com/ugd/8f02de_22dd098e6ff747a1b90b7e05a1d48169.pdf?index=true
    • https://36535336-4f9e-4c0a-b1ad-3385cb5d4299.filesusr.com/ugd/15ebe2_40ff665b513a45d0b4e2a8927119501f.pdf?index=true
    • https://1237a3da-0b33-4890-9ba9-974507bf2590.filesusr.com/ugd/3e0cb9_0fd5a60558034151adbe5e04727c88dd.pdf?index=true
    • https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_8f5873da7b9542bb8b2b60284e6904bb.pdf?index=true
    • http://ziwemasux.myartsonline.com/futimujevo.pdf
    • https://409b2d23-5c1d-402e-97df-26c0da9299b0.filesusr.com/ugd/2e3d42_ccc2481d37b04e628a3cb57961ef8c0b.pdf?index=true
    • https://eeeff038-21f9-42a6-bde0-cd945221d618.filesusr.com/ugd/9dc459_c5796f6194a0443d82c81c883f9b89e4.pdf?index=true
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_9c7e5a45b9f64f1f881ff2c827905ef2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012d06.bin
fdf666775739f5400db99ee6a19a95417d97653b4f40e25f2c8cef54da9830b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D06 5008 bytes
font_01_sfnt_off00013e2f.bin
0662e448fb55e87b1f909ecd1bd8e03c455b0ef0c966e47fd5559b9691351837		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E2F 10792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.