Malicious PDF — malware analysis report

Static analysis result for SHA-256 ceb654d639d4d8c8…

MALICIOUS

PDF

126.3 KB Created: 2020-04-14 23:21:11 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-15
MD5: 4fee08642a7e1e6f2d6f96e42ebd4cc1 SHA-1: dc8e932f5e1195769ca72c2a69eeebbe1d0f8801 SHA-256: ceb654d639d4d8c8616ea751c32a46b75dda701d6c74f6e0592a2a8c2a302f01
176 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1059.003 Windows Command Shell T1059.001 PowerShell

This PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO poisoning tactic. The document also explicitly instructs the user to copy and paste commands into a terminal, a common social engineering lure associated with ClickFix attacks. No scripts were extracted, but the presence of multiple malicious URLs and the direct user interaction lure are strong indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6382

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://distancelearningtoday.net/uploads/1/3/0/8/130814728/130814728.html#mathematica+11.+1+linux PDF link annotation
    • http://cashoffer2day.com/uploads/1/3/0/4/130435857/4915267.pdfIn PDF document text
    • http://resortvacationsforless.com/uploads/1/3/0/4/130435895/5071099.pdfIn PDF document text
    • http://indyductrebateclaims.com/uploads/1/3/0/7/130740165/wukugikubopasis-biroropafixosad.pdfIn PDF document text
    • http://aliamiri-lifehacks.com/uploads/1/3/0/6/130621089/7290988.pdfIn PDF document text
    • http://creativecapacities.net/uploads/1/3/0/7/130740562/lakolo.pdfIn PDF document text
    • http://pulsewavedeals.com/uploads/1/3/0/6/130604585/9880ad.pdfIn PDF document text
    • https://softwareIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000a7c9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA7C9 99080 bytes
SHA-256: 106552510bf6b010c123bfde5a97f0f7100074681be099154aabca0b3c29eb6c
font_00_sfnt_off000085c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85C4 8940 bytes
SHA-256: 5941182bb11c3b0c80b5c943bc978d60be2a34bffdf1af000d29a72ba83dce1a
font_02_sfnt_off0001ce8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CE8D 2600 bytes
SHA-256: 63f5e27ee3d24cc00d413e59c301cc73ab377383609796993547673f2bea898c
font_03_sfnt_off0001d7b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D7B9 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63

Open this report in the interactive analyzer, or submit your own file for analysis.