Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce1a2c307b911f94…

MALICIOUS

PDF

110.1 KB Created: 2021-03-19 20:23:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab7e22a920bad8069ffd32f5e910fbae SHA-1: 9e81604c125f20dc8ee6dc04915c6c130d0a7dc5 SHA-256: ce1a2c307b911f946dd5f3dd3c0152e7aff6890bb759246f5ff65d6b12b5e266
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to suspicious domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or malware distribution vector, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=the+harlem+renaissance+and+modernism+worksheet+answers
    • https://cdn.sqhk.co/xaranoraf/jeECzXM/44925007158.pdf
    • http://ginupedarokuxu.getenjoyment.net/union_budget_2020_affairs_cloud.pdf
    • http://7lessons.website/taurus_pt111_g2_vs_millennium_proko2rh.pdf
    • https://cdn.sqhk.co/vadavenaw/ri81gjg/mr_bullet_feeder_xl750.pdf
    • http://torchland.xyz/sodifexule0v76e.pdf
    • http://makeyourself.xyz/dell_u2913wm_driverxsb2a.pdf
    • http://gsmall.space/67223853396rbexa.pdf
    • http://handler-autoscout24.com/atlas_copco_air_compressor_troubleshooting_guide53ffz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/kewuxejikiwe/commutative_property_of_addition_worksheets_6th_grade.pdf
    • https://s3.amazonaws.com/sukobogixe/cunto_tiempo_se_puede_tener_el_carnet_de_conducir_caducado.pdf
    • https://s3.amazonaws.com/mevuzokekenojab/31304805638.pdf
    • https://s3.amazonaws.com/folexapurilowe/46825501034.pdf
    • https://64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com/ugd/baa514_d5ea5890ca2b4240971ce41c7bd2d77c.pdf?index=true
    • http://sipanokule.onlinewebshop.net/18153675380.pdf
    • https://s3.amazonaws.com/falufusu/when_a_single_man_buys_a_house.pdf
    • https://s3.amazonaws.com/tinajabizoreguf/scientific_laws_hypotheses_and_theories_worksheet_answers.pdf
    • https://f4f877d8-29ff-4f35-83ab-971b93db0aba.filesusr.com/ugd/f4de5e_f864e23f66684e2098f7f04c54844ca4.pdf?index=true
    • https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_b2294f1dcbdd4667b50b8f3c1fac40de.pdf?index=true
    • https://s3.amazonaws.com/wupiwupiwot/70100268697.pdf
    • https://s3.amazonaws.com/pugomonapoxuxe/delta_airlines_arrival_information.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000165d3.bin
ca79e7314d2b1fc0a2c1b65438edd7534b0e1243ee9f455779f205f8b68ef4ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x165D3 5072 bytes
font_01_sfnt_off000176ef.bin
1f069298ca4d64d03046ab5e4ac0363f58e0d49703f6856a199b3b3548dfe1d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x176EF 10928 bytes
font_02_sfnt_off00019c3c.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19C3C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.