Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce46b71807c532ed…

MALICIOUS

PDF

80.7 KB Created: 2021-03-19 13:55:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0495bb3580f8e59b61c821e48a2a37c3 SHA-1: 9ba5a653e7fab4f3287f05781efa2d07d9cb7281 SHA-256: ce46b71807c532ed4efd92d87151ef77f335eed96ea7cb538df15955d0552698
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, characteristic of a link farm or phishing operation, with one URL specifically mentioning a 'singular to plural spanish translator' as a lure. The presence of numerous PDF links suggests an attempt to distribute further malicious content or engage in SEO manipulation for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=singular+to+plural+spanish+translator
    • http://madamzero.com/youtube_english_grammar_course_for_beginners2sbwi.pdf
    • https://lunipudazu.weebly.com/uploads/1/3/4/4/134462877/6122498.pdf
    • https://dukutisanag.weebly.com/uploads/1/3/4/3/134318107/bofisejiluvepupuje.pdf
    • https://galekogikelubem.weebly.com/uploads/1/3/1/4/131438025/4077759.pdf
    • https://xokodozavujug.weebly.com/uploads/1/3/5/3/135343923/d0facf72a8a.pdf
    • https://xasigusuvenazuj.weebly.com/uploads/1/3/0/7/130739755/53b092.pdf
    • http://sarhello.online/sifuterarnr2a.pdf
    • http://viewcreditscore.info/51304117208czooq.pdf
    • http://scrlt.xyz/the_world_is_too_much_with_us_theme_of_the_poem8uxnr.pdf
    • https://xufuluzigi.weebly.com/uploads/1/3/4/2/134266078/lujobofeno.pdf
    • https://wujipiledulom.weebly.com/uploads/1/3/4/6/134695719/3969573.pdf
    • https://viwitilabepimep.weebly.com/uploads/1/3/2/6/132695477/6fc0c6a1.pdf
    • https://povazolanatul.weebly.com/uploads/1/3/0/7/130740072/4541047.pdf
    • http://xrootunited.com/reglas_de_acentuacin_agudas_graves_y_esdrujulas_y_sobresdrjulassyhnw.pdf
    • http://pizidojokinesa.66ghz.com/ammoniacal_formule_chimique.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xiwaresijo.epizy.com/nccn_lung_cancer_screening_guidelines.pdf
    • http://tolimimagag.epizy.com/bible_timeline_poster.pdf
    • https://s3.amazonaws.com/bezorito/86639896016.pdf
    • https://uploads.strikinglycdn.com/files/11fa56b9-05bf-4b15-8333-3dd50cfcd93f/rifasemofijedunesaz.pdf
    • http://zanukabijegur.rf.gd/degig.pdf
    • https://s3.amazonaws.com/nerugiraxura/43964364926.pdf
    • https://uploads.strikinglycdn.com/files/c63549c0-620c-442e-9b87-56f96ea0db6a/netukolijomom.pdf
    • https://s3.amazonaws.com/xojafemori/40567077316.pdf
    • https://s3.amazonaws.com/fulosobezur/98125614483.pdf
    • https://s3.amazonaws.com/woneketelak/attestation_pole_emploi_vierge_remplissable.pdf
    • http://zomojafo.epizy.com/95299109042.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f798.bin
e8d6b718e398683c194e221e4b4aee12b84da0fac2c7c5a1edd11ea27186229d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF798 5184 bytes
font_01_sfnt_off00010930.bin
8b05031b29aa65c7cc92e97a85d1d6c43c5807199becce033beaf30b03f7ded8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10930 12800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.