Malicious PDF — malware analysis report

Static analysis result for SHA-256 e13682a9a3bf1fe6…

MALICIOUS

PDF

69.9 KB Created: 2021-03-16 03:51:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f8519c46ffe4e814a2b964ec27853ae SHA-1: 1d1418ea46a1f18d92f1df1353e2d881ca3e1ad4 SHA-256: e13682a9a3bf1fe64426997b7608da9aeb5df557ef9fb13055a1edab0c6c3ddf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to benign content, but one suspicious URL (https://dafemum.ru/wix?keyword=magnavox+32+inch+tv+manual) is present and labeled as unknown. Heuristics indicate a link farm and a phishing/trojan detection by ClamAV. The document body is heavily obfuscated, but the presence of external links and the heuristic firings suggest a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=magnavox+32+inch+tv+manual
    • https://xepesirivow.weebly.com/uploads/1/3/1/4/131408502/8df9b267b8.pdf
    • https://napolapivu.weebly.com/uploads/1/3/5/3/135303388/768726.pdf
    • https://marizezibafive.weebly.com/uploads/1/3/4/8/134865590/4870232.pdf
    • https://waxevinibiwe.weebly.com/uploads/1/3/0/9/130969944/1885628.pdf
    • https://ruvetuse.weebly.com/uploads/1/3/4/6/134618438/7185092.pdf
    • https://wajirabipuxu.weebly.com/uploads/1/3/0/8/130874591/mibakegomebima_wujimifejazowi_jelodelelomereb.pdf
    • https://joxoxego.weebly.com/uploads/1/3/4/6/134664344/8440962.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_af8d828480b6446cb6ea75929626558d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ee3e60de-b174-4783-accf-e8eb31b191f8/when_to_harvest_sweet_potatoes_in_texas.pdf
    • https://uploads.strikinglycdn.com/files/e3216b56-4583-4767-a1bb-4ab7d7fadcf5/famous_writers_in_english_literature_21st_century.pdf
    • https://uploads.strikinglycdn.com/files/ec3f6c42-667a-4bd6-8eae-e66b4ec61b33/how_to_unlock_door_on_maytag_front_load_washer.pdf
    • https://uploads.strikinglycdn.com/files/59ed52ab-de2e-44c1-85cc-6ffe03308cab/science_of_mind_magazine_daily_affirmations.pdf
    • https://88749095-6fd7-453f-8e8a-15b48fe47dd1.filesusr.com/ugd/e4d7df_461319afcd9b4851b611a4380fd576ec.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c7ee63da-12cf-42f3-815b-14ab9835e884/does_jersey_mikes_have_gluten_free.pdf
    • https://uploads.strikinglycdn.com/files/b8407ced-7017-454b-89c0-be862d5c255e/lubasodogukedomupavafibo.pdf
    • https://uploads.strikinglycdn.com/files/b83d5c14-2494-4a9b-8e06-948774d88e2d/how_to_get_a_vet_assistant_job_with_no_experience.pdf
    • https://uploads.strikinglycdn.com/files/759974d5-5a16-415b-b725-9473c357f50a/fikabezamusawubodixobiwed.pdf
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_7247a0b2a3b54bf3a320d2faaeeed622.pdf?index=true
    • https://s3.amazonaws.com/wukevirenesu/gusazubitumufuze.pdf
    • https://uploads.strikinglycdn.com/files/a4764d67-7f56-47d3-be15-0c994c8dc594/kopej.pdf
    • https://s3.amazonaws.com/sifawekujiki/20787379788.pdf
    • https://s3.amazonaws.com/polojuliragam/gate_2020_form_notification.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c819.bin
b5e22a575d59af6b365077cb0e684b32afdb463e143c75a1995a5958bea3f0d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC819 5132 bytes
font_01_sfnt_off0000d976.bin
34c4a781a2177ce1313c5757a5af14ce7fc35fdc01fee0628ae2b821e0e561d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD976 10132 bytes
font_02_sfnt_off0000fc15.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC15 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.