Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5d189977c62cfda…

MALICIOUS

PDF

76.3 KB Created: 2021-03-08 00:12:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f9f48bc1626889e2ebe8bb7a876544ec SHA-1: 4e97614bf5d071b917cabb6fcb0cdcc9fbea85f9 SHA-256: e5d189977c62cfdaffee93cc940a68f48cfc4da953e4ba3dab589935d8d0db29
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains a large number of external links, many of which point to PDF files hosted on suspicious domains, suggesting a link farm or a distribution mechanism for further malicious content. The document body, though heavily obfuscated, contains metadata related to wkhtmltopdf and a stock market crash query, which may be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/aws?utm_term=1929+stock+market+crash+chart+compared+to+2020
    • http://nikaold.site/4116756689267hdf.pdf
    • http://aromaita.space/52639079671pkito.pdf
    • https://videxopefofima.weebly.com/uploads/1/3/4/1/134131768/4941779.pdf
    • http://akmurzina.com/katilogawezuxumif7m5e.pdf
    • https://cdn.sqhk.co/pekobenew/KTijajE/kefibutitid.pdf
    • http://service-hire.com/photo_grid_video_maker_apklandu.pdf
    • https://cdn.sqhk.co/jagibuvat/piagfhg/towupujomumawufijox.pdf
    • https://dibekojiworibo.weebly.com/uploads/1/3/1/6/131637919/2299440.pdf
    • https://cdn.sqhk.co/vimerokil/Tu6gjgi/gajulolakotuzejajefujotum.pdf
    • http://copyrightsafetyhelps.com/nms_frigates_guide9a8pg.pdf
    • https://cdn.sqhk.co/timugulirebu/hgghihc/business_strategy_game_quiz_1_2020.pdf
    • https://cdn.sqhk.co/bapisolel/xgf7d4y/3d_pipe_bender.pdf
    • https://gipofomodofomew.weebly.com/uploads/1/3/2/3/132303323/873830.pdf
    • https://cdn.sqhk.co/mekaxuzoxu/7gitmhj/refozujijurodokumo.pdf
    • https://wuwiragirek.weebly.com/uploads/1/3/0/8/130874366/5207778.pdf
    • https://cdn.sqhk.co/fogibadeku/jKTmoja/on_my_block_age_cast.pdf
    • https://pezomivagijo.weebly.com/uploads/1/3/5/3/135392772/xoraloremunugof_vilurimo_deradejumokirow.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/893de593-8745-4333-bb4d-85e0818ed2d3/scott_cunningham_causal_inference_mixtape.pdf
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_00038210d77d4b62b0a5c6a3a9cd2143.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7cafc718-1524-4a9a-a0d0-938f4896c05d/george_m_lamsa_idioms_in_the_bible_explained.pdf
    • https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_8ffa6ecacbde4b43a0939d660691a295.pdf?index=true
    • https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_752c104139c44a118627c708baf05b31.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7e8a54f9-d6c6-4b95-81e1-83cac0f8840e/build_multiband_delta_loop_antenna.pdf
    • https://uploads.strikinglycdn.com/files/3a9080d2-be52-44a2-8ddb-b6b163b5bb61/2008_jeep_wrangler_unlimited_x_for_sale.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5b8.bin
ffb0d9ff311392a8ce58e1090ef304e742aac600645d16205725e3c7f14e12f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5B8 5732 bytes
font_01_sfnt_off0000f90f.bin
5994abbe6cf565b11d9be3896918a7741c42fd3531ea46a2d7b60fed9b9a2d84		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF90F 13200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.