Malicious PDF — malware analysis report

Static analysis result for SHA-256 e27902c3bc66d4c7…

MALICIOUS

PDF

81.1 KB Created: 2021-03-09 17:58:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 414e139d75eca58885b7e968ed3a59fa SHA-1: 50a12c82bb9e9a8d1a9d1bcec338bb0102502b18 SHA-256: e27902c3bc66d4c78d241c41aff39de88339d051c7369a6f51a887452a3adb9f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm designed to redirect users to potentially harmful websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The primary malicious URL identified is https://resalured.ru/award?keyword=berserk+manga+tomo+1+pdf, which is likely used to distribute further malware or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=berserk+manga+tomo+1+pdf
    • https://cdn.sqhk.co/vikoparif/dNjgiar/67289829949.pdf
    • https://cdn.sqhk.co/sogefuluf/jjzCXhf/83766660639.pdf
    • https://cdn.sqhk.co/tokejosanawo/eW0iggf/5440277569.pdf
    • https://cdn.sqhk.co/kibutonap/fXRUZzr/moments_choose_your_story.pdf
    • http://viniveba.mywebcommunity.org/44003602038.pdf
    • https://cdn.sqhk.co/wifinalimow/gjJhAji/hot_wheels_pixel_shaker.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://31c8a3d4-0132-49f1-a04f-09c79d03e01f.filesusr.com/ugd/a4da84_f9ab4d202c0040fbb43d5fced19b6390.pdf?index=true
    • https://979cd01f-16ea-4d2c-b189-234964c95597.filesusr.com/ugd/d4c4cf_3deb2946d1124b87b6d41777d2007ac9.pdf?index=true
    • http://zilisidojaze.myartsonline.com/isostichopus_badionotus.pdf
    • https://uploads.strikinglycdn.com/files/8edd67e7-ee2f-482a-b8b2-e2415685515d/72978568380.pdf
    • https://d6b7b3c7-8429-4d82-9d75-5d5d09e763cc.filesusr.com/ugd/a8c229_5004b9ea874a4689a4b17057cc945e5e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f88ff962-4b2c-4758-a67c-cc0856101527/cells_alive_meiosis_phase_worksheet_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/e8728146-42e0-4cd8-abd9-9a5561bfd24b/dexonesanijedalodago.pdf
    • https://uploads.strikinglycdn.com/files/d9e47f0c-1c17-4f2e-a035-23450480a2df/25771381449.pdf
    • https://a9864912-ad24-422b-99f3-2d90f7703507.filesusr.com/ugd/d6af85_2c68e519120a4d8abc58c28965b120a4.pdf?index=true
    • https://8e8ef6ac-913c-489f-8395-c30730e7ba0a.filesusr.com/ugd/f39c52_a17c472526cb48b29a6d05d400b8c8ce.pdf?index=true
    • http://fuwutowamig.myartsonline.com/barbarians_of_lemuria_mythic.pdf
    • https://s3.amazonaws.com/rubidokezive/how_to_use_p_touch_1000_label_maker.pdf
    • https://c83cbd6e-a134-4b49-ba12-49f24c654ad9.filesusr.com/ugd/904a8b_abdff25af3ec4933ad8c5627c41d8c38.pdf?index=true
    • https://eb62986f-0112-409a-9ebe-777412bc5c19.filesusr.com/ugd/26938b_0497bce599c6488cb5f9814c5587bb8f.pdf?index=true
    • https://99442e0c-e188-470f-b1e9-a2082f9e7f28.filesusr.com/ugd/2274a7_88a74f88c5c2404badfc5a10ad15fd54.pdf?index=true
    • https://s3.amazonaws.com/radubozufiwo/36653213792.pdf
    • https://1a9cd40a-f0d6-44d4-a143-19288280ca2b.filesusr.com/ugd/7a13df_2463c52364ee4a85bac5b7296af23c56.pdf?index=true
    • https://0f0532cb-4478-41f9-91a1-cf277c4732ec.filesusr.com/ugd/8acad3_788b5e15cd204a489ba3fadea2863189.pdf?index=true
    • https://s3.amazonaws.com/poresi/electronic_signature_policy_for_medical_records_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7d5.bin
9418d0cf4ae8c7403a26521f11ae83e4cab911df5130df390b9ec5fb115b418c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D5 5496 bytes
font_01_sfnt_off0000fa7f.bin
9444813e63a2f148913e2a36f78608a77046d2e5ab01559e248f84b75cec825b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA7F 10384 bytes
font_02_sfnt_off00011e4a.bin
85c94fc111484d73a468a4f0aebb65e2efced8bbdc9299e501605211a9a6f78a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E4A 16992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.