Malicious PDF — malware analysis report

Static analysis result for SHA-256 dabf010bc28b8761…

MALICIOUS

PDF

86.2 KB Created: 2021-03-17 15:06:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b45f3237ce3192cca151fa2a3d320aa SHA-1: b2880395a7981a2433f4aa51504b32c8050e015d SHA-256: dabf010bc28b87616d570d23bdddf1cb6b52c5b3062e80f35db9a567242dced5
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The file contains a large number of external links, many of which are likely part of a link farm designed to deceive users into downloading further malicious content, such as the PDF found at http://pupovedifa.rf.gd/clinger-_cohen_act_implementation_guide.pdf. The embedded URLs and the heuristic firings suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=android+file+transfer+windows+10+free
    • http://trokot-shopnew.online/what_is_the_meaning_of_social_science_researchozpp2.pdf
    • http://sowivonowiso.iblogger.org/85784567112.pdf
    • http://reawont.online/wamarowupezy4xh.pdf
    • http://youtube-subscribes.com/definition_of_mitotic_spindle_in_sciencey8gai.pdf
    • http://sberbank.link/68751243439l1csy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pupovedifa.rf.gd/clinger-_cohen_act_implementation_guide.pdf
    • https://b4095e1f-5e43-4c35-8b28-ff0c3185c247.filesusr.com/ugd/9cc3de_8c723d2b188848d29b2b868d9930a323.pdf?index=true
    • https://70010cfe-69b1-4fe9-a336-bdfe2418dc1e.filesusr.com/ugd/f1d680_90ddc96f86794a2abb22a161591bd33e.pdf?index=true
    • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_eec9ab228f654483b453e3b9b95fbbfe.pdf?index=true
    • http://sasujawanolej.epizy.com/mibof.pdf
    • https://beea745c-e446-4317-9ad8-fe501d584c0a.filesusr.com/ugd/9196db_0f7312b475af4af7a5b8a8d5bd4814a8.pdf?index=true
    • https://s3.amazonaws.com/vokeri/80300721519.pdf
    • http://pumuvezanasen.rf.gd/what_is_the_best_website_to_make_photo_books.pdf
    • https://c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com/ugd/957c7b_c3b66380f43d49b8b41e7a3ebe0c1f27.pdf?index=true
    • https://63995da9-74be-4895-8497-a4fa53c9845d.filesusr.com/ugd/788c84_efde3bc38e1142cf96fdbe1fc8abe5e8.pdf?index=true
    • https://s3.amazonaws.com/subopukomanaw/engram_injury_report.pdf
    • https://s3.amazonaws.com/kozewuposoridil/2476119211.pdf
    • https://s3.amazonaws.com/lekizopiloref/462174033.pdf
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_9a4f9961c68a422ca728bed0d67efe28.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc9e.bin
d5eea08422064ffa3224de504b4bc4ec2f51ad0acac7fb446d716fba92088c96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC9E 5176 bytes
font_01_sfnt_off00010e61.bin
1ca16ce697c9f333018857740c8a6e68c3f6b416daec3cf4c7278ca9fc148b55		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E61 11764 bytes
font_02_sfnt_off000135eb.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135EB 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.