Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2191e9702ee9f93…

MALICIOUS

PDF

75.2 KB Created: 2021-03-31 18:17:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 62b156289d38e97a8520c98ac7ebbf39 SHA-1: 451f319392e34db6f4f9f5e161d2717d9f082096 SHA-256: d2191e9702ee9f938583ebfbc15e655b9a7aa21f582e13544240294423a1225f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to potentially malicious domains, indicative of a link farm or phishing campaign. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URIs are consistent with techniques used to redirect users to malicious sites for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=citizen+watch+setting+instructions+c650
    • https://lasasokuvob.weebly.com/uploads/1/3/1/6/131607269/13e749791.pdf
    • http://goldstein.capital/google_play_store_apk_android_2._29fwgy.pdf
    • http://jisutuxoxaza.medianewsonline.com/atletismo_salto_largo.pdf
    • http://fazejajogavu.medianewsonline.com/epson_wf_3540_replace_ink_cartridge.pdf
    • http://fobexugelego.getenjoyment.net/dwg_to_converter_free_download_full_version_with_crack.pdf
    • http://itfamily.pro/7232717439bwylf.pdf
    • http://supportcopyright.net/lapakewefakosuxibtpp2o.pdf
    • http://wivafojoki.22web.org/modelos_pedagogicos_segun_autores.pdf
    • https://tuvuneboginat.weebly.com/uploads/1/3/1/6/131606819/e6d05.pdf
    • http://dotavulilego.mypressonline.com/33783117288.pdf
    • https://pazisurezufil.weebly.com/uploads/1/3/4/5/134594691/5363294.pdf
    • http://fusekimutoxi.sportsontheweb.net/casebook_of_sherlock_holmes.pdf
    • https://depopuxa.weebly.com/uploads/1/3/4/8/134893869/limasujufalojes_gimopatomivuma_wodagu_texob.pdf
    • http://ropiwijubasa.22web.org/medatirekuxutowanijiza.pdf
    • http://edevletorg.com/fantastic_fan_lid_replacementp7u6u.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dekogamik/adobe_color_cc_panel.pdf
    • https://s3.amazonaws.com/gajabedafot/canonet_ql17_manual.pdf
    • https://s3.amazonaws.com/zamemigojat/cara_gta_5_mod_di_pc.pdf
    • https://s3.amazonaws.com/najubu/resinugaboxetonemis.pdf
    • https://s3.amazonaws.com/votuweroxigezog/lalizidodubikemasibi.pdf
    • http://xexelakufakeze.epizy.com/inkjet_printable_fabric_sheets.pdf
    • http://sazosubegus.epizy.com/cbse_guide_class_11_physical_education.pdf
    • https://s3.amazonaws.com/mejigavukolu/used_ranger_bass_boats_in_missouri.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8ae.bin
5c67f9683d3f2149ec276d18776d9727c6916fbbf381653bc26d769e529b4963		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8AE 5496 bytes
font_01_sfnt_off0000fb73.bin
ed253a885c5373a5911ddf82281f5c8d002bea3924fd7301e2a393658955c71f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB73 10436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.