Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfaf302c1c38d2f2…

MALICIOUS

PDF

99.8 KB Created: 2021-03-31 01:31:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9a04addc3b119d48e9e1d725f4580fc SHA-1: b1343e0e2798e12d6e0b23a2f08b696100ac81f9 SHA-256: dfaf302c1c38d2f28af9adb6f75b0347ecf9f2cbf0f2fb80f05c1f72821ce562
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers indicate a high probability of maliciousness. The document contains a large number of external links, suggesting a link farm or phishing attempt. While no scripts were directly extracted, the presence of external URLs and the heuristic 'PDF_SEO_LINK_FARM' indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=bach+chaconne+pdf+piano
    • http://pozufopajosel.mypressonline.com/surah_al_waqiah.pdf
    • https://cdn.sqhk.co/zaweniwefi/w2kijhd/36428222891.pdf
    • http://delozofize.scienceontheweb.net/89601716408.pdf
    • https://cdn.sqhk.co/vanujapuduti/hS8vgiE/sniper_killer_shooter_3d_mod_apk.pdf
    • https://cdn.sqhk.co/mesafovojifo/bhuKjcy/ruduwuzovofan.pdf
    • http://nemosixumeki.mypressonline.com/mawupaj.pdf
    • http://dipenoguzel.sportsontheweb.net/75188168240.pdf
    • http://sekatiduzogi.22web.org/medical_dictionary_download_free.pdf
    • http://nisefobodidave.22web.org/yo_soy_tu_amor_en_ingles.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jatijunulefare.epizy.com/artificial_neural_network_rapidminer.pdf
    • https://e5720c39-3c1c-4a52-9be9-509675281b5a.filesusr.com/ugd/0010c8_6b143c1944cc4acd88b87e1c95a616d8.pdf?index=true
    • https://22520ec4-2132-45a5-98b8-54db1b71d3ea.filesusr.com/ugd/b33b96_c00f75f1fbb9463d906171fbe089ac48.pdf?index=true
    • http://libowilibedu.epizy.com/wugezezanek.pdf
    • http://pozijawikubinun.myartsonline.com/dofotiba.pdf
    • https://000bb656-a8cb-4e8b-9327-0b0ec99f56fe.filesusr.com/ugd/3f812e_5d9db10274b34a7bb2fcbbb1b5beef07.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e5f9b20e-8e5e-4a0b-86bf-11190211a177/crazy_kind_of_love_movie_plot.pdf
    • https://uploads.strikinglycdn.com/files/771cacf6-aba2-4d0c-9ea2-f8b02cf66267/pubefurogudijosub.pdf
    • https://uploads.strikinglycdn.com/files/49f1d537-0ae4-4e2f-b471-775d1978925c/duzipawemugopapasi.pdf
    • https://uploads.strikinglycdn.com/files/de9dada0-b7dc-4f18-aa49-b5e440418524/60779447166.pdf
    • https://uploads.strikinglycdn.com/files/92ac3284-bb2d-4271-9fae-b66b97c6f64a/cuales_son_los_pasos_del_proceso_de_investigacion_cientifica.pdf
    • https://uploads.strikinglycdn.com/files/eaa1357c-5b5a-4226-b5e0-733c94b11c1a/lg_fridge_service_centre_near_me.pdf
    • https://uploads.strikinglycdn.com/files/ffd00a1a-d989-4410-afab-4b2812e559a3/80819885866.pdf
    • https://uploads.strikinglycdn.com/files/2a4054b2-20a4-4286-8a32-c0ef4ccfd718/chilam_balam_restaurante_barcelona.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000131bb.bin
6786f573f93dfb889a72e9603b886799b10a59136333966f20ed60e912c2a238		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131BB 4988 bytes
font_01_sfnt_off000142bc.bin
44666af6f7541d2a08a8c0bf6ac280a191e1c339fc82ec37024bea5c16f110d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142BC 11780 bytes
font_02_sfnt_off00016a6c.bin
f0d7227652c39c0ed3a674eb50801baccdef2bbf27cbfcf74ce440b78e632b52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16A6C 16184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.