Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdfe726c1b31bb1c…

MALICIOUS

PDF

106.9 KB Created: 2021-03-21 06:41:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 76a4e36352d98347beeb983b014cb623 SHA-1: 1cfd47d443f039e72aefd56390f9a677a3deb519 SHA-256: cdfe726c1b31bb1c29ad1bc2a8860573be7d445b84804ffb2d156ea4996a2f35
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are obfuscated or lead to potentially malicious content, as indicated by the 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' heuristics. The ClamAV detection further confirms its malicious nature. The document body, though heavily truncated and obfuscated, suggests a lure related to 'heroclix teams', likely to drive traffic to the linked sites for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=best+heroclix+teams
    • https://nogigeto.weebly.com/uploads/1/3/4/6/134665346/lebuvedijekotofa.pdf
    • https://cdn.sqhk.co/kexofodatop/Bibijje/tinuranabufi.pdf
    • https://cdn.sqhk.co/nobixapo/igiajan/spin_clothes_for_sale_near_me.pdf
    • https://sinegozedajosor.weebly.com/uploads/1/3/1/8/131871849/vejutumega_zozokafowon_sejukilokiwem_domege.pdf
    • https://ragesetenavuxom.weebly.com/uploads/1/3/1/6/131606186/jowalatopo.pdf
    • https://cdn.sqhk.co/josozudibud/hfdiihi/ziwowe.pdf
    • https://cdn.sqhk.co/lotazoza/Mghbn3u/95721271070.pdf
    • https://cdn.sqhk.co/wakewafo/fkjguZ3/sipevemurebiresabok.pdf
    • https://wefapewirevuvik.weebly.com/uploads/1/3/4/6/134667644/9817875.pdf
    • https://bunoworerut.weebly.com/uploads/1/3/1/4/131438217/31cde2be0d9ee4.pdf
    • https://cdn.sqhk.co/zunezafi/fuVElTk/vigirawitisodilunivu.pdf
    • https://cdn.sqhk.co/fusuwudofal/iIzdjhD/pubg_m249_gun_sound_ringtone_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jijetebum.epizy.com/18602775261.pdf
    • https://s3.amazonaws.com/tesodagiwor/space_bound_music_video.pdf
    • https://s3.amazonaws.com/taturi/telexekiriwener.pdf
    • https://s3.amazonaws.com/naxizugenabi/tedojijepezapunudilimoliv.pdf
    • https://s3.amazonaws.com/ronenitevodo/clinical_teaching_strategies_in_nursing_fourth_edition.pdf
    • https://s3.amazonaws.com/likerajatob/32621628877.pdf
    • https://s3.amazonaws.com/wazotojemov/67064238404.pdf
    • https://s3.amazonaws.com/gozilum/tubibegexalivavej.pdf
    • http://somizifiwij.epizy.com/47632676857.pdf
    • http://dojeguxe.rf.gd/nofupiwanekoju.pdf
    • http://kilaliwe.rf.gd/essential_hypertension_in_pregnancy.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000162a4.bin
c6f45df6ff80a7fc3d692165dbd6daa44bcc3e6cd728fea194670e3b5c8ee41e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162A4 5156 bytes
font_01_sfnt_off00017409.bin
e09d731251a71a4d81396fdd39298e3ed03c293c1b677b5fd16eedc2b9082164		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17409 11856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.