Malicious PDF — malware analysis report

Static analysis result for SHA-256 da6e84c9f6b53eda…

MALICIOUS

PDF

75.1 KB Created: 2021-05-03 03:16:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8ae9009cd6067b6204b5bad479ed5e02 SHA-1: d6c5d02d27e9b07377b1e74c8cab93f34ab19c75 SHA-256: da6e84c9f6b53eda4c9025ac2041fe521d6540901fbf6835e811cd89ae081cc3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which appear to be part of a link farm, suggesting a malicious intent to manipulate search results or redirect users to phishing sites. The ClamAV detection and ML classifier strongly indicate malicious content, specifically a phishing trojan. While no scripts were directly extracted, the PDF structure and numerous URLs point towards a phishing or SEO abuse campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=bid+rent+theory+ap+human+geography+definition
    • https://cdn.sqhk.co/loxinesupiva/TrLbgdy/43559283837.pdf
    • http://tederurokeroga.iblogger.org/general_ledger_accounting_spreadsheet.pdf
    • https://cdn.sqhk.co/wimiwupo/gjkhhhg/setilavakobijitawox.pdf
    • https://cdn.sqhk.co/bibolaned/eXIZgeQ/methode_swot_projet.pdf
    • http://rofepanix.iblogger.org/fly_ash_bricks_mixing_ratio.pdf
    • https://cdn.sqhk.co/videgogaf/ijjbje0/detentionaire_tina_voice_actress.pdf
    • http://ginalupajeriw.scienceontheweb.net/55852474620.pdf
    • http://lamatokatov.22web.org/60349423846.pdf
    • https://cdn.sqhk.co/polopomoset/S3REihY/tasuku.pdf
    • https://cdn.sqhk.co/pegidago/wGGpRhe/nazowi.pdf
    • https://cdn.sqhk.co/saboretiki/aBMjjgc/gifedixusawelafid.pdf
    • http://gepokupaburorew.mywebcommunity.org/lopafirozuvevawe.pdf
    • https://cdn.sqhk.co/jarogofef/edswFt0/poached_egg_calories_and_carbs.pdf
    • http://tazikuruwuwozu.22web.org/99416999150.pdf
    • http://mogimetekojubar.scienceontheweb.net/papuxibenegexudatobubaz.pdf
    • https://cdn.sqhk.co/dijabidasu/Cwjagcu/26969938044.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3ecb585b-79b8-4502-8567-d9a17299c5c1.filesusr.com/ugd/4b874d_6af5775939ce4141b4358a54a9b5e198.pdf?index=true
    • https://b66a6cc6-7028-4fd7-9d19-084b2b27c535.filesusr.com/ugd/4015cf_1596422e9dc44e5d84f64ab530a891cd.pdf?index=true
    • https://95fbbc11-640f-4658-acdf-6e09da746871.filesusr.com/ugd/e42ee3_a4bca6479a6b41009248a7023090f03a.pdf?index=true
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_bf4c5decebfb48f88c58dcd930f66f58.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e61f.bin
3273213348dbe81b86e0e9729bf53b268353003af74f69979de5e317252b7f64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE61F 5396 bytes
font_01_sfnt_off0000f860.bin
9f72d99557cd6efaab997ec0ab311b2ac70705829b718d9b9a738198ac3534a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF860 10916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.