Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1110a1e7d087e24…

MALICIOUS

PDF

65.7 KB Created: 2021-04-27 09:58:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: b5f9f7d499163e6b02b4d31d78182b1d SHA-1: 26eb893ef6606ce1b78de31057bb504ed488d8cc SHA-256: e1110a1e7d087e24df8b6426794c9bbc12f514226c8c6fb73280728713cc9caf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, with a significant number pointing to potentially malicious domains, suggesting a link farm or phishing infrastructure. The document body, though heavily obfuscated, contains references to 'Powerscribe 360 user guide', likely a lure to encourage users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=powerscribe+360+user+guide PDF link annotation
    • https://koxagirokutan.weebly.com/uploads/1/3/4/6/134625301/2124758.pdfIn PDF document text
    • https://cdn.sqhk.co/wamedexipun/cr7hhAA/803542137.pdfIn PDF document text
    • https://cdn.sqhk.co/lexelinowe/bwzzD8c/xcom_enemy_within_console_commands_steam.pdfIn PDF document text
    • https://cdn.sqhk.co/mumeriretepi/gfWmDhC/74050741877.pdfIn PDF document text
    • https://segurabo.weebly.com/uploads/1/3/5/9/135964373/85db1c7b07f7.pdfIn PDF document text
    • https://cdn.sqhk.co/xonoguduzob/jhfidgg/jekivokelop.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3624421f-c5f8-4c40-b5de-fa79d46ae423/it_program_manager_interview_questions_and_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29f5d861-4bbd-4b2c-b57d-8049b578a8f1/wedorozenone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8378f08-57bb-46d5-b3d7-96222d6f8174/dark_sun_3.5_portugues.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33a4ba00-a506-4892-bfe7-241b39e027c6/17637200503.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/421ae28d-6802-4ca4-a956-3faaebaa7744/23607653191.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edbff8bc-de37-4cda-9cc9-7235894218f3/is_les_mis_on_netflix_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44c5d37d-ad06-4d9b-aa4d-4278682aa6ff/yes_i_do_in_spanish_wedding.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5d0563e-6890-487d-a33f-c64ab6ff90b3/fuzoviwubonafobem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/adc93921-652d-4b44-98a5-2ec4a883f56d/50898972174.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c261.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC261 5560 bytes
SHA-256: a131b08c89acd7cd09e5dd53264786ca14ade9b9450361f2c05706a3fff98308
font_01_sfnt_off0000d567.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD567 10304 bytes
SHA-256: 254f739a865bbe64fa2fcace26a7fb66c39697c281d88736717141ec07c2172c

Open this report in the interactive analyzer, or submit your own file for analysis.