Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6992de282f02745…

MALICIOUS

PDF

116.6 KB Created: 2021-03-17 12:45:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b8bbddfc17e326352c91183a7fe7b08 SHA-1: 183392ab6c5eb05756d842f1345d020f5d366775 SHA-256: e6992de282f02745478e6fbb4ad4ba64cbdaefeac27405729b72be96945a3bf6
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file exhibits characteristics of an advance-fee scam, using lures related to lotteries, prizes, and parcel delivery. It contains numerous external links, suggesting a link farm designed to distribute malicious content or redirect users to phishing sites. While no scripts were explicitly extracted, the presence of PDF_URI and ML_NYX_PDF_MALICIOUS heuristics, along with ClamAV detection, strongly indicates malicious intent, likely involving the exploitation of PDF vulnerabilities or the delivery of further malware via the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=multi+armed+bandit+pdf
    • https://cdn.sqhk.co/bimonabozo/ib6jG6i/40050049565.pdf
    • http://drnextact.xyz/hypercube_evolution_build_guidepaf4x.pdf
    • http://rollernefrit.xyz/ielts_answer_sheet_writing_task_2dxuiz.pdf
    • https://cdn.sqhk.co/xupixawina/35Pgcjj/college_essay_template.pdf
    • http://eushopvmn.site/residential_lease_california_association_of_realtorswj5sy.pdf
    • http://prostochillforum.fun/stachys_hummelo_perennialx1uhr.pdf
    • http://goodsun.space/el_proceso_de_investigacin_cientficaa5jey.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1c514d3f-4aca-4c14-a2cc-94ef866bc6c7.filesusr.com/ugd/860217_aa1e3decd1db437596381f43dbc94c9c.pdf?index=true
    • https://a765b249-d442-4b07-8ea9-8318d996b894.filesusr.com/ugd/902d29_e6682c0cee9844ff9867bb4ea5a0f568.pdf?index=true
    • https://b5c4f4dd-ae1f-4f6a-908c-f463551224e4.filesusr.com/ugd/dafd60_a70010c4fdfc437fa0df1ecba9b1c8c8.pdf?index=true
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_db5a30bbf7dc449687df8d1f82e41a71.pdf?index=true
    • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_7f59c86c9a8e423ba14184ef91557694.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d7872bbb-44a2-4e06-9273-3c9f589c0bf5/viresogafupaderakajaxomo.pdf
    • https://uploads.strikinglycdn.com/files/4ccdc8cf-ddbe-42b5-9cca-99fb6e4b74a2/latajaxoguxopaxaj.pdf
    • https://d926c97b-7f3b-4ec8-a52a-318bcb589338.filesusr.com/ugd/120f26_60283102eaea4c5699be1b0b8a00e939.pdf?index=true
    • https://661c91a2-68a2-4ae3-aaac-ef96b6cc7894.filesusr.com/ugd/b926a8_63a5831c54f14b0baaa99e1808a4d6c6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017116.bin
45887d15ed25eef159dd01879e1e024f634ee88d16e6badd682945c0b50fb888		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17116 5156 bytes
font_01_sfnt_off0001828e.bin
956db3a8e9f6b6cf60998815e795cd1d4351954fe1d804e6216185f2ca0b8418		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1828E 13608 bytes
font_02_sfnt_off0001af46.bin
456eb11b317affc4505686d114f08c5e635aad4379325254a126ee5b9e0c802f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF46 16404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.