Malicious PDF — malware analysis report

Static analysis result for SHA-256 db2be36bb057c08b…

MALICIOUS

PDF

92.3 KB Created: 2021-03-27 18:56:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b0019ac40953fcd1df40aa00470280b SHA-1: 11986d2bf2b57b80b36a69dfffd7b1ee88d883a5 SHA-256: db2be36bb057c08b9a8f3f60590481a1b2f34fb2673a235930780f28a9ac5f6b
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for phishing or directing users to malicious sites. The heuristic 'SE_INVOICE_LURE' suggests a fake invoice or payment lure, which aligns with the presence of external links. While no scripts were explicitly extracted, the PDF structure and link farm indicate a malicious intent to redirect users. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=is+dhgate+legit+2020
    • https://narapafugoziror.weebly.com/uploads/1/3/0/7/130775848/wodibile_gunisatatone.pdf
    • https://cdn.sqhk.co/mewedenemez/jehcrNd/tumefojafalilirazavomolik.pdf
    • https://cdn.sqhk.co/vilubofi/chejjGC/18925072484.pdf
    • https://vojutodebol.weebly.com/uploads/1/3/4/0/134096580/tunuk.pdf
    • https://xunerekube.weebly.com/uploads/1/3/0/7/130739532/1955565.pdf
    • https://cdn.sqhk.co/rixutixim/hatZjhp/line_graph_examples_with_questions.pdf
    • https://jowujutaxafekul.weebly.com/uploads/1/3/5/3/135348014/diziseluvugi.pdf
    • https://cdn.sqhk.co/jilanukubok/gc0ijic/ebook_akuntansi_keperilakuan.pdf
    • https://sefedajexoxoj.weebly.com/uploads/1/3/4/4/134479396/jemamunezaxuto_zowabaro.pdf
    • https://cdn.sqhk.co/luwesefizi/bjchhNO/90996339483.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e37f7d65-0a98-4601-86b9-cd2b9228808f/duwitan.pdf
    • https://uploads.strikinglycdn.com/files/a270a8e8-7124-419f-813e-50fc9439e2b3/meripetimewenotowol.pdf
    • https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_df75c166503040b0ae888ab9b62054e3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/301def8e-7b56-42c9-8a10-f7ef0302ecf7/19733896386.pdf
    • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_04fcbb4b0a5e48b297c0a6146ac7dd20.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8fc86d45-4aba-4fc9-980e-a0e151b7c226/56666549938.pdf
    • https://5613ab86-cfe5-4642-b9e1-29ab5e510d76.filesusr.com/ugd/79e000_c9730fe000d44ad1b8cd0586bf13dbd9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f75fbae6-9d6e-4213-887e-5cb091d87782/how_to_make_a_steel_column_in_revit.pdf
    • https://fb9345b8-40be-4608-a8ff-9c5427dba92f.filesusr.com/ugd/98d639_7eb77fd8152f49af8b6d85f5ab600035.pdf?index=true
    • https://7b4e975e-109f-4397-a679-93e438ff1453.filesusr.com/ugd/c33f71_1b9205df82ad44589649904b1ebb9ea5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a592f23a-d8cc-4ff6-b35a-da0f606fdfaa/how_to_use_adobe_draw_on_ipad.pdf
    • https://s3.amazonaws.com/sugowubuf/seven_little_words_answers_may_12.pdf
    • https://uploads.strikinglycdn.com/files/756d5fb7-8cf9-49a3-a92b-9340c2e00097/dinmicas_de_presentacin_para_adolescentes.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/18951939093.pdf
    • https://uploads.strikinglycdn.com/files/cf9256bf-a362-4e76-a24b-06cd37abda03/chess_puzzles_mate_in_2_moves.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001265d.bin
8bd0beee08cce823c24809d3391bb9eee4c63e46b2bbb2891ed9b6a03ff49ab4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1265D 5204 bytes
font_01_sfnt_off0001380b.bin
0ef14bf74a8d7a71381f0ac2233f3cbc690cc99cb3de55f9605f6d98bc626207		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1380B 12788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.