Malicious PDF — malware analysis report

Static analysis result for SHA-256 d85a5b78befcffc7…

MALICIOUS

PDF

114.1 KB Created: 2021-04-06 17:50:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: da1084453af1b482e0ced8ebcb483615 SHA-1: d676dc10ea2e867af00069c4809c9a5f7bfe6426 SHA-256: d85a5b78befcffc784da6ea7824e4da4e0448c4a605048ffea86c979094d9f90
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO spam or redirecting users to malicious sites. ClamAV and ML classifiers identify it as a phishing trojan. The presence of embedded URLs and the 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggest the document is designed to trick users into downloading further malicious content, potentially by providing a password for an encrypted archive.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=skulls+and+shackles+characters
    • https://cdn-cms.f-static.net/uploads/4374009/normal_6069db02f22c8.pdf
    • https://static.s123-cdn-static.com/uploads/4387817/normal_5fe287fb6bc01.pdf
    • https://totijavefukaja.weebly.com/uploads/1/3/4/7/134705726/lazojamadogameded.pdf
    • http://a1metromovers.com/xbox_360_emulator_activation_filezq7e4.pdf
    • https://cdn-cms.f-static.net/uploads/4416796/normal_604a906a002cf.pdf
    • https://wisapemewe.weebly.com/uploads/1/3/4/7/134713478/bemokenir-bulirob-wegalusedo-nutuwukimunigis.pdf
    • https://vurodotug.weebly.com/uploads/1/3/1/4/131454057/e1431a61de2.pdf
    • https://jipofaxinevafud.weebly.com/uploads/1/3/4/3/134350183/reviwij.pdf
    • https://jukafubu.weebly.com/uploads/1/3/0/8/130874261/7a13e4cb41f37d1.pdf
    • https://cdn.sqhk.co/guvevifowo/ewpm8ji/miwujirasowitefevug.pdf
    • http://prodive.su/james_bertoni_code_fetishkxy7j.pdf
    • http://barcaporirternet-interbank-pe.com/what_kind_of_ammo_does_a_sig_p365_useeio2j.pdf
    • http://medyahanem.com/luvobuwikozarobis32hm.pdf
    • https://funotagikaxu.weebly.com/uploads/1/3/1/8/131857914/xipolamemipapevej.pdf
    • http://2220202.ru/samsung_un58mu6070fxza_review1zjxa.pdf
    • https://cdn.sqhk.co/nazalugewu/KrnfCgd/minigun_warzone_reload.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://80172413-d145-4b71-b7cf-4a007d76ad29.filesusr.com/ugd/cacfd7_e28a956524f940f7a0a5cb91dd4ebbcd.pdf?index=true
    • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_55db60af73d74891b01c2f5f469c1593.pdf?index=true
    • https://569e8712-2873-4b93-a654-ea71b6b809e3.filesusr.com/ugd/345929_0f28587f1e1c42eaafcd4935d0435ca0.pdf?index=true
    • https://18b09f4e-de4d-4c1b-9fe6-be55c63b1c00.filesusr.com/ugd/cd81e9_1a62e20957484ec8b438fab03c224e55.pdf?index=true
    • https://e8ceee85-86bf-4804-80ab-d7a1511cbcf5.filesusr.com/ugd/38650a_750c7b6ed56b4e7a952be28eaef5e92b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015ffd.bin
f0b673ba72351a863e81a7bd46b63bdaba80f1953b298c885e9cfcb1e2edb32b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15FFD 4916 bytes
font_01_sfnt_off00017099.bin
f884fd1e6b6a8f87d22126a75d64c083a4a4af536f8effd30a1cb5122b7a5991		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17099 11232 bytes
font_02_sfnt_off00019702.bin
069f5cdcb972b33999f3dc18a3e5b847fc2aa024b7c5b45b4734cedf253a8e5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19702 16376 bytes
font_03_sfnt_off0001aca9.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1ACA9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.