Malicious PDF — malware analysis report

Static analysis result for SHA-256 db5bf49c5f2c7829…

MALICIOUS

PDF

89.8 KB Created: 2021-03-16 02:37:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af31b7e6d9cc16803fac6448efa54c0e SHA-1: 9521c32cbb2c96bd6af5f7d29d909fe5f1e9d00c SHA-256: db5bf49c5f2c7829a69a2c38ce67564ea20b6ad2ec7a506e1bbe734cac5a370a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified as a link farm, and one specific URL points to a resource that appears to be a lure for downloading music. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or a scam. While no scripts were directly extracted, the PDF structure and embedded links suggest an attempt to redirect the user to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=descargar+musica+de+antony+santos+popurri
    • https://cdn.sqhk.co/nidaruzada/cjdNIyt/love_stars_happy_balls_brain_puzzle_game.pdf
    • http://shoop-ff.ru/38447721157iwjyj.pdf
    • https://cdn.sqhk.co/zolokike/jqR8igR/94648581827.pdf
    • http://mediaverifiedbadge.com/999312015919037s.pdf
    • https://cdn.sqhk.co/fefuxumito/oUfhiia/pogolemosa.pdf
    • http://dietnatur.fun/multiplying_and_dividing_exponents_free_worksheetslyacm.pdf
    • https://cdn.sqhk.co/zobelekivix/jibchiK/jolufapofirupisupozapiw.pdf
    • https://cdn.sqhk.co/febutatesu/hfjhCjc/alan_walker_remix_new_song_2019_mp3_download.pdf
    • https://cdn.sqhk.co/vifekodilevi/tjiTjbo/building_champions_loan_officer_business_plan_worksheet.pdf
    • https://cdn.sqhk.co/zuvaworizon/sajahhf/mobidolukinazawexavakago.pdf
    • https://cdn.sqhk.co/gobamagedesi/L8A0fge/instrumental_rap_trap_2019_download_mp3.pdf
    • http://tricitysikhs.com/yamaha_baby_grand_piano_gb1_pricer9apj.pdf
    • https://cdn.sqhk.co/gefeloxo/jiMwlRV/survival_raft_lost_on_island_simulator_mod_apk.pdf
    • http://study-english-05.site/jowuwivuwevevabrxs9c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_4293fcc273684fd3aaca94bbc0a38080.pdf?index=true
    • https://s3.amazonaws.com/gezetega/95467448735.pdf
    • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_ec009874772b4368b686b2612994ad00.pdf?index=true
    • https://s3.amazonaws.com/likadojivivofu/sulutivowivar.pdf
    • https://bf130ee1-1463-4c69-9604-1b23772ced92.filesusr.com/ugd/b4609a_0d3e2438cbef4ab1aa59eb0ab3c063ab.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9dc.bin
3d4760ca295192c89086870ebbac49c5a5945404ea6ab57fca452cf2db5f569a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9DC 6440 bytes
font_01_sfnt_off0000f9d0.bin
0d27b81200daa885f6dd7a333db15e076949310809e90dcf9765bfb1b8446ba3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D0 5460 bytes
font_02_sfnt_off00010c54.bin
9f92e0654c1e582ed295e80a6cacec9d253fabf071d66d4f6342525951131000		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C54 2676 bytes
font_03_sfnt_off000117ad.bin
ee5a0cddb554c07c7d468d33360396401a558c08de4459850fe3f305b5781cf1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117AD 11896 bytes
font_04_sfnt_off00013ec5.bin
07cb34b00b7d8cc8640cf9cd2e16338b0aefed2e4d1928b1e3c34ef080187915		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EC5 17180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.