Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce688bb695584e7a…

MALICIOUS

PDF

85.2 KB Created: 2021-04-04 13:26:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f12881fd9cdd6993fb7a1e1e74102996 SHA-1: 73769d0e2ab02bda47f5bd9082b1e4d5a8a76a29 SHA-256: ce688bb695584e7adab40b2d70f89a4a8968d146fd3478b881ee70691fe5b72e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The embedded links and the heuristic 'PDF_SEO_LINK_FARM' suggest an attempt to direct users to a network of sites, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=do+kidde+smoke+alarms+flash+red
    • https://zororoxuz.weebly.com/uploads/1/3/4/3/134309160/79757.pdf
    • https://bofonoge.weebly.com/uploads/1/3/5/3/135388944/d42efd37c0b4e.pdf
    • https://febawamowezifu.weebly.com/uploads/1/3/4/5/134594075/3472129.pdf
    • https://vebuxevofarina.weebly.com/uploads/1/3/4/0/134013543/4705715.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zobuwubedak/miwop.pdf
    • https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_b745d68e5804410d9b1785864debb635.pdf?index=true
    • https://c5e26362-acc3-4c40-9db4-ce0cbd355080.filesusr.com/ugd/681527_f5b8f5e2124d44bd99d492e92c476fb3.pdf?index=true
    • https://cd29ef07-728f-4a0b-b57b-23e770395c36.filesusr.com/ugd/f14cf6_dca93ece31e44ced83397557c271230a.pdf?index=true
    • https://s3.amazonaws.com/xebuvuwov/kunuzoki.pdf
    • https://s3.amazonaws.com/zexozavo/samsung_galaxy_j2_prime_2019_price_in_sri_lanka.pdf
    • https://75ca6b5e-a470-4e0e-8004-b00a9f1721b4.filesusr.com/ugd/1e4819_5be492d202f94366b365dd0bf6ec6ab5.pdf?index=true
    • https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_563f627d407c4738a7b6658766a6f4e5.pdf?index=true
    • https://s3.amazonaws.com/bulolimepol/22331414146.pdf
    • https://50b7e5d6-ab0e-41ff-bbcb-47d024e5c277.filesusr.com/ugd/45d8ab_db5dbe26b6804bf4849edb01a14a4332.pdf?index=true
    • https://s3.amazonaws.com/minaxigevani/sound_blaster_audigy_2_zs_platinum_manual.pdf
    • https://s3.amazonaws.com/xukirizugukugi/76856841527.pdf
    • https://s3.amazonaws.com/dipafuxe/mla_cover_page_template.pdf
    • https://s3.amazonaws.com/dobikasukavu/xirebil.pdf
    • https://s3.amazonaws.com/rebomedug/vujosabefajujowi.pdf
    • https://e301b21f-f707-426c-a094-6199d4b1a2d6.filesusr.com/ugd/f65518_0db112b1f95b44e7838a213e6ff2dfe8.pdf?index=true
    • https://e60c805d-b9e1-47fc-b045-983511e9ac1f.filesusr.com/ugd/116bb2_6ed9314b11b34f968a09c45ab39696b7.pdf?index=true
    • https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_88fcaa5d31af42608e8b38ae44c67a24.pdf?index=true
    • https://d4f4546a-a836-4b3d-8651-c56b89608eca.filesusr.com/ugd/3e9e83_0c7c23a721834de7b083024618e4825b.pdf?index=true
    • https://s3.amazonaws.com/zedudo/moxusanowujavutijaw.pdf
    • https://s3.amazonaws.com/baxekojojexusol/89343723969.pdf
    • https://s3.amazonaws.com/gozifep/the_idiot_iggy_pop_rym.pdf
    • https://s3.amazonaws.com/dekogamik/sports_tv_guide_apk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010fdd.bin
c5b3ad567268c30df546f1ae51401aca9ecd4cc10829546ae83bd4559232e678		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FDD 5208 bytes
font_01_sfnt_off0001216a.bin
cf84277dd097c0bd326fd5849252f39d6695ce17cc252ec0a60bbd806392bea3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1216A 10876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.