Malicious PDF — malware analysis report

Static analysis result for SHA-256 e03372d6c779066b…

MALICIOUS

PDF

81.8 KB Created: 2021-03-23 04:15:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b3fd0b02e94ba7e46902afeb38413cc SHA-1: 8ee4e24010f238f7eb762035d2c0bf6d0e081bdc SHA-256: e03372d6c779066bd0548b45d05b564c0b60bc3896d8b5d9bf0cb14cccc0b4a1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a 'PDF_SEO_LINK_FARM' which indicates a large number of external links, with one pointing to a suspicious domain. The 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' heuristics further confirm its malicious nature. The embedded URL suggests an attempt to redirect the user to a potentially harmful site, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=emotional+intelligence+test+pdf
    • https://cdn-cms.f-static.net/uploads/4421336/normal_6040a1c936779.pdf
    • https://cdn-cms.f-static.net/uploads/4450898/normal_5fd9de567adba.pdf
    • https://static.s123-cdn-static.com/uploads/4502819/normal_6001be716f9a4.pdf
    • https://cdn.sqhk.co/tamejenonisi/gjghM6j/synonyms_of_good_politics.pdf
    • https://cdn.sqhk.co/gasajolop/eghjegg/setafufuzazusoborura.pdf
    • https://cdn.sqhk.co/sasimidiweg/hgQ9hca/48690248756.pdf
    • https://cdn.sqhk.co/nugizape/j5nhhhj/slap_kings_mod_apk_no_ads.pdf
    • https://cdn-cms.f-static.net/uploads/4451348/normal_605899563f609.pdf
    • https://cdn.sqhk.co/diwamukef/qVtjhiq/wudevobinelujoneboxorijo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/cb0418e4-65c3-4c63-8494-5033aa76bbcd/kiret.pdf
    • https://uploads.strikinglycdn.com/files/9a95180c-4d68-4d09-b9c5-ee5a0fa2fe6e/idaho_state_hospital_blackfoot_id.pdf
    • https://75a697d3-84f0-44cf-bab9-f05e37020c50.filesusr.com/ugd/7c3584_a76b476b5a5647daaba776fe2fe4e30f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9b49d9d3-ce6b-4cfa-b700-646d328efc48/how_to_use_avent_manual_breast_pump_video.pdf
    • https://5e1449e8-5ae4-4a15-bc7a-ee23795bc964.filesusr.com/ugd/3a34a5_5992d00738084c6a83831b1e80fed6dd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9e76a219-46e7-42de-8c04-261795d92926/modujerifokovewatap.pdf
    • https://fb075467-9d00-46c6-93ac-2b777f5e584b.filesusr.com/ugd/8bcd66_e6bc07cd04504fc8bc08adfa5a411294.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c1c7e98c-c3fa-490b-8b46-98358fcffe29/71174103787.pdf
    • https://uploads.strikinglycdn.com/files/aebcab55-0088-49c0-b30c-a68738e97028/25274220486.pdf
    • https://uploads.strikinglycdn.com/files/da48f82e-1128-4b14-b2cb-5cab9f3c1846/81164273585.pdf
    • https://bea00909-aa88-4d38-ac88-e56db460b486.filesusr.com/ugd/923104_8fe505e2dd384fd88f7785b954026e1f.pdf?index=true
    • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_f819b0168d16481c834d5cdd65384d9d.pdf?index=true
    • https://c580675e-8888-491d-8c80-3106eaac86fb.filesusr.com/ugd/c8a981_61499d1cb94344919def59ed89d5056a.pdf?index=true
    • https://e6f9d1db-9bad-45ba-a188-0e8e378e8087.filesusr.com/ugd/99b222_345a399ea55b49178e8f582bfed4b624.pdf?index=true
    • https://91c7bc9f-df77-4dbd-ae51-8bcf521f3e61.filesusr.com/ugd/1df9ea_e1fd9d8fe291473c942d0800853fbf0b.pdf?index=true
    • https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_95ee6775350b46be978c5345c16fd558.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f444.bin
5ae43b685ff6329064643db195c55a00d1e5d7ed241b19528449a9a8c2ddb354		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF444 5124 bytes
font_01_sfnt_off0001059f.bin
6c13201aa1ec190705e6ffdd6fe7c59d8d27c71a4ec54fe11c136e145e374506		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1059F 11000 bytes
font_02_sfnt_off00012b0e.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B0E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.