Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9b659bc8d3dac67…

MALICIOUS

PDF

80.8 KB Created: 2021-06-02 17:27:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b8f193ef44afb17cc20fd7ff4b35b43c SHA-1: de054ec457a9232d41230191dbc17da075ebadf8 SHA-256: d9b659bc8d3dac676c9c49c0362b98868a9456112c7b66a44c446ce7354b2201
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The heuristic firings reveal a significant number of external links, suggesting a link farm or SEO manipulation tactic. One of the primary URLs, https://catamma.ru/pbw, appears to be a lure for potentially malicious content. While no scripts were directly extracted, the PDF structure and extensive external linking are indicative of a phishing or content-serving malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=prison+life+hack+gui+pastebin
    • https://kasutuwisuruja.weebly.com/uploads/1/3/1/8/131872017/momifinuzoda_goponinoji.pdf
    • https://mikexilip.weebly.com/uploads/1/3/4/8/134868220/lonufo-rodikonerizat-vejapigeruvi-dudewifub.pdf
    • https://sokijolixorinus.weebly.com/uploads/1/3/1/1/131163896/799298c79fe846c.pdf
    • https://wenajatimox.weebly.com/uploads/1/3/4/4/134480159/96845.pdf
    • https://tevupuzenoxa.weebly.com/uploads/1/3/6/0/136009769/d9b7c6124db4057.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://xiwitanul.pbworks.com/w/file/fetch/144462612/32852646031.pdf
    • http://dekokos.pbworks.com/f/how_to_get_ssc_duplicate_certificate_online.pdf
    • http://dijakezepo.pbworks.com/f/94515514913.pdf
    • http://xuvabufoj.pbworks.com/w/file/fetch/144472185/59175811058.pdf
    • https://uploads.strikinglycdn.com/files/1951d7e8-a336-4a69-92dd-353f4aaeb2df/76840558077.pdf
    • http://bemulopawed.pbworks.com/f/why_wont_my_skullcandy_bluetooth_headphones_connect_to_my_laptop.pdf
    • https://uploads.strikinglycdn.com/files/76d7946c-b000-44da-8345-497669ffd43d/iatf_16949_english_download.pdf
    • http://pezeliv.pbworks.com/w/file/fetch/144426207/obeb_okek_soru_zm.pdf
    • http://zufogopojut.pbworks.com/w/file/fetch/144503580/xoruxozavexezuwisev.pdf
    • https://uploads.strikinglycdn.com/files/3300cdc1-d5cf-4c52-b274-1f4e9f6031bc/xemedamopijotolikejo.pdf
    • https://uploads.strikinglycdn.com/files/980ec822-2513-4823-9ae1-4049c44e2555/puzixanukurarusarexuzag.pdf
    • https://uploads.strikinglycdn.com/files/91d0f6d2-95d0-46c2-8d3c-2a5054833c91/pezos.pdf
    • https://uploads.strikinglycdn.com/files/f3e9bc15-e0bc-4fa4-a996-0a4b98e6e1c2/what_is_the_medical_definition_of_a_palsy.pdf
    • https://uploads.strikinglycdn.com/files/0e1783c2-a3ce-4a0f-a9ad-db5fd4530ad2/whats_the_best_cuban_cigar_brand.pdf
    • http://mumubib.pbworks.com/f/africas_hidden_history.pdf
    • http://gozuwef.pbworks.com/w/file/fetch/144497625/71178977831.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6d6.bin
979e168b3fea7dedb30822dc5a36b9d149f985fb5a7297e05c4138c32e69cd5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6D6 5364 bytes
font_01_sfnt_off0000e903.bin
85eb25696a065660d1e6ba61e2d7a0895f9aa960c7d73dbc5a14087e9a8a993b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE903 12644 bytes
font_02_sfnt_off0001120a.bin
b77299264355aee3efd3c22c086d00163a970304bd010275c8b6955279230dd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1120A 16172 bytes
font_03_sfnt_off00012733.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12733 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.