Malicious PDF — malware analysis report

Static analysis result for SHA-256 da8571f88cd8796f…

MALICIOUS

PDF

93.3 KB Created: 2021-06-06 00:43:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0d282f2ce55dc540978b9d8687a18538 SHA-1: 669cee8170db03e8c15a7a9f44230bd4c5042cb3 SHA-256: da8571f88cd8796f3c9a92fa90d60e8cf1f7721342482d697ad72ef2662ffe3d
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of a large number of external links, including a link farm, suggests an attempt to direct users to potentially harmful websites. The heuristic 'PDF_SEO_LINK_FARM' specifically points to a large number of external PDF links, some of which are likely malicious. The embedded URL 'https://maypoin.ru/123?utm_term=descendants+2++utorrent' is a primary indicator of a potential phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=descendants+2++utorrent
    • https://xonutupusuvulin.weebly.com/uploads/1/3/1/8/131871786/6879555.pdf
    • https://fanivimijebi.weebly.com/uploads/1/3/4/5/134594820/2e3700e93.pdf
    • https://filajusarapobu.weebly.com/uploads/1/3/4/7/134761194/c73fecb9.pdf
    • https://xoduwotef.weebly.com/uploads/1/3/5/3/135328954/1424188.pdf
    • https://xuxulavadimuxa.weebly.com/uploads/1/3/4/2/134234789/ef98738f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wirabofitox.pbworks.com/f/active_vs_passive_voice_lesson.pdf
    • http://maxasol.pbworks.com/f/kodak_esp_3250_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/786c7e47-4bb6-4d7c-b288-3b69c15accbf/how_to_do_debits_and_credits_in_accounting.pdf
    • https://uploads.strikinglycdn.com/files/f9af1b32-4897-4820-af7c-fb56957a3843/international_journal_of_pharma_sciences_and_research_abbreviation.pdf
    • http://togusan.pbworks.com/w/file/fetch/144686049/what_are_the_duties_of_an_internet_sales_manager.pdf
    • https://uploads.strikinglycdn.com/files/75cc4bf3-b8ed-4548-8e31-5107d029a2ff/69535269527.pdf
    • https://uploads.strikinglycdn.com/files/2082d26f-d7a9-40d6-a5f4-939ed4c52907/what_is_spiral_dynamics_integral.pdf
    • http://viluxese.pbworks.com/f/66183914971.pdf
    • http://jesababa.pbworks.com/w/file/fetch/144414360/what_is_the_prognosis_of_sickle_cell_anemia.pdf
    • http://nilanom.pbworks.com/w/file/fetch/144415713/how_to_use_the_i7s_tws.pdf
    • https://uploads.strikinglycdn.com/files/fdc9e5be-4e28-426f-b76e-91f3b55a2525/livilizafe.pdf
    • http://jebusolole.pbworks.com/f/8540392094.pdf
    • http://dewubuk.pbworks.com/w/file/fetch/144657216/how_does_jack_change_in_lord_of_the_flies_quotes.pdf
    • http://kafunujazuwo.pbworks.com/f/53731289980.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0bc.bin
ade4e2dfdcdf2f3c65fd45c0a3e101c5210dc111864cfdf8fe55fff3e00be54e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0BC 4868 bytes
font_01_sfnt_off00010106.bin
7739432808785c5d812aad0cd9056c4be64d9d8bce42bd5fe95da02c8c45342c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10106 19848 bytes
font_02_sfnt_off00013221.bin
7deab06ab1ca9017969a4522856d6f7d8ec1f877aac94e7f11f96d4cb6145f82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13221 11656 bytes
font_03_sfnt_off000159e2.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x159E2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.