Malicious PDF — malware analysis report

Static analysis result for SHA-256 e56f4f525bc92196…

MALICIOUS

PDF

137.3 KB Created: 2021-06-06 21:09:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 864d80cf1ce23416f82095bf9c28bd13 SHA-1: 5710a4cca326a13739c3e0edf35e4452f9193d03 SHA-256: e56f4f525bc92196b4b57876630ea4ff5256869e9fb859b0781958e07b3a7ddd
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, identified as a link farm, with one primary URL pointing to a suspicious domain. While no scripts were extracted, the PDF structure and heuristic firings suggest an attempt to direct users to malicious or SEO-manipulated content. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=how+to+open+smart+watch+a1
    • https://xukizawumu.weebly.com/uploads/1/3/1/3/131380236/fapuwekedavol_xogudo_kogigoled.pdf
    • https://rojomitalo.weebly.com/uploads/1/3/4/4/134485393/dipalas.pdf
    • https://debaduvevuw.weebly.com/uploads/1/3/4/3/134383420/30dadf.pdf
    • https://votobadopa.weebly.com/uploads/1/3/1/4/131483772/930220.pdf
    • https://welawebunigekuk.weebly.com/uploads/1/3/4/7/134713971/330e4e.pdf
    • https://xowuxuwakewobi.weebly.com/uploads/1/3/4/8/134853014/voxozaxakudunawos.pdf
    • https://busuguzokiw.weebly.com/uploads/1/3/1/4/131406797/846357.pdf
    • https://nepufetok.weebly.com/uploads/1/3/1/4/131438640/6dbef1fb.pdf
    • https://likemojinefafus.weebly.com/uploads/1/3/1/4/131406739/39b481719213e.pdf
    • https://tasoxagizuj.weebly.com/uploads/1/3/4/7/134734804/56245f54dfe0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kokoxudalux.pbworks.com/w/file/fetch/144426018/58688280365.pdf
    • https://uploads.strikinglycdn.com/files/e5c2a63a-29a2-449e-bc32-f173a18a2e96/romeo_and_juliet_1996_full_movie_sub_thai.pdf
    • http://dadilotofexi.pbworks.com/w/file/fetch/144514122/malory_towers_3.pdf
    • http://nafidob.pbworks.com/f/accountancy_class_11_important_questions.pdf
    • https://uploads.strikinglycdn.com/files/8afca83f-15d5-47f3-8f91-adc2ea3d5278/99060206381.pdf
    • https://uploads.strikinglycdn.com/files/24b8c8ae-160f-41b5-8b45-b63981197542/rilixekemapozalif.pdf
    • http://vazesuna.pbworks.com/w/file/fetch/144499941/beauty_box_plugin_premiere_pro_free_download_mac.pdf
    • https://uploads.strikinglycdn.com/files/e1ea6a22-eb23-4bf1-9064-30de90617a93/baixar_harpa_crist_cifrada_gratis.pdf
    • http://sujagajo.pbworks.com/f/lesson_plan_on_adjectives_for_8th_grade.pdf
    • https://uploads.strikinglycdn.com/files/80b2e7d0-0e90-4cab-ae78-7b17cf5fe476/what_is_module_in_python_with_example.pdf
    • https://uploads.strikinglycdn.com/files/779fa84e-e58c-4070-bec8-5b4294f76da7/lazuso.pdf
    • https://uploads.strikinglycdn.com/files/285875a0-3adc-45ab-b8bb-4285a4998162/50550915468.pdf
    • http://podixarutib.pbworks.com/w/file/fetch/144451920/how_to_reset_hisense_smart_tv.pdf
    • http://movapog.pbworks.com/f/25276008467.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001cd69.bin
c8744325e4f963a40f969a10be9ae55e3a2ea04a3741d6c7a34904110b559c29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CD69 3868 bytes
font_01_sfnt_off0001db24.bin
5bebebf15b3a94b6a302573dd3678d6631e7d872849bd7e6c22c68e4a52757d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DB24 5244 bytes
font_02_sfnt_off0001ecdd.bin
d5f8edafe1f77a0f7346d373e16b19ebc7b13493cb76a4b5a56c1bf629065962		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1ECDD 12672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.