Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbef7c719bd17f14…

MALICIOUS

PDF

72.4 KB Created: 2021-03-09 17:51:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a696e4a58399bbc80742a08c99856432 SHA-1: a933d533b8b1ecd9dcbbf0cd8540548c633b5f9f SHA-256: dbef7c719bd17f14b913b5d0af21b0eed3fb540d91fa91982826f6a09f313c4b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm designed to redirect users to various PDF files. The presence of a URL related to 'Acronis true image 2016 software' suggests a lure to download potentially malicious software. While no scripts were explicitly extracted, the PDF structure and extensive external linking are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=acronis+true+image+2016+software
    • http://minomesiguziv.22web.org/diretalapememijupezo.pdf
    • http://delunabiwefepef.22web.org/69675937162.pdf
    • http://ritixibetono.mygamesonline.org/the_raven_queen_warlock_patron.pdf
    • http://nomenowunesazoz.scienceontheweb.net/positive_behaviour_support_strategies_for_toddlers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://03dfb0eb-7fe6-4188-ad87-ea2b88df7b19.filesusr.com/ugd/f967ac_83b66cd31978451aa981f5859dc2e217.pdf?index=true
    • https://e2a12503-e9f4-4898-9b1e-00959bf5a9c8.filesusr.com/ugd/1f0de7_2a0ff995e0644188b821e88ff6865660.pdf?index=true
    • https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_0606c2c98ca3424d9b46e14782418ddb.pdf?index=true
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_1362ec79cd7340cebab1e6aea15cecc0.pdf?index=true
    • http://nalejunubotuw.rf.gd/desalosuxigobolemi.pdf
    • https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_7af726c01c074390b18de143a1f784c9.pdf?index=true
    • https://s3.amazonaws.com/davubewu/xavixovezazero.pdf
    • http://vubelifijam.atwebpages.com/switch_games_2020_rpg.pdf
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_efdddaaab59c42d1835abf6e429841cf.pdf?index=true
    • http://zabesawafusoxa.rf.gd/chupke_se_sun_song_pagalworld.pdf
    • http://kagilabitivibe.epizy.com/gajasevitikexuxa.pdf
    • http://vajapojaperusu.myartsonline.com/51768869669.pdf
    • https://s3.amazonaws.com/vexeliku/how_to_fix_fisher_price_rock_n_play.pdf
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_fc69717a57f940a7ba18b9587f1b19fd.pdf?index=true
    • https://95fbbc11-640f-4658-acdf-6e09da746871.filesusr.com/ugd/e42ee3_7461221ba0c24848b2a824bce8477dd6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc5d.bin
dc1e126ec8bdfa07d4e3458ee134984fbfe5dffc5ac87626205aec92b7feeb00		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC5D 5732 bytes
font_01_sfnt_off0000efe0.bin
2f9b4f2b2f4afc58195756e268686943c0166b8f25685e04f252f9c00f917001		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE0 10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.