Malicious PDF — malware analysis report

Static analysis result for SHA-256 de3b3d12e9218295…

MALICIOUS

PDF

76.0 KB Created: 2021-03-06 18:38:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78fcbc24eb8a343a6d124b31b37ee828 SHA-1: e14371f4869cfed7de46731ce751e5459c7a88d3 SHA-256: de3b3d12e92182951ad0942291881126e8dd384dfd1b7d7f20297864409b782a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified as a link farm, directing users to various PDF files hosted on external domains. ClamAV and ML classifiers strongly indicate maliciousness, specifically flagging it as a phishing trojan. The presence of embedded URLs and the link farm structure suggest the primary purpose is to redirect users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/wix?keyword=01.06+the+historians+clues
    • https://cdn-cms.f-static.net/uploads/4465707/normal_60145a2e3442a.pdf
    • http://jawixogu.mygamesonline.org/motejixupuxixodila.pdf
    • https://cdn-cms.f-static.net/uploads/4379848/normal_6040d5e0a9239.pdf
    • https://fowuwulavo.weebly.com/uploads/1/3/4/7/134754099/c64c3e.pdf
    • https://fuwiposodunumof.weebly.com/uploads/1/3/1/4/131438128/4923100.pdf
    • https://cdn-cms.f-static.net/uploads/4465907/normal_6021655048d75.pdf
    • https://lemefiware.weebly.com/uploads/1/3/4/0/134017231/925e2712.pdf
    • https://cdn-cms.f-static.net/uploads/4393029/normal_602977f743452.pdf
    • https://cdn-cms.f-static.net/uploads/4375514/normal_602462de831fa.pdf
    • https://cdn-cms.f-static.net/uploads/4366337/normal_6016a9b1c38d7.pdf
    • http://jiwabozaxexe.mypressonline.com/96581389755.pdf
    • http://vpntop.info/sap_material_requirement_planningvqnsf.pdf
    • http://dsv-trening.ru/63169874840a62xq.pdf
    • https://static.s123-cdn-static.com/uploads/4389353/normal_5ffe30c20350e.pdf
    • https://static.s123-cdn-static.com/uploads/4408177/normal_6008dbd0c1699.pdf
    • https://static.s123-cdn-static.com/uploads/4415944/normal_5ffefa14c1abd.pdf
    • https://cdn-cms.f-static.net/uploads/4417656/normal_5fd68d8b64e2b.pdf
    • https://jewefero.weebly.com/uploads/1/3/1/3/131383264/ridusujeji_bufatawulaw_fomefiwukike_xitixuvokalep.pdf
    • https://cdn-cms.f-static.net/uploads/4369168/normal_6035aaa47097a.pdf
    • http://retamos.mygamesonline.org/how_to_change_crane_scale_from_kg_to_lbs.pdf
    • https://cdn-cms.f-static.net/uploads/4530323/normal_600b2a80cf2de.pdf
    • https://donabetolemi.weebly.com/uploads/1/3/1/6/131637402/4640942.pdf
    • https://static.s123-cdn-static.com/uploads/4494417/normal_5ffdc8103c572.pdf
    • https://static.s123-cdn-static.com/uploads/4487186/normal_6007cb478a9be.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://supuwevul.atwebpages.com/garmin_echomap_plus_94sv_livescope_bundle.pdf
    • http://tiluxusimutine.atwebpages.com/96982982481.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed95.bin
058a3f09978cfe176a2f9090f222cfbe2e73824d8d09eb6aed541796348c16df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED95 5172 bytes
font_01_sfnt_off0000ff2b.bin
776bc3f84a644515bed3a5b586d07f75fac5a031fb11d3027bbadc1dea127533		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF2B 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.