Malicious PDF — malware analysis report

Static analysis result for SHA-256 db9fc31e3aa0b582…

MALICIOUS

PDF

73.5 KB Created: 2021-06-05 08:01:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: da8de5802f033b9e1781b300ef693161 SHA-1: 99591666009c753927bd92993d93808c92a99537 SHA-256: db9fc31e3aa0b58260248570d9055d9b59c55835fea9698740e98e38517dd270
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to PDF files, suggesting a link farm or phishing attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=is+constitutional+carry+legal+in+tennessee
    • https://forelidik.weebly.com/uploads/1/3/0/7/130775511/222131.pdf
    • https://rurojuwonaluw.weebly.com/uploads/1/3/7/5/137510596/8842480.pdf
    • https://fevenegor.weebly.com/uploads/1/3/1/3/131380973/mamelonaroje-risuwevali.pdf
    • https://nodazijokavi.weebly.com/uploads/1/3/4/3/134315007/3593641.pdf
    • https://gofasajuv.weebly.com/uploads/1/3/4/3/134359632/toligewasegakodaxo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/eb278ee8-5e45-4a58-8918-9cd3bd6fc1da/microsoft_word_recovery_file_location_mac.pdf
    • http://sejiliki.pbworks.com/f/nidatepudom.pdf
    • https://uploads.strikinglycdn.com/files/15816ae2-67c6-45bc-b914-b33e18fe1021/57748060329.pdf
    • https://uploads.strikinglycdn.com/files/e1bb5ef6-49cc-49aa-a9c0-a950edcde9b6/48189058133.pdf
    • https://uploads.strikinglycdn.com/files/7ed84d1d-9f77-4f3d-8915-ff5d1c9793b9/50_shades_darker_movie_download_worldfree4u.pdf
    • https://uploads.strikinglycdn.com/files/3cbb3601-6a3f-40f5-8d74-dba3442ae063/56167412418.pdf
    • https://uploads.strikinglycdn.com/files/2210bf65-eae9-484d-952c-21875dfb1b10/43025856604.pdf
    • https://uploads.strikinglycdn.com/files/400456f7-e994-48b0-ab4f-b595197123dc/demogegaxurutuwewapidesa.pdf
    • https://uploads.strikinglycdn.com/files/65e7e2b9-60fe-4370-9066-4586bb4a3900/fofomad.pdf
    • https://uploads.strikinglycdn.com/files/ff218302-8832-4a16-aa02-bd1a64229c1d/what_is_junie_b_jones_real_name.pdf
    • https://uploads.strikinglycdn.com/files/ef3cf096-aec5-4655-bf66-76bdf059f008/expository_essay_topics_for_7th_graders.pdf
    • https://uploads.strikinglycdn.com/files/df7160b9-99d6-4a28-8676-710ccf6c3f27/nonesirinewivaj.pdf
    • http://tefimemovem.pbworks.com/w/file/fetch/144618063/rovafadiru.pdf
    • http://vulazojab.pbworks.com/w/file/fetch/144545235/reading_comprehension_exercises_with_answers_grade_6.pdf
    • https://uploads.strikinglycdn.com/files/6d69c7ee-9ac2-4086-bae6-27df5747d439/why_my_tv_screen_is_black.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4b7.bin
8bcd2314b3f6e72724d5f61f644be8337dfe6df9508934cc9eaecb527c2bdeab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4B7 5004 bytes
font_01_sfnt_off0000f5d8.bin
079abc907e1cfa33be375c1d37590da1c3de09ded51996e2dca0665444c5f100		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5D8 10136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.